Function at 0x100028a0
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
mov eax, 0x1408
call fcn.1000e540
mov eax, dword [0x1001803c]
xor eax, esp
mov dword [esp + 0x1404], eax
mov eax, dword [esp + 0x140c]
push esi
push edi
mov esi, edx
mov dword [esp + 8], 0
cmp eax, 1
jne 0x100029a4
push 0
push 0
dec ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x10002b2a
push 0
lea eax, [esp + 0xc]
push eax
push 0x1000
lea ecx, [esp + 0x418]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10002b2a
mov ecx, dword [0x1001a484]
or eax, 0xffffffff
xor edx, edx
jmp 0x10002920
movzx esi, byte [esp + edx + 0x40c]
mov edi, eax
and edi, 0xff
xor esi, edi
movzx edi, byte [esp + edx + 0x40d]
shr eax, 8
xor eax, dword [ecx + esi*4]
add edx, 4
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
xor eax, dword [ecx + esi*4]
movzx esi, byte [esp + edx + 0x40a]
mov edi, eax
and edi, 0xff
xor esi, edi
shr eax, 8
xor eax, dword [ecx + esi*4]
movzx esi, byte [esp + edx + 0x40b]
mov edi, eax
and edi, 0xff
xor esi, edi
shr eax, 8
xor eax, dword [ecx + esi*4]
cmp edx, 0x1000
jb 0x10002920
pop edi
not eax
pop esi
mov ecx, dword [esp + 0x1404]
xor ecx, esp
call fcn.100065f6
add esp, 0x1408
ret
test eax, eax
jne 0x10002a68
push eax
push eax
dec ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x10002b2a
push 0
lea edx, [esp + 0xc]
push edx
push 0x200
lea eax, [esp + 0x18]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10002b2a
mov ecx, dword [0x1001a484]
or eax, 0xffffffff
xor edx, edx
jmp 0x100029f0
movzx esi, byte [esp + edx + 0xc]
mov edi, eax
and edi, 0xff
xor esi, edi
movzx edi, byte [esp + edx + 0xd]
shr eax, 8
xor eax, dword [ecx + esi*4]
add edx, 4
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
xor eax, dword [ecx + esi*4]
movzx esi, byte [esp + edx + 0xa]
mov edi, eax
and edi, 0xff
xor esi, edi
shr eax, 8
xor eax, dword [ecx + esi*4]
movzx esi, byte [esp + edx + 0xb]
mov edi, eax
and edi, 0xff
xor esi, edi
shr eax, 8
xor eax, dword [ecx + esi*4]
cmp edx, 0x200
jb 0x100029f0
pop edi
not eax
pop esi
mov ecx, dword [esp + 0x1404]
xor ecx, esp
call fcn.100065f6
add esp, 0x1408
ret
cmp eax, 2
jne 0x10002b2a
push 0
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x10002b2a
push 0
lea ecx, [esp + 0xc]
push ecx
push 0x400
lea edx, [esp + 0x18]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10002b2a
mov ecx, dword [0x1001a484]
or eax, 0xffffffff
xor edx, edx
movzx esi, byte [esp + edx + 0xc]
mov edi, eax
and edi, 0xff
xor esi, edi
movzx edi, byte [esp + edx + 0xd]
shr eax, 8
xor eax, dword [ecx + esi*4]
add edx, 4
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
xor eax, dword [ecx + esi*4]
movzx esi, byte [esp + edx + 0xa]
mov edi, eax
and edi, 0xff
xor esi, edi
shr eax, 8
xor eax, dword [ecx + esi*4]
movzx esi, byte [esp + edx + 0xb]
mov edi, eax
and edi, 0xff
xor esi, edi
shr eax, 8
xor eax, dword [ecx + esi*4]
cmp edx, 0x400
jb 0x10002ab2
pop edi
not eax
pop esi
mov ecx, dword [esp + 0x1404]
xor ecx, esp
call fcn.100065f6
add esp, 0x1408
ret
mov ecx, dword [esp + 0x140c]
pop edi
pop esi
xor ecx, esp
xor eax, eax
call fcn.100065f6
add esp, 0x1408
ret