Function at 0x11a10
Capabilities:
Encode data using xor
Read file on windows
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24c
mov eax, dword [0x15390]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
xor esi, esi
push 0x206
mov dword [ebp - 0x24c], eax
lea eax, [ebp - 0x20a]
push esi
push eax
mov word [ebp - 0x20c], si
call sub.ntoskrnl.exe_memset
push 0x15440
push 0x14c32
lea eax, [ebp - 0x20c]
push 0x208
push eax
call fcn.000109fc
mov edi, dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
add esp, 0x1c
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x248]
push eax
call edi
mov ebx, dword [sym.imp.ntoskrnl.exe_ZwOpenFile]
push 0x60
lea eax, [ebp - 0x248]
mov dword [ebp - 0x238], eax
push 1
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x240]
push eax
push 0x80100000
lea eax, [ebp - 0x218]
push eax
mov dword [ebp - 0x240], 0x18
mov dword [ebp - 0x23c], esi
mov dword [ebp - 0x234], 0x240
mov dword [ebp - 0x230], esi
mov dword [ebp - 0x22c], esi
call ebx
test eax, eax
jge 0x11d08
push esi
push esi
push 0x60
push 5
push 2
push 0x80
push esi
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x240]
push eax
push 0x40100000
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.ntoskrnl.exe_ZwCreateFile]
test eax, eax
jl 0x11d14
push dword [ebp - 0x24c]
lea eax, [ebp - 0x20c]
push 0x14c32
push 0x208
push eax
call fcn.000109fc
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x248]
push eax
call edi
push 0x60
lea eax, [ebp - 0x248]
mov dword [ebp - 0x238], eax
push 1
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x240]
push eax
push 0x80100000
lea eax, [ebp - 0x214]
push eax
mov dword [ebp - 0x240], 0x18
mov dword [ebp - 0x23c], esi
mov dword [ebp - 0x234], 0x240
mov dword [ebp - 0x230], esi
mov dword [ebp - 0x22c], esi
call ebx
test eax, eax
jl 0x11d08
mov edi, dword [sym.imp.ntoskrnl.exe_ZwReadFile]
push esi
push esi
push 4
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x228]
push eax
push esi
push esi
push esi
push dword [ebp - 0x214]
mov dword [ebp - 0x210], esi
call edi
test eax, eax
jl 0x11cc6
mov eax, dword [ebp - 0x210]
push esi
add eax, 4
mov dword [ebp - 0x220], eax
lea eax, [ebp - 0x220]
push eax
push 4
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x228]
push eax
push esi
push esi
push esi
push dword [ebp - 0x214]
mov dword [ebp - 0x21c], esi
call edi
test eax, eax
jl 0x11cc6
mov eax, dword [ebp - 0x210]
push esi
add eax, 4
add dword [ebp - 0x220], eax
lea eax, [ebp - 0x220]
push eax
adc dword [ebp - 0x21c], esi
push 4
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x228]
push eax
push esi
push esi
push esi
push dword [ebp - 0x214]
call edi
test eax, eax
jl 0x11cc6
push 0x76734d4d
push dword [ebp - 0x210]
push 1
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov ebx, eax
cmp ebx, esi
je 0x11cc6
push esi
push esi
push dword [ebp - 0x210]
lea eax, [ebp - 0x228]
push ebx
push eax
push esi
push esi
push esi
push dword [ebp - 0x214]
call edi
xor eax, eax
cmp dword [ebp - 0x210], esi
jbe 0x11c9f
mov cl, byte [eax + ebx]
xor cl, 0x73
sub cl, 0x57
mov byte [eax + ebx], cl
inc eax
cmp eax, dword [ebp - 0x210]
jb 0x11c8a
push esi
push esi
push dword [ebp - 0x210]
lea eax, [ebp - 0x228]
push ebx
push eax
push esi
push esi
push esi
push dword [ebp - 0x218]
call dword [sym.imp.ntoskrnl.exe_ZwWriteFile]
push esi
push ebx
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
push dword [ebp - 0x214]
mov esi, dword [sym.imp.ntoskrnl.exe_ZwClose]
call esi
push dword [ebp - 0x218]
call esi
push 0x15440
push 0x14c32
lea eax, [ebp - 0x20c]
push 0x208
push eax
call fcn.000109fc
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
call fcn.000110da
jmp 0x11d14
push dword [ebp - 0x218]
call dword [sym.imp.ntoskrnl.exe_ZwClose]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00012c87
leave
ret 4