Function at 0x100427a0
Capabilities:
Check if file exists
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
mov ecx, 0x101d8890
push 0xffffffffffffffff
push 0x100925c8
push eax
mov dword fs:[0], esp
sub esp, 0x148
push esi
call fcn.10062c20
mov esi, dword [0x101d88a0]
cmp esi, 4
je 0x10042834
mov edx, 0x92
xor ecx, ecx
nop dword [eax + eax]
mov al, byte [ecx + 0x100a8c70]
xor al, dl
mov byte [ebp + ecx - 0x32], al
inc ecx
lea eax, [edx + 1]
movzx edx, al
cmp ecx, 0x19
jb 0x100427e0
push esi
lea eax, [ebp - 0x32]
mov byte [ebp - 0x19], 0
push eax
lea eax, [ebp - 0x154]
push eax
call fcn.1002c420
add esp, 0xc
lea eax, [ebp - 0x154]
mov edx, 2
push 0x1388
push eax
push ecx
mov ecx, 0x101d8768
call fcn.100635d0
add esp, 0xc
call fcn.10062f90
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
lea eax, [ebp - 0x13]
push eax
mov dword [ebp - 0x13], 0x41505942
mov word [ebp - 0xf], 0x5353
mov byte [ebp - 0xd], 0
call esi
test eax, eax
je 0x1004287a
push 0xbb8
push 0x1b
call fcn.1005c660
push eax
push ecx
mov edx, 2
mov ecx, 0x101d8768
call fcn.100635d0
add esp, 0xc
call fcn.10062f90
push 0x3a0a2084
lea ecx, [ebp - 0x14]
call fcn.10058ec0
push eax
call esi
test eax, eax
jne 0x10042855
mov eax, str.0_4__J
lea ecx, [ebp - 0x14]
sub eax, 0x1357750e
push eax
call fcn.10058f30
push eax
call esi
test eax, eax
jne 0x10042855
mov eax, str.bxrbwv
lea ecx, [ebp - 0x14]
sub eax, 0x6b84c2cd
push eax
call fcn.10058fa0
push eax
call esi
test eax, eax
jne 0x10042855
mov eax, 0x100a8ca4
lea ecx, [ebp - 0x16]
sub eax, 0x7ad32036
push eax
call fcn.10059010
push eax
call esi
test eax, eax
jne 0x10042855
mov edx, 0x98
xor ecx, ecx
nop word [eax + eax]
mov al, byte [ecx + 0x100a8cb0]
xor al, dl
mov byte [ebp + ecx - 0x18], al
inc ecx
lea eax, [edx + 1]
movzx edx, al
cmp ecx, 0xb
jb 0x100428f0
lea eax, [ebp - 0x18]
mov byte [ebp - 0xd], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x10042926
push 0xbb8
push 0x1c
jmp 0x1004285c
mov eax, dword [0x101da344]
cmp byte [eax], 0x55
je 0x1004296f
mov eax, 0x100a8cbc
lea ecx, [ebp - 0x34]
sub eax, 0x2bf74a70
push eax
call fcn.10059090
mov dword [ebp - 4], 0
push 0xbb8
push eax
push ecx
mov edx, 2
mov ecx, 0x101d8768
call fcn.100635d0
add esp, 0xc
mov dword [ebp - 4], 0xffffffff
jmp 0x10042875
mov eax, dword [0x101da37c]
cmp byte [eax], 0x55
je 0x1004298f
push 0x667bdbf2
lea ecx, [ebp - 0x34]
call fcn.100590d0
mov dword [ebp - 4], 1
jmp 0x1004294a
mov edx, dword [0x101ce418]
xor ecx, ecx
mov esi, dword [0x101da894]
sub edx, 0x101ce41c
sub esi, 0x101ce41c
nop dword [eax]
cmp byte [0x101ce435], 0
jne 0x100429c8
mov al, byte [ecx + edx + 0x101ce41c]
cmp al, byte [ecx + 0x101ce41c]
jne 0x10042a01
mov al, byte [ecx + esi + 0x101ce41c]
cmp al, byte [ecx + 0x101ce662]
jne 0x10042aae
mov eax, ecx
add eax, 0x1005f7a0
mov al, byte [eax]
cmp al, byte [ecx + 0x101ce658]
jne 0x10042a40
inc ecx
cmp ecx, 5
jl 0x100429b0
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
mov edx, 0xe5
xor ecx, ecx
nop dword [eax + eax]
mov al, byte [ecx + 0x100a8cf4]
xor al, dl
mov byte [ebp + ecx - 0x34], al
inc ecx
lea eax, [edx + 1]
movzx edx, al
cmp ecx, 0x1b
jb 0x10042a10
mov byte [ebp - 0x19], 0
mov dword [ebp - 4], 2
lea eax, [ebp - 0x34]
push 0xbb8
jmp 0x1004294f
mov edx, 0x21
xor ecx, ecx
nop word [eax + eax]
mov al, byte [ecx + str.qJBP]
xor al, dl
mov byte [ebp + ecx - 0x50], al
inc ecx
lea eax, [edx + 1]
movzx edx, al
cmp ecx, 0x1b
jb 0x10042a50
mov byte [ebp - 0x35], 0
push 0xbb8
lea eax, [ebp - 0x50]
mov dword [ebp - 4], 4
push eax
push ecx
mov edx, 2
mov ecx, 0x101d8768
call fcn.100635d0
mov dword [ebp - 4], 0xffffffff
xorps xmm0, xmm0
add esp, 0xc
movq qword [ebp - 0x40], xmm0
movups xmmword [ebp - 0x50], xmm0
mov dword [ebp - 0x38], 0
jmp 0x10042875
mov edx, 0x53
xor ecx, ecx
nop word [eax + eax]
mov al, byte [ecx + 0x100a8d10]
xor al, dl
mov byte [ebp + ecx - 0x34], al
inc ecx
lea eax, [edx + 1]
movzx edx, al
cmp ecx, 0x1b
jb 0x10042ac0
mov byte [ebp - 0x19], 0
mov dword [ebp - 4], 3
lea eax, [ebp - 0x34]
push 0xbb8
jmp 0x1004294f
mov eax, dword [0xe8c578]
inc dword [0x10b3c490]
push esi
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0x11
mov dword [0x101ce3f0], eax
call esi
test ax, ax
je 0x10053274
push dword [0x101ce3b4]
call esi
test ax, ax
je 0x1005326d
cmp byte [0x101ce3b8], 0
jne 0x10053274
mov byte [0x101ce3b8], 1
mov esi, dword [0xe8c578]
call dword [sym.imp.USER32.dll_GetForegroundWindow]
cmp eax, esi
je 0x10053274
cmp byte [0x101ce36b], 0
je 0x10053274
push 5
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [0xe8c578]
call dword [sym.imp.USER32.dll_UpdateWindow]
jmp 0x10053274
mov byte [0x101ce3b8], 0
cmp dword [0x10b3c490], 0x96
pop esi
jl 0x100532a2
cmp byte [0x101ce434], 0
mov dword [0x10b3c490], 0
mov dword [0x101d88a0], 0
je 0x100427a0
ret