Function at 0x10002690
Capabilities:
Authenticate hmac
Check if file exists
Encode data using xor
Get file attributes
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x54c
mov eax, dword [0x1026e004]
xor eax, esp
mov dword [esp + 0x548], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [esp + 0x340]
push esi
push edi
push ebx
push 0x208
push eax
mov eax, dword [0x102a8048]
mov edi, ecx
mov eax, dword [eax + 0xe8]
call eax
mov ax, word [esp + 0x348]
lea ecx, [esp + 0x348]
xor esi, esi
test ax, ax
je 0x100031d5
movzx edx, ax
nop word [eax + eax]
cmp dx, 0x5c
je 0x10002700
cmp dx, 0x2f
je 0x10002700
xor edx, edx
jmp 0x10002705
mov edx, 1
test edx, edx
mov eax, ecx
cmove eax, esi
add ecx, 2
mov esi, eax
movzx eax, word [ecx]
mov edx, eax
test ax, ax
jne 0x100026f0
test esi, esi
je 0x100031d5
xor eax, eax
mov word [esi], ax
lea eax, [esp + 0x348]
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push eax
call esi
test al, 0x10
je 0x1000305d
lea eax, [esp + 0x348]
push eax
push 0x208
lea eax, [esp + 0x148]
push eax
mov eax, dword [0x102a8048]
mov eax, dword [eax + 0xe8]
call eax
mov dword [esp + 0x10], 0x9099
mov eax, dword [esp + 0x10]
xor eax, 0x5c
mov word [esp + 0x14], ax
mov eax, dword [esp + 0x10]
inc eax
xor eax, 0x7b
mov word [esp + 0x16], ax
mov eax, dword [esp + 0x10]
add eax, 2
xor eax, 0x46
mov word [esp + 0x18], ax
mov eax, dword [esp + 0x10]
add eax, 3
xor eax, 0x42
mov word [esp + 0x1a], ax
mov eax, dword [esp + 0x10]
add eax, 4
xor eax, 0x37
mov word [esp + 0x1c], ax
mov eax, dword [esp + 0x10]
add eax, 5
xor eax, 0x37
mov word [esp + 0x1e], ax
mov eax, dword [esp + 0x10]
add eax, 6
xor eax, 0x30
mov word [esp + 0x20], ax
mov eax, dword [esp + 0x10]
add eax, 7
xor eax, 0x45
mov word [esp + 0x22], ax
mov eax, dword [esp + 0x10]
add eax, 8
xor eax, 0x30
mov word [esp + 0x24], ax
mov eax, dword [esp + 0x10]
add eax, 9
xor eax, 0x37
mov word [esp + 0x26], ax
mov eax, dword [esp + 0x10]
add eax, 0xa
xor eax, 0x2d
mov word [esp + 0x28], ax
mov eax, dword [esp + 0x10]
add eax, 0xb
xor eax, 0x37
mov word [esp + 0x2a], ax
mov eax, dword [esp + 0x10]
add eax, 0xc
xor eax, 0x42
mov word [esp + 0x2c], ax
mov eax, dword [esp + 0x10]
add eax, 0xd
xor eax, 0x33
mov word [esp + 0x2e], ax
mov eax, dword [esp + 0x10]
add eax, 0xe
xor eax, 0x42
mov word [esp + 0x30], ax
mov eax, dword [esp + 0x10]
add eax, 0xf
xor eax, 0x2d
mov word [esp + 0x32], ax
mov eax, dword [esp + 0x10]
add eax, 0x10
xor eax, 0x34
mov word [esp + 0x34], ax
mov eax, dword [esp + 0x10]
add eax, 0x11
xor eax, 0x43
mov word [esp + 0x36], ax
mov eax, dword [esp + 0x10]
add eax, 0x12
xor eax, 0x36
mov word [esp + 0x38], ax
mov eax, dword [esp + 0x10]
add eax, 0x13
xor eax, 0x32
mov word [esp + 0x3a], ax
mov eax, dword [esp + 0x10]
add eax, 0x14
xor eax, 0x2d
mov word [esp + 0x3c], ax
mov eax, dword [esp + 0x10]
add eax, 0x15
xor eax, 0x42
mov word [esp + 0x3e], ax
mov eax, dword [esp + 0x10]
add eax, 0x16
xor eax, 0x46
mov word [esp + 0x40], ax
mov eax, dword [esp + 0x10]
add eax, 0x17
xor eax, 0x31
mov word [esp + 0x42], ax
mov eax, dword [esp + 0x10]
add eax, 0x18
xor eax, 0x41
mov word [esp + 0x44], ax
mov eax, dword [esp + 0x10]
add eax, 0x19
xor eax, 0x2d
mov word [esp + 0x46], ax
mov eax, dword [esp + 0x10]
add eax, 0x1a
xor eax, 0x41
mov word [esp + 0x48], ax
mov eax, dword [esp + 0x10]
add eax, 0x1b
xor eax, 0x41
mov word [esp + 0x4a], ax
mov eax, dword [esp + 0x10]
add eax, 0x1c
xor eax, 0x39
mov word [esp + 0x4c], ax
mov eax, dword [esp + 0x10]
add eax, 0x1d
xor eax, 0x32
mov word [esp + 0x4e], ax
mov eax, dword [esp + 0x10]
add eax, 0x1e
xor eax, 0x42
mov word [esp + 0x50], ax
mov eax, dword [esp + 0x10]
add eax, 0x1f
xor eax, 0x32
mov word [esp + 0x52], ax
mov eax, dword [esp + 0x10]
add eax, 0x20
xor eax, 0x36
mov word [esp + 0x54], ax
mov eax, dword [esp + 0x10]
add eax, 0x21
xor eax, 0x36
mov word [esp + 0x56], ax
mov eax, dword [esp + 0x10]
add eax, 0x22
xor eax, 0x33
mov word [esp + 0x58], ax
mov eax, dword [esp + 0x10]
add eax, 0x23
xor eax, 0x35
mov word [esp + 0x5a], ax
mov eax, dword [esp + 0x10]
add eax, 0x24
xor eax, 0x32
mov word [esp + 0x5c], ax
mov eax, dword [esp + 0x10]
add eax, 0x25
xor eax, 0x44
mov word [esp + 0x5e], ax
mov eax, dword [esp + 0x10]
add eax, 0x26
xor eax, 0x7d
mov word [esp + 0x60], ax
mov eax, dword [esp + 0x10]
add eax, 0x27
xor eax, 0x2e
mov word [esp + 0x62], ax
mov eax, dword [esp + 0x10]
add eax, 0x28
xor eax, 0x78
mov word [esp + 0x64], ax
mov eax, dword [esp + 0x10]
add eax, 0x29
xor eax, 0x65
mov word [esp + 0x66], ax
mov eax, dword [esp + 0x10]
add eax, 0x2a
xor eax, 0x6d
mov word [esp + 0x68], ax
xor eax, eax
mov word [esp + 0x6a], ax
xor edx, edx
mov ax, word [esp + 0x14]
nop dword [eax + eax]
mov ax, word [esp + edx*2 + 0x14]
mov ecx, dword [esp + 0x10]
add ecx, edx
movzx eax, ax
xor ecx, eax
mov word [esp + edx*2 + 0x14], cx
inc edx
cmp edx, 0x2b
jb 0x10002a00
xor eax, eax
mov word [esp + 0x6a], ax
lea eax, [esp + 0x14]
push eax
push 0x208
lea eax, [esp + 0x148]
push eax
mov eax, dword [0x102a8048]
mov eax, dword [eax + 0xf0]
call eax
lea eax, [esp + 0x140]
push eax
call esi
cmp eax, 0xffffffff
jne 0x100031ac
lea eax, [esp + 0x348]
push eax
push 0x208
lea eax, [esp + 0x148]
push eax
mov eax, dword [0x102a8048]
mov eax, dword [eax + 0xe8]
call eax
mov dword [esp + 0x70], 0x8460
mov eax, dword [esp + 0x70]
xor eax, 0x5c
mov word [esp + 0x74], ax
mov eax, dword [esp + 0x70]
inc eax
xor eax, 0x7b
mov word [esp + 0x76], ax
mov eax, dword [esp + 0x70]
add eax, 2
xor eax, 0x39
mov word [esp + 0x78], ax
mov eax, dword [esp + 0x70]
add eax, 3
xor eax, 0x39
mov word [esp + 0x7a], ax
mov eax, dword [esp + 0x70]
add eax, 4
xor eax, 0x38
mov word [esp + 0x7c], ax
mov eax, dword [esp + 0x70]
add eax, 5
xor eax, 0x34
mov word [esp + 0x7e], ax
mov eax, dword [esp + 0x70]
add eax, 6
xor eax, 0x41
mov word [esp + 0x80], ax
mov eax, dword [esp + 0x70]
add eax, 7
xor eax, 0x42
mov word [esp + 0x82], ax
mov eax, dword [esp + 0x70]
add eax, 8
xor eax, 0x37
mov word [esp + 0x84], ax
mov eax, dword [esp + 0x70]
add eax, 9
xor eax, 0x37
mov word [esp + 0x86], ax
mov eax, dword [esp + 0x70]
add eax, 0xa
xor eax, 0x2d
mov word [esp + 0x88], ax
mov eax, dword [esp + 0x70]
add eax, 0xb
xor eax, 0x39
mov word [esp + 0x8a], ax
mov eax, dword [esp + 0x70]
add eax, 0xc
xor eax, 0x33
mov word [esp + 0x8c], ax
mov eax, dword [esp + 0x70]
add eax, 0xd
xor eax, 0x42
mov word [esp + 0x8e], ax
mov eax, dword [esp + 0x70]
add eax, 0xe
xor eax, 0x44
mov word [esp + 0x90], ax
mov eax, dword [esp + 0x70]
add eax, 0xf
xor eax, 0x2d
mov word [esp + 0x92], ax
mov eax, dword [esp + 0x70]
add eax, 0x10
xor eax, 0x34
mov word [esp + 0x94], ax
mov eax, dword [esp + 0x70]
add eax, 0x11
xor eax, 0x44
mov word [esp + 0x96], ax
mov eax, dword [esp + 0x70]
add eax, 0x12
xor eax, 0x33
mov word [esp + 0x98], ax
mov eax, dword [esp + 0x70]
add eax, 0x13
xor eax, 0x43
mov word [esp + 0x9a], ax
mov eax, dword [esp + 0x70]
add eax, 0x14
xor eax, 0x2d
mov word [esp + 0x9c], ax
mov eax, dword [esp + 0x70]
add eax, 0x15
xor eax, 0x38
mov word [esp + 0x9e], ax
mov eax, dword [esp + 0x70]
add eax, 0x16
xor eax, 0x45
mov word [esp + 0xa0], ax
mov eax, dword [esp + 0x70]
add eax, 0x17
xor eax, 0x31
mov word [esp + 0xa2], ax
mov eax, dword [esp + 0x70]
add eax, 0x18
xor eax, 0x30
mov word [esp + 0xa4], ax
mov eax, dword [esp + 0x70]
add eax, 0x19
xor eax, 0x2d
mov word [esp + 0xa6], ax
mov eax, dword [esp + 0x70]
add eax, 0x1a
xor eax, 0x44
mov word [esp + 0xa8], ax
mov eax, dword [esp + 0x70]
add eax, 0x1b
xor eax, 0x36
mov word [esp + 0xaa], ax
mov eax, dword [esp + 0x70]
add eax, 0x1c
xor eax, 0x44
mov word [esp + 0xac], ax
mov eax, dword [esp + 0x70]
add eax, 0x1d
xor eax, 0x30
mov word [esp + 0xae], ax
mov eax, dword [esp + 0x70]
add eax, 0x1e
xor eax, 0x32
mov word [esp + 0xb0], ax
mov eax, dword [esp + 0x70]
add eax, 0x1f
xor eax, 0x37
mov word [esp + 0xb2], ax
mov eax, dword [esp + 0x70]
add eax, 0x20
xor eax, 0x41
mov word [esp + 0xb4], ax
mov eax, dword [esp + 0x70]
add eax, 0x21
xor eax, 0x37
mov word [esp + 0xb6], ax
mov eax, dword [esp + 0x70]
add eax, 0x22
xor eax, 0x45
mov word [esp + 0xb8], ax
mov eax, dword [esp + 0x70]
add eax, 0x23
xor eax, 0x38
mov word [esp + 0xba], ax
mov eax, dword [esp + 0x70]
add eax, 0x24
xor eax, 0x30
mov word [esp + 0xbc], ax
mov eax, dword [esp + 0x70]
add eax, 0x25
xor eax, 0x45
mov word [esp + 0xbe], ax
mov eax, dword [esp + 0x70]
add eax, 0x26
xor eax, 0x7d
mov word [esp + 0xc0], ax
mov eax, dword [esp + 0x70]
add eax, 0x27
xor eax, 0x2e
mov word [esp + 0xc2], ax
mov eax, dword [esp + 0x70]
add eax, 0x28
xor eax, 0x78
mov word [esp + 0xc4], ax
mov eax, dword [esp + 0x70]
add eax, 0x29
xor eax, 0x65
mov word [esp + 0xc6], ax
mov eax, dword [esp + 0x70]
add eax, 0x2a
xor eax, 0x6d
mov word [esp + 0xc8], ax
xor eax, eax
mov word [esp + 0xca], ax
xor edx, edx
mov ax, word [esp + 0x74]
nop
mov ax, word [esp + edx*2 + 0x74]
mov ecx, dword [esp + 0x70]
add ecx, edx
movzx eax, ax
xor ecx, eax
mov word [esp + edx*2 + 0x74], cx
inc edx
cmp edx, 0x2b
jb 0x10002d80
xor eax, eax
mov word [esp + 0xca], ax
lea eax, [esp + 0x74]
push eax
push 0x208
lea eax, [esp + 0x148]
push eax
mov eax, dword [0x102a8048]
mov eax, dword [eax + 0xf0]
call eax
lea eax, [esp + 0x140]
push eax
call esi
cmp eax, 0xffffffff
jne 0x1000305d
lea eax, [esp + 0x348]
push eax
push 0x208
lea eax, [esp + 0x148]
push eax
mov eax, dword [0x102a8048]
mov eax, dword [eax + 0xe8]
call eax
mov eax, 0x44
mov edx, 0x50
mov word [esp + 0xf0], ax
mov ecx, 0x3e
mov eax, 0x85
mov word [esp + 0xf2], ax
mov eax, 0x43
mov word [esp + 0xf4], ax
mov eax, 0x4d
mov word [esp + 0xf6], dx
mov word [esp + 0xf8], ax
mov eax, 0x40
mov word [esp + 0xfa], cx
mov word [esp + 0xfc], ax
mov eax, 0x43
mov word [esp + 0xfe], ax
mov eax, 0x3d
mov word [esp + 0x100], dx
mov edx, 0x37
mov word [esp + 0x102], ax
mov eax, 0x40
mov word [esp + 0x104], dx
mov word [esp + 0x106], cx
mov word [esp + 0x108], ax
mov eax, 0x42
mov word [esp + 0x10a], ax
mov eax, 0x4e
mov word [esp + 0x10c], ax
mov eax, 0x3c
mov word [esp + 0x10e], dx
mov word [esp + 0x110], cx
mov ecx, 0x41
mov word [esp + 0x112], ax
mov eax, 0x4b
mov word [esp + 0x114], cx
mov ecx, 0x3c
mov word [esp + 0x116], ax
mov eax, 0x4c
mov word [esp + 0x118], dx
mov word [esp + 0x11a], ax
mov eax, 0x40
mov word [esp + 0x11c], ax
mov eax, 0x3f
mov word [esp + 0x11e], ax
mov word [esp + 0x120], cx
mov ecx, 0x3a
mov word [esp + 0x122], dx
mov edx, 0x40
mov word [esp + 0x124], dx
mov edx, 0x4d
mov word [esp + 0x126], cx
mov word [esp + 0x128], dx
mov word [esp + 0x12a], ax
mov eax, 0x3c
mov word [esp + 0x12c], ax
mov eax, 0x50
mov word [esp + 0x12e], ax
mov word [esp + 0x130], ax
mov eax, 0x4f
mov word [esp + 0x132], ax
mov eax, ecx
mov word [esp + 0x134], ax
mov ecx, 0x41
mov word [esp + 0x136], cx
mov word [esp + 0x138], ax
mov eax, 0x43
mov word [esp + 0x13a], ax
mov eax, 0x87
mov word [esp + 0x13c], ax
xor eax, eax
mov word [esp + 0x13e], ax
xor ecx, ecx
mov ax, word [esp + 0xf0]
nop dword [eax + eax]
mov ax, word [esp + ecx*2 + 0xf0]
movzx eax, ax
add eax, 0xfffffff6
mov word [esp + ecx*2 + 0xf0], ax
inc ecx
cmp ecx, 0x27
jb 0x10002fe0
lea eax, [esp + 0xf0]
push eax
push 0x208
lea eax, [esp + 0x148]
push eax
mov eax, dword [0x102a8048]
mov eax, dword [eax + 0xf0]
call eax
lea eax, [esp + 0x140]
push eax
call esi
cmp eax, 0xffffffff
jne 0x100031ac
push 0
push 0x80
push 4
push 0
push 0
push 0x40000000
lea eax, [esp + 0x158]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x1000305d
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
push 0x208
lea eax, [esp + 0x148]
push eax
mov eax, dword [0x102a8048]
mov eax, dword [eax + 0xe8]
call eax
mov edx, dword [edi + 0x64]
lea eax, [esp + 0x140]
push eax
mov ecx, edi
call fcn.10003eb0
mov edx, eax
test edx, edx
jns 0x100031bc
mov esi, dword [edi + 0x6c]
mov ebx, 0x7a
mov word [esp + 0xd0], bx
mov eax, 0x35
mov word [esp + 0xd2], ax
mov ecx, 0x3c
mov eax, 0x64
mov word [esp + 0xd4], ax
mov word [esp + 0xd6], cx
mov word [esp + 0xd8], cx
mov ecx, 0x22
mov word [esp + 0xda], cx
mov word [esp + 0xdc], ax
mov eax, 0x67
mov word [esp + 0xde], ax
mov eax, 0x68
mov word [esp + 0xe0], ax
mov eax, 0x27
mov word [esp + 0xe2], cx
mov ecx, 0x3a
mov word [esp + 0xe4], ax
mov eax, 0x32
mov word [esp + 0xe6], ax
xor eax, eax
mov word [esp + 0xe8], cx
xor ecx, ecx
mov word [esp + 0xea], bx
mov word [esp + 0xec], ax
mov ax, word [esp + 0xd0]
nop dword [eax]
mov ax, word [esp + ecx*2 + 0xd0]
movzx eax, ax
add eax, 0xfffffffe
mov word [esp + ecx*2 + 0xd0], ax
inc ecx
cmp ecx, 0xe
jb 0x10003150
mov eax, dword [esi]
lea ecx, [esp + 0xd0]
push edx
push ecx
push esi
call dword [eax + 0x10]
add esp, 0xc
lea eax, [esp + 0x140]
lea edx, [esp + 0x348]
push eax
call fcn.10003420
test eax, eax
js 0x100031ac
mov edx, dword [edi + 0x64]
lea eax, [esp + 0x140]
push eax
mov ecx, edi
call fcn.10003eb0
test eax, eax
jns 0x100031bc
mov edx, dword [edi + 0x64]
mov ecx, edi
push 0
call fcn.10003a10
test eax, eax
js 0x100031da
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x548]
xor ecx, esp
call fcn.100e04a9
mov esp, ebp
pop ebp
ret 4
mov eax, 0xe0010001
mov ecx, dword [esp + 0x554]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.100e04a9
mov esp, ebp
pop ebp
ret 4