Function at 0x49df3a
Capabilities:
Encode data using xor
Get common file path

Disassembly:
mov eax, 0x4bf91b
call fcn.004be928
sub esp, 0xd0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x40], ecx
xor edi, edi
inc edi
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x20], 0xfffffffd
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov eax, 0x5b0bb8bf
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x24], 0xfffd
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], 0xcefbde28
push edi
lea ecx, [ebp - 0xa8]
call fcn.0043557d
mov dword [ebp - 0x1c], ebx
jmp 0x49dfb1
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xa8]
mov dword [eax + ecx*4], 0xbbb66efe
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x49df9e
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x80], eax
mov eax, dword [ebp - 0x24]
mov edx, dword [ebp - 0x18]
dec edx
neg edx
sbb edx, edx
neg edx
mov eax, dword [ebp - 0x18]
xor ecx, ecx
cmp eax, edx
setle cl
imul eax, ecx, 0x32c5
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], ebx
jne 0x49dfeb
cmp dword [ebp - 0x28], ebx
mov eax, ebx
je 0x49dfed
mov eax, edi
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x80]
mov eax, dword [ebp - 0x20]
xor edx, edx
cmp ecx, eax
setge dl
mov esi, dword [ebp - 0x20]
imul esi, edx
neg esi
sbb esi, esi
neg esi
mov eax, dword [ebp - 0x18]
xor ecx, ecx
cmp esi, eax
setne cl
mov eax, dword [ebp - 0xa8]
mov dword [eax], ecx
lea ecx, [ebp - 0xa8]
call fcn.0043564f
push 4
lea ecx, [ebp - 0x9c]
call fcn.0043557d
mov dword [ebp - 0x20], 0x65c829e
push 8
pop ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x18], 0x7b18
mov dword [ebp - 0x1c], 0xffffffff
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x18]
jl 0x49e098
mov dword [ebp - 0x24], 2
mov dword [ebp - 0x18], 0x17
jmp 0x49e084
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], bl
je 0x49e081
push 0x23ac
push 0x14d1
call dword [sym.imp.USER32.dll_IsDlgButtonChecked]
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x25
jge 0x49e069
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x1c], eax
push 3
pop esi
jmp 0x49e163
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 0x68], ebx
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x1c], ebx
push 3
pop esi
jmp 0x49e145
mov dword [ebp - 0x20], edi
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], bl
je 0x49e0cb
push ebx
push ebx
push ebx
push 0x8ac
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
mov dword [ebp - 0x18], ebx
jmp 0x49e0e4
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], bl
je 0x49e0e1
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jle 0x49e0d0
mov dword [ebp - 0x18], ebx
jmp 0x49e13d
mov dword [ebp - 0x28], 7
mov dword [ebp - 0x24], 0xe56e31bb
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], bl
je 0x49e110
push 0x15dd
push ebx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x6c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
xor edx, edx
cmp eax, 5
setge dl
mov eax, dword [ebp - 0x64]
sub edx, eax
mov eax, dword [ebp - 0x28]
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [ebp - 0x24], ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jle 0x49e0ee
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jle 0x49e0b2
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], bl
je 0x49e163
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], bl
je 0x49e17b
push 0x2f6
push 0x93d
call dword [sym.imp.GDI32.dll_SetTextAlign]
mov dword [ebp - 0x50], 0x9015
mov dword [ebp - 0x28], 0xfff6
mov dword [ebp - 0x18], 0xecf4a416
push esi
lea ecx, [ebp - 0xb4]
call fcn.0043557d
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x1c], ebx
jmp 0x49e1ba
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xb4]
mov dword [eax + ecx*4], 5
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x49e1a7
mov dword [ebp - 0x28], edi
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0xb4]
mov dword [eax + 4], ebx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
mov ecx, 0xfffe
cmp ecx, eax
sbb ecx, ecx
add ecx, 0xfffff5b5
neg ecx
sbb ecx, ecx
inc ecx
xor eax, eax
cmp ecx, 0xffffffff
setg al
imul eax, dword [ebp - 0x20]
xor ecx, ecx
cmp eax, 0x7fce6bb2
setle cl
mov eax, dword [ebp - 0x28]
xor edx, edx
cmp eax, ecx
setl dl
sub edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [ebp - 0x24], ecx
lea ecx, [ebp - 0xb4]
call fcn.0043564f
push esi
lea ecx, [ebp - 0x90]
call fcn.0043557d
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x24], 0x4eea2a3b
mov dword [ebp - 0x24], edi
push edi
lea ecx, [ebp - 0xc0]
call fcn.0043557d
mov dword [ebp - 0x24], 0x21afa9b6
mov dword [ebp - 0x18], ebx
jmp 0x49e26b
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xcc], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x49e25e
mov dword [ebp - 0x18], ebx
jmp 0x49e288
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xc0]
mov dword [eax + ecx*4], 0xfffffffb
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x49e275
mov dword [ebp - 0x18], ebx
jmp 0x49e2a0
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x38], 0xf1a969ac
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x49e292
mov dword [ebp - 0x1c], ebx
jmp 0x49e2f7
push edi
lea ecx, [ebp - 0x5c]
call fcn.0043557d
mov dword [ebp - 0x18], ebx
jmp 0x49e2c4
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x5c]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x49e2b8
mov eax, dword [ebp - 0x5c]
mov dword [eax], ebx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp + eax*4 - 0xcc]
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xcc], ecx
mov eax, dword [ebp - 0x5c]
inc dword [eax]
cmp dword [eax], 2
jle 0x49e2ce
lea ecx, [ebp - 0x5c]
call fcn.0043564f
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jle 0x49e2aa
mov dword [ebp - 0x18], 0x25b6
cmp dword [ebp - 0x18], 0x2852
jle 0x49e374
mov edi, ebx
mov dword [ebp - 0x1c], ebx
mov ecx, ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x20], ebx
mov eax, edi
cdq
idiv ecx
mov edi, edx
mov esi, ebx
mov ebx, dword [ebp - 0x20]
lea eax, [esi + ebx]
xor eax, edi
cdq
push edx
push eax
mov ecx, 0xab56b8
call fcn.00435439
inc esi
cmp esi, 0x5ea0
jl 0x49e326
inc ebx
mov dword [ebp - 0x20], ebx
cmp ebx, 0xabe
push 0
pop ebx
jl 0x49e321
mov ecx, dword [ebp - 0x28]
inc ecx
mov dword [ebp - 0x28], ecx
cmp ecx, 0xf89
mov edi, dword [ebp - 0x1c]
jl 0x49e317
inc edi
mov dword [ebp - 0x1c], edi
cmp edi, 0x32d6
jl 0x49e312
xor edi, edi
inc edi
push 3
pop esi
inc dword [ebp - 0x38]
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x18], 0x2404
jge 0x49e392
mov edx, str.ksjmg_tpsl_miljxj_bmkxe_mppki_lwvvztfdj_xxe_diaoirt_mmj_uydaer_skr_hezftywvj
mov ecx, 0xab56b8
call fcn.004371ef
or dword [ebp - 4], 0xffffffff
jmp 0x49e3be
lea ecx, [ebp - 0xc0]
call fcn.0043564f
lea edx, [ebp - 0x9c]
lea ecx, [ebp - 0x30]
call fcn.0049dcff
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x1c], 0xfffffffe
mov dword [ebp - 0x18], ebx
jmp 0x49e450
movdqa xmm0, xmmword [0xaaa830]
movdqu xmmword [ebp - 0xdc], xmm0
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x44], ebx
push dword [ebp - 0x3c]
lea eax, [ebp - 0xcc]
push eax
lea eax, [ebp - 0xdc]
push eax
push ebx
lea ecx, [ebp - 0x4c]
call fcn.00437747
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x4c]
mov dword [eax], edi
mov dword [ebp - 0x1c], ebx
jmp 0x49e43f
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x49e43c
push ebx
call dword [sym.imp.GDI32.dll_CreateBrushIndirect]
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xfffffffd
jge 0x49e42c
lea ecx, [ebp - 0x4c]
call fcn.0043564f
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xffffffeb
jle 0x49e3e6
mov dword [ebp - 0x18], 0x6ff23b1a
mov dword [ebp - 0x20], 0xa01c77dc
mov dword [ebp - 0x1c], ebx
jmp 0x49e477
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x74], 0x7084bc9c
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x49e469
cmp dword [ebp - 0x18], ebx
jne 0x49e48e
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x18], ebx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x70]
mov eax, dword [ebp - 0x70]
neg eax
sbb eax, eax
neg eax
cmp edi, eax
sbb eax, eax
inc eax
mov byte [ebp - 0x11], bl
cmp eax, 0x8e99
jg 0x49e4cd
cmp byte [ebp - 0x11], 0
je 0x49e4b7
push 0x37f
call dword [sym.imp.USER32.dll_IsWindow]
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x49e4db
push 0x1255
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
jmp 0x49e4db
cmp byte [ebp - 0x11], 0
je 0x49e4db
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WaitNamedPipeA]
inc dword [ebp - 0x20]
mov dword [ebp - 0x30], ebx
jmp 0x49e4f6
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x90]
mov dword [eax + ecx*4], 0x3624b674
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], esi
jl 0x49e4e3
mov eax, dword [ebp - 0x9c]
mov eax, dword [eax + 8]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x34]
xor edx, edx
cmp eax, ecx
setle dl
cmp edx, dword [ebp - 0x2c]
je 0x49e528
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x90]
mov dword [eax + 8], 0x82b357f0
lea ecx, [ebp - 0x90]
call fcn.0043564f
lea ecx, [ebp - 0x9c]
call fcn.0043564f
mov eax, dword [ebp - 0x3c]
cdq
mov ecx, 0x3e8
idiv ecx
mov edi, edx
mov esi, eax
mov ecx, dword [ebp - 0x40]
call fcn.0049dc89
add eax, esi
add eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret