Function at 0x405830
Capabilities:
Encode data using xor
Get common file path
Hash data using sha256
Write file on windows

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x328
push esi
push edi
mov edx, 0x20
lea ecx, [ebp - 0x70]
call fcn.00405db0
mov edx, 0x20
lea ecx, [ebp - 0x30]
call fcn.00405db0
push 0x425138
lea edx, [ebp - 0x70]
lea ecx, [ebp - 0x90]
call fcn.00404b00
add esp, 4
lea edx, [ebp - 0x30]
lea ecx, [ebp - 0xb0]
push 0x425138
call fcn.00404b00
add esp, 4
lea edx, [ebp - 0x70]
lea ecx, [ebp - 0x50]
push 0x423160
call fcn.00404b00
add esp, 4
mov dword [ebp - 0x118], 0x6a09e667
xorps xmm0, xmm0
mov dword [ebp - 0x114], 0xbb67ae85
lea edx, [ebp - 0x50]
movlpd qword [ebp - 0x120], xmm0
lea ecx, [ebp - 0x120]
mov dword [ebp - 0x110], 0x3c6ef372
push 0x20
mov dword [ebp - 0x10c], 0xa54ff53a
mov dword [ebp - 0x108], 0x510e527f
mov dword [ebp - 0x104], 0x9b05688c
mov dword [ebp - 0x100], 0x1f83d9ab
mov dword [ebp - 0xfc], 0x5be0cd19
mov dword [ebp - 0xf8], 0
call fcn.00407e20
add esp, 4
lea edx, [ebp - 0x50]
lea ecx, [ebp - 0x120]
call fcn.00407ea0
push 0x70
lea eax, [ebp - 0x120]
push 0
push eax
call fcn.00409030
add esp, 0xc
lea esi, [ebp - 0x50]
or eax, 0xffffffff
mov edi, 0x20
nop dword [eax + eax]
movzx ecx, byte [esi]
lea esi, [esi + 1]
mov edx, eax
shl eax, 8
shr edx, 0x18
xor edx, ecx
xor eax, dword [edx*4 + 0x422d60]
sub edi, 1
jne 0x405950
xor ecx, ecx
nop
movups xmm0, xmmword [ebp + ecx - 0x30]
movups xmm1, xmmword [ebp + ecx - 0x50]
pxor xmm1, xmm0
movups xmmword [ebp + ecx - 0x30], xmm1
add ecx, 0x10
cmp ecx, 0x20
jb 0x405970
movups xmm0, xmmword [ebp - 0x30]
mov dword [0x42a8c8], eax
mov ecx, 0x20
lea eax, [ebp - 0x70]
movups xmmword [0x42a868], xmm0
movups xmm0, xmmword [ebp - 0x20]
movups xmmword [0x42a878], xmm0
movups xmm0, xmmword [ebp - 0xb0]
movups xmmword [0x42a888], xmm0
movups xmm0, xmmword [ebp - 0xa0]
movups xmmword [0x42a898], xmm0
movups xmm0, xmmword [ebp - 0x90]
movups xmmword [0x42a8a8], xmm0
movups xmm0, xmmword [ebp - 0x80]
movups xmmword [0x42a8b8], xmm0
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x4059e3
mov ecx, 0x20
lea eax, [ebp - 0x90]
nop dword [eax]
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x405a00
mov ecx, 0x20
lea eax, [ebp - 0x30]
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x405a13
mov ecx, 0x20
lea eax, [ebp - 0xb0]
nop dword [eax]
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x405a30
mov ecx, 0x20
lea eax, [ebp - 0x50]
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x405a43
lea eax, [ebp - 0x328]
push eax
push ecx
push ecx
push 0x23
push ecx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push 0x4250d0
lea eax, [ebp - 0x328]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0
push 0x80
push 1
push 0
push 0
push 0x40000000
lea eax, [ebp - 0x328]
mov dword [ebp - 4], 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x405aba
push 0
lea eax, [ebp - 4]
push eax
push 0x64
push 0x42a868
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret