Function at 0x402fd0
Capabilities:
Delete file
Encode data using xor

Disassembly:
push 0xffffffffffffffff
push 0x429979
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x510
push ebx
push ebp
mov ebp, ecx
push esi
push edi
lea ecx, [esp + 0x18]
call fcn.00405410
xor ebx, ebx
mov ecx, 0x7f
xor eax, eax
lea edi, [esp + 0x21]
mov byte [esp + 0x20], bl
mov byte [esp + 0x220], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x7f
xor eax, eax
lea edi, [esp + 0x221]
mov dword [esp + 0x528], ebx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
cmp dword [esp + 0x530], ebx
je 0x403054
push 0xa
mov ecx, ebp
call fcn.00403a30
push eax
lea ecx, [ebp + 0x5c]
call fcn.0041e764
push ebx
mov ecx, ebp
call fcn.00420a53
lea eax, [ebp + 0x70]
lea ecx, [esp + 0x18]
push eax
call fcn.00405470
test al, al
je 0x40372d
lea ecx, [esp + 0x20]
push 1
push ecx
push 1
lea ecx, [esp + 0x24]
call fcn.004054a0
test al, al
je 0x403724
mov esi, 0x438010
lea edi, [esp + 0x20]
mov dl, byte [edi]
mov cl, byte [esi]
mov al, dl
cmp dl, cl
jne 0x4030b4
cmp al, bl
je 0x4030b0
mov cl, byte [edi + 1]
mov dl, byte [esi + 1]
mov al, cl
cmp cl, dl
jne 0x4030b4
add edi, 2
add esi, 2
cmp al, bl
jne 0x40308c
xor eax, eax
jmp 0x4030b9
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x403724
mov ecx, 0x80
xor eax, eax
lea edi, [esp + 0x220]
xor esi, esi
rep stosd dword es:[edi], eax
call fcn.0040db77
mov byte [esp + esi + 0x220], al
inc esi
cmp esi, 0x200
jl 0x4030d3
lea edx, [esp + 0x220]
push 1
push edx
push 2
lea ecx, [esp + 0x24]
mov byte [esp + 0x22c], 0x41
mov byte [esp + 0x22d], 0x43
mov byte [esp + 0x22e], 0x4b
mov byte [esp + 0x22f], 0x52
mov byte [esp + 0x230], bl
call fcn.00405480
mov al, byte [esp + 0x233]
mov ecx, 0x80
mov byte [esp + 0x14], al
xor eax, eax
lea edi, [esp + 0x20]
push 1
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x24]
push ecx
push 2
lea ecx, [esp + 0x24]
call fcn.004054a0
xor eax, eax
mov dl, byte [esp + eax + 0x20]
mov cl, byte [esp + eax + 0x28]
xor cl, dl
mov byte [esp + eax + 0x28], cl
inc eax
cmp eax, 8
jl 0x403150
mov edi, dword [esp + 0x14]
xor eax, eax
and edi, 0xff
mov dword [esp + 0x1c], edi
mov ecx, edi
and ecx, 0xff
mov dl, byte [ecx + 0x42b678]
mov cl, byte [esp + eax + 0x20]
xor cl, dl
mov byte [esp + eax + 0x20], cl
inc eax
inc edi
cmp eax, 0x10
jl 0x403174
mov esi, str.CN_SZ_GR299123
lea edi, [esp + 0x20]
mov cl, byte [edi]
mov dl, byte [esi]
mov al, cl
cmp cl, dl
jne 0x4031c4
cmp al, bl
je 0x4031c0
mov dl, byte [edi + 1]
mov cl, byte [esi + 1]
mov al, dl
cmp dl, cl
jne 0x4031c4
add edi, 2
add esi, 2
cmp al, bl
jne 0x40319c
xor eax, eax
jmp 0x4031c9
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x403724
cmp dword [esp + 0x530], ebx
je 0x4035fc
mov eax, dword [esp + 0x40]
mov ecx, dword [esp + 0x44]
mov edx, dword [esp + 0x48]
mov dword [ebp + 0x90], eax
mov eax, dword [esp + 0x4c]
mov dword [ebp + 0x88], ecx
mov ecx, dword [esp + 0x50]
mov dword [ebp + 0x94], eax
mov eax, dword [esp + 0x58]
mov dword [ebp + 0x84], edx
mov edx, dword [esp + 0x54]
mov dword [esp + 0x424], eax
mov al, byte [ebp + 0x90]
mov dword [ebp + 0x8c], ecx
mov ecx, dword [esp + 0x5c]
cmp al, 0x41
mov dword [esp + 0x420], edx
mov dword [esp + 0x428], ecx
jl 0x403245
cmp al, 0x5a
jg 0x403245
mov byte [esp + 0x13], al
jmp 0x403283
mov al, byte [ebp + 0x84]
cmp al, 0x41
jl 0x403259
cmp al, 0x5a
jg 0x403259
mov byte [esp + 0x13], al
jmp 0x403283
mov al, byte [ebp + 0x94]
cmp al, 0x41
jl 0x40326d
cmp al, 0x5a
jg 0x40326d
mov byte [esp + 0x13], al
jmp 0x403283
mov al, byte [ebp + 0x8c]
cmp al, 0x41
jl 0x40327f
cmp al, 0x5a
mov byte [esp + 0x13], al
jle 0x403283
mov byte [esp + 0x13], bl
lea edi, [ebp + 0x98]
lea esi, [esp + 0x420]
mov dl, byte [esi]
mov cl, byte [edi]
mov al, dl
cmp dl, cl
jne 0x4032b8
cmp al, bl
je 0x4032b4
mov cl, byte [esi + 1]
mov dl, byte [edi + 1]
mov al, cl
cmp cl, dl
jne 0x4032b8
add esi, 2
add edi, 2
cmp al, bl
jne 0x403290
xor eax, eax
jmp 0x4032bd
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x4032d0
mov dl, byte [esp + 0x13]
mov al, byte [ebp + 0x7c]
cmp dl, al
je 0x403359
mov eax, dword [ebp + 0xd0]
lea esi, [ebp + 0xd0]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, esi
call fcn.0041e4a5
mov edx, dword [esp + 0x420]
lea eax, [ebp + 0x98]
mov ecx, eax
mov dword [ecx], edx
mov edx, dword [esp + 0x424]
mov dword [ecx + 4], edx
mov edx, dword [esp + 0x428]
mov dword [ecx + 8], edx
mov cl, byte [esp + 0x13]
mov byte [ebp + 0x7c], cl
lea edx, [esp + 0x420]
movsx ecx, cl
push ecx
push eax
push str.http:__www.vstchina.com_uploadfiles_upLoadFile_Download__s__c.bin
push edx
call fcn.0040dc75
add esp, 0x10
lea esi, [ebp + 0xcc]
lea eax, [esp + 0x420]
mov ecx, esi
push eax
call fcn.0041e65f
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push esi
call fcn.0041e28f
mov ecx, ebp
call fcn.00403760
push 8
mov ecx, ebp
lea esi, [ebp + 0x5c]
call fcn.00403a30
push eax
mov ecx, esi
call fcn.0041e764
lea eax, [ebp + 0x84]
lea ecx, [esp + 0x14]
push eax
push ecx
mov ecx, ebp
call fcn.004038a0
push eax
mov ecx, esi
mov byte [esp + 0x52c], 1
call fcn.0041e7a0
lea ecx, [esp + 0x14]
mov byte [esp + 0x528], bl
call fcn.0041e51a
push 0x43806c
mov ecx, esi
call fcn.0041e764
lea eax, [ebp + 0x88]
lea edx, [esp + 0x14]
push eax
push edx
mov ecx, ebp
call fcn.004038a0
push eax
mov ecx, esi
mov byte [esp + 0x52c], 2
call fcn.0041e7a0
lea ecx, [esp + 0x14]
mov byte [esp + 0x528], bl
call fcn.0041e51a
push 0x43806c
mov ecx, esi
call fcn.0041e764
lea eax, [ebp + 0x8c]
mov ecx, ebp
push eax
lea eax, [esp + 0x18]
push eax
call fcn.004038a0
push eax
mov ecx, esi
mov byte [esp + 0x52c], 3
call fcn.0041e7a0
lea ecx, [esp + 0x14]
mov byte [esp + 0x528], bl
call fcn.0041e51a
push 0x43806c
mov ecx, esi
call fcn.0041e764
lea eax, [ebp + 0x90]
lea ecx, [esp + 0x14]
push eax
push ecx
mov ecx, ebp
call fcn.004038a0
push eax
mov ecx, esi
mov byte [esp + 0x52c], 4
call fcn.0041e7a0
lea ecx, [esp + 0x14]
mov byte [esp + 0x528], bl
call fcn.0041e51a
push 0x43806c
mov ecx, esi
call fcn.0041e764
lea eax, [ebp + 0x94]
lea edx, [esp + 0x14]
push eax
push edx
mov ecx, ebp
call fcn.004038a0
push eax
mov ecx, esi
mov byte [esp + 0x52c], 5
call fcn.0041e7a0
lea ecx, [esp + 0x14]
mov byte [esp + 0x528], bl
call fcn.0041e51a
push 0x437fac
mov ecx, esi
call fcn.0041e764
push 9
mov ecx, ebp
call fcn.00403a30
push eax
mov ecx, esi
call fcn.0041e764
lea eax, [ebp + 0xa4]
lea ecx, [esp + 0x14]
push eax
push ecx
mov ecx, ebp
call fcn.004038a0
push eax
mov ecx, esi
mov byte [esp + 0x52c], 6
call fcn.0041e7a0
lea ecx, [esp + 0x14]
mov byte [esp + 0x528], bl
call fcn.0041e51a
push 0x43806c
mov ecx, esi
call fcn.0041e764
lea edx, [ebp + 0xa8]
lea eax, [esp + 0x14]
push edx
push eax
mov ecx, ebp
call fcn.004038a0
push eax
mov ecx, esi
mov byte [esp + 0x52c], 7
call fcn.0041e7a0
lea ecx, [esp + 0x14]
mov byte [esp + 0x528], bl
call fcn.0041e51a
push 0x43806c
mov ecx, esi
call fcn.0041e764
lea ecx, [ebp + 0xac]
lea edx, [esp + 0x14]
push ecx
push edx
mov ecx, ebp
call fcn.004038a0
push eax
mov ecx, esi
mov byte [esp + 0x52c], 8
call fcn.0041e7a0
lea ecx, [esp + 0x14]
mov byte [esp + 0x528], bl
call fcn.0041e51a
push 0x43806c
mov ecx, esi
call fcn.0041e764
lea eax, [ebp + 0xb0]
lea ecx, [esp + 0x14]
push eax
push ecx
mov ecx, ebp
call fcn.004038a0
push eax
mov ecx, esi
mov byte [esp + 0x52c], 9
call fcn.0041e7a0
mov byte [esp + 0x528], bl
lea ecx, [esp + 0x14]
call fcn.0041e51a
push 0x43806c
mov ecx, esi
call fcn.0041e764
lea edx, [ebp + 0xb4]
lea eax, [esp + 0x14]
push edx
push eax
mov ecx, ebp
call fcn.004038a0
push eax
mov ecx, esi
mov byte [esp + 0x52c], 0xa
call fcn.0041e7a0
lea ecx, [esp + 0x14]
mov byte [esp + 0x528], bl
call fcn.0041e51a
push 0x437fac
mov ecx, esi
call fcn.0041e764
push ebx
mov ecx, ebp
call fcn.00420a53
mov ecx, 0x80
xor eax, eax
lea edi, [esp + 0x20]
push 1
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x24]
mov byte [esp + 0x24], 0x41
push ecx
push 2
lea ecx, [esp + 0x24]
mov byte [esp + 0x2d], 0x43
mov byte [esp + 0x2e], 0x4b
mov byte [esp + 0x2f], 0x57
call fcn.00405480
mov edx, dword [str.CN_SZ_GR2991CD]
mov eax, dword [0x4350f4]
mov ecx, dword [0x4350f8]
mov dword [esp + 0x220], edx
mov edx, dword [0x4350fc]
mov dword [esp + 0x224], eax
mov dword [esp + 0x228], ecx
mov dword [esp + 0x22c], edx
xor eax, eax
mov cl, byte [esp + eax + 0x220]
mov dl, byte [esp + eax + 0x228]
xor dl, cl
mov byte [esp + eax + 0x228], dl
inc eax
cmp eax, 8
jl 0x403664
mov eax, dword [esp + 0x1c]
mov edx, eax
and edx, 0xff
mov cl, byte [edx + 0x42b678]
mov dl, byte [esp + ebx + 0x220]
xor dl, cl
mov byte [esp + ebx + 0x220], dl
inc ebx
inc eax
cmp ebx, 0x10
jl 0x403685
mov ecx, dword [ebp + 0xa4]
mov edx, dword [ebp + 0xb0]
mov eax, dword [ebp + 0xa8]
mov dword [esp + 0x248], ecx
lea ecx, [esp + 0x220]
mov dword [esp + 0x240], edx
mov edx, dword [ebp + 0xb4]
mov dword [esp + 0x244], eax
mov eax, dword [ebp + 0xac]
push 1
push ecx
push 2
lea ecx, [esp + 0x24]
mov dword [esp + 0x258], edx
mov dword [esp + 0x25c], eax
call fcn.00405480
lea ecx, [esp + 0x18]
call fcn.00405460
lea ecx, [esp + 0x18]
mov dword [esp + 0x528], 0xffffffff
call fcn.004054c0
mov eax, 1
jmp 0x403743
lea ecx, [esp + 0x18]
call fcn.00405460
lea ecx, [esp + 0x18]
mov dword [esp + 0x528], 0xffffffff
call fcn.004054c0
xor eax, eax
mov ecx, dword [esp + 0x520]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x51c
ret 4