Function at 0x498670
Capabilities:
Copy file
Encode data using xor
Move file

Disassembly:
mov eax, 0x500db1
call fcn.00500754
sub esp, 0x1e0
push ebx
push esi
push edi
xor ebx, ebx
push ebx
call dword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
pop ecx
push eax
call dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
mov dword [esp], 0x104
lea eax, [ebp - 0x1ec]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x498871
lea ecx, [ebp - 0x2c]
call fcn.004ac9e7
lea ecx, [ebp - 0xe0]
mov dword [ebp - 4], ebx
call fcn.004ac9e7
mov byte [ebp - 4], 1
lea eax, [ebp - 0x2c]
cmp dword [ebp - 0x18], 0xf
cmova eax, dword [ebp - 0x2c]
push eax
lea eax, [ebp - 0x1ec]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
je 0x49885e
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x8c]
call fcn.004a299c
push dword [ebp - 0x14]
mov byte [ebp - 4], 2
push ecx
lea ecx, [ebp - 0x97]
call fcn.004a3478
push ecx
push 9
lea ecx, [ebp - 0x5c]
mov esi, eax
call fcn.004a28e9
mov edx, ebx
mov cl, byte [esi + edx + 1]
lea eax, [ebp - 0x5c]
xor cl, byte [esi]
cmp dword [ebp - 0x48], 0xf
cmova eax, dword [ebp - 0x5c]
mov byte [eax + edx], cl
inc edx
cmp edx, 9
jb 0x49871d
lea eax, [ebp - 0x1ec]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0xc8]
call fcn.004a2965
mov esi, eax
lea eax, [ebp - 0x1ec]
mov byte [ebp - 4], 4
push eax
lea ecx, [ebp - 0xb0]
call fcn.004a2965
mov edx, eax
mov byte [ebp - 4], 5
cmp dword [edx + 0x14], 0xf
mov eax, dword [edx + 0x10]
jbe 0x498776
mov edx, dword [edx]
test eax, eax
je 0x498795
dec eax
or ecx, 0xffffffff
cmp eax, ecx
cmovb ecx, eax
add ecx, edx
jmp 0x49878c
cmp ecx, edx
je 0x498795
dec ecx
cmp byte [ecx], 0x5c
jne 0x498787
sub ecx, edx
jmp 0x498798
or ecx, 0xffffffff
xor eax, eax
lea edi, [ebp - 0x44]
stosd dword es:[edi], eax
inc ecx
cmp dword [esi + 0x10], ecx
push 0xf
cmovb ecx, dword [esi + 0x10]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
pop edi
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], ebx
cmp dword [esi + 0x14], edi
jbe 0x4987b9
mov esi, dword [esi]
push ecx
push esi
lea ecx, [ebp - 0x44]
call fcn.004a622b
lea eax, [ebp - 0x5c]
mov byte [ebp - 4], 6
push eax
lea eax, [ebp - 0x44]
push eax
push dword [ebp - 0x14]
lea ecx, [ebp - 0x74]
call fcn.004a6636
mov edx, dword [ebp - 0x30]
cmp edx, edi
jbe 0x4987ea
mov ecx, dword [ebp - 0x44]
inc edx
call fcn.004a62c6
lea ecx, [ebp - 0xb0]
call fcn.004a2890
lea ecx, [ebp - 0xc8]
call fcn.004a2890
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 0xb
call fcn.004a2890
cmp dword [ebp - 0x60], edi
lea ecx, [ebp - 0x74]
push ebx
cmova ecx, dword [ebp - 0x74]
lea eax, [ebp - 0x8c]
cmp dword [ebp - 0x78], edi
push ecx
cmova eax, dword [ebp - 0x8c]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x49884b
cmp dword [ebp - 0x18], edi
lea eax, [ebp - 0x2c]
push dword [ebp - 0x1c]
cmova eax, dword [ebp - 0x2c]
mov ecx, 0x658fc4
push eax
call fcn.004a2e2c
lea ecx, [ebp - 0x74]
call fcn.004a2890
lea ecx, [ebp - 0x8c]
call fcn.004a2890
lea ecx, [ebp - 0xe0]
call fcn.004a2890
lea ecx, [ebp - 0x2c]
call fcn.004a2890
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret