Function at 0x403380
Capabilities:
Encode data using xor
Read file on windows
Resolve function by parsing pe exports
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x418161
mov eax, dword fs:[0]
push eax
mov eax, 0x1ad60
call fcn.00417910
mov eax, dword [0x41f1f0]
xor eax, esp
mov dword [esp + 0x1ad58], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x41f1f0]
xor eax, esp
push eax
lea eax, [esp + 0x1ad74]
mov dword fs:[0], eax
mov ebx, dword [esp + 0x1ad84]
push 0x48
xor ebp, ebp
lea eax, [esp + 0xc8]
push ebp
push eax
mov edi, ecx
mov esi, edx
call fcn.0040afd0
push 0x48
lea ecx, [esp + 0x8c]
push ebp
push ecx
call fcn.0040afd0
mov ecx, vtable.CGsFile.0
mov eax, 0xf
add esp, 0x18
mov dword [esp + 0x58], ecx
mov dword [esp + 0x74], eax
mov dword [esp + 0x70], ebp
mov byte [esp + 0x60], 0
mov dword [esp + 0x78], ebp
mov dword [esp + 0x1ad7c], ebp
mov dword [esp + 0x34], ecx
mov dword [esp + 0x50], eax
mov dword [esp + 0x4c], ebp
mov byte [esp + 0x3c], 0
mov dword [esp + 0x54], ebp
mov dword [esp + method.CGsLZSS.virtual_0], vtable.CGsLZSS.0
push 0x21
push esi
lea ecx, [esp + 0x60]
mov byte [esp + 0x1ad84], 2
call fcn.00406c90
test eax, eax
jne 0x4034a3
push esi
push 0x41b3ac
push 0x420f50
call dword [sym.imp.USER32.dll_wsprintfA]
mov edi, dword [edi + 4]
add esp, 0xc
push 0x20
push 0x41b340
push 0x420f50
push edi
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [esp + 0x34]
mov byte [esp + 0x1ad7c], 0
call fcn.00406bc0
lea ecx, [esp + 0x58]
mov dword [esp + 0x1ad7c], 0xffffffff
call fcn.00406bc0
xor eax, eax
jmp 0x403c11
push 0x27
push ebx
lea ecx, [esp + 0x3c]
call fcn.00406c90
test eax, eax
je 0x40344d
mov eax, dword [esp + 0x78]
cmp eax, ebp
je 0x4034d0
push eax
push 0x48
lea edx, [esp + 0xcc]
push 1
push edx
call fcn.0040c915
add esp, 0x10
mov eax, dword [esp + 0x54]
cmp eax, ebp
je 0x4034ed
push eax
push 0x48
lea eax, [esp + 0x84]
push 1
push eax
call fcn.0040c915
add esp, 0x10
test byte [esp + 0xac], 1
jne 0x403be7
mov eax, dword [esp + 0x100]
xor ecx, ecx
mov edx, 0x68
mul edx
seto cl
mov dword [esp + 0x1c], ebp
neg ecx
or ecx, eax
push ecx
call fcn.0040adb8
mov ebx, eax
mov eax, dword [esp + 0x104]
imul eax, eax, 0x68
push eax
push ebp
push ebx
mov dword [esp + 0x3c], ebx
call fcn.0040afd0
mov eax, dword [esp + 0x108]
add esp, 0x10
cmp eax, ebp
je 0x4035e0
push eax
call fcn.0040b2f7
mov ecx, dword [esp + 0xfc]
push ecx
mov esi, eax
push ebp
push esi
call fcn.0040afd0
mov eax, dword [esp + 0x88]
add esp, 0x10
cmp eax, ebp
je 0x40359c
mov edx, dword [esp + 0x108]
push ebp
push edx
push eax
call fcn.0040cd9e
mov eax, dword [esp + 0x84]
add esp, 0xc
cmp eax, ebp
je 0x40359c
push eax
mov eax, dword [esp + 0xfc]
push eax
push 1
push esi
call fcn.0040c915
add esp, 0x10
mov ecx, dword [esp + 0xfc]
cmp ecx, ebp
je 0x4035b3
mov edi, dword [esp + 0xf8]
call fcn.00407100
mov ecx, dword [esp + 0xf8]
push ebp
push ecx
push ebx
push esi
lea ecx, [esp + 0xd54c]
mov dword [esp + 0xd54c], 0x41b4ac
call fcn.00407610
push esi
call fcn.0040b3ba
add esp, 4
jmp 0x4035ff
mov eax, dword [esp + 0x100]
mov ecx, dword [esp + 0x78]
imul eax, eax, 0x68
cmp ecx, ebp
je 0x4035ff
push ecx
push eax
push 1
push ebx
call fcn.0040c915
add esp, 0x10
mov eax, dword [esp + 0xb8]
xor ecx, ecx
mov edx, 0x68
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0040adb8
mov ebx, eax
mov eax, dword [esp + 0xbc]
imul eax, eax, 0x68
push eax
push ebp
push ebx
mov dword [esp + 0x40], ebx
call fcn.0040afd0
mov eax, dword [esp + 0xc0]
add esp, 0x10
cmp eax, ebp
je 0x4036da
push eax
call fcn.0040b2f7
mov ecx, dword [esp + 0xb4]
push ecx
mov esi, eax
push ebp
push esi
call fcn.0040afd0
mov eax, dword [esp + 0x64]
add esp, 0x10
cmp eax, ebp
je 0x403696
mov edx, dword [esp + 0xc0]
push ebp
push edx
push eax
call fcn.0040cd9e
mov eax, dword [esp + 0x60]
add esp, 0xc
cmp eax, ebp
je 0x403696
push eax
mov eax, dword [esp + 0xb4]
push eax
push 1
push esi
call fcn.0040c915
add esp, 0x10
mov ecx, dword [esp + 0xb4]
cmp ecx, ebp
je 0x4036ad
mov edi, dword [esp + 0xb0]
call fcn.00407100
mov ecx, dword [esp + 0xb0]
push ebp
push ecx
push ebx
push esi
lea ecx, [esp + 0xd54c]
mov dword [esp + 0xd54c], 0x41b4ac
call fcn.00407610
push esi
call fcn.0040b3ba
add esp, 4
jmp 0x4036fb
mov eax, dword [esp + 0xb8]
mov edx, dword [esp + 0x54]
mov ecx, eax
imul ecx, ecx, 0x68
cmp edx, ebp
je 0x403702
push edx
push ecx
push 1
push ebx
call fcn.0040c915
add esp, 0x10
mov eax, dword [esp + 0xb8]
cmp dword [esp + 0x100], ebp
mov dword [esp + 0x18], ebp
mov dword [esp + 0x20], ebp
jbe 0x403bb4
mov edi, dword [esp + 0x2c]
jmp 0x403720
xor ebp, ebp
cmp eax, ebp
mov dword [esp + 0x28], ebp
mov dword [esp + 0x24], ebp
jbe 0x4037c4
mov esi, dword [esp + 0x30]
add esi, 0x48
lea esp, [esp]
push 0x40
lea ebx, [esi - 0x48]
push ebx
push edi
call fcn.0040b5ba
add esp, 0xc
test eax, eax
jne 0x4037ac
mov eax, dword [edi + 0x48]
mov ecx, dword [esi]
cmp eax, ecx
mov edx, 1
mov dword [esp + 0x28], edx
jbe 0x403772
add dword [esp + 0x18], edx
mov dword [esp + 0x24], edx
mov byte [ebx], 0
jmp 0x4037ac
jne 0x403798
lea edx, [esi + 0x18]
push edx
lea eax, [edi + 0x60]
push eax
call dword [sym.imp.KERNEL32.dll_CompareFileTime]
test eax, eax
jle 0x403798
add dword [esp + 0x18], 1
mov dword [esp + 0x24], 1
mov byte [ebx], 0
jmp 0x4037ac
cmp dword [esp + 0x24], 1
jne 0x4037a9
add dword [esp + 0x18], 1
mov byte [ebx], 0
jmp 0x4037ac
mov byte [edi], 0
mov eax, dword [esp + 0xb8]
add ebp, 1
add esi, 0x68
cmp ebp, eax
jb 0x403740
cmp dword [esp + 0x28], 0
jne 0x4037c9
add dword [esp + 0x18], 1
mov ecx, dword [esp + 0x20]
add ecx, 1
add edi, 0x68
cmp ecx, dword [esp + 0x100]
mov dword [esp + 0x20], ecx
jb 0x403720
cmp dword [esp + 0x18], 0
je 0x403bb4
mov ecx, dword [esp + 0x18]
lea esi, [ecx + eax]
xor ecx, ecx
mov eax, esi
mov edx, 0x68
mul edx
seto cl
mov dword [esp + 0x24], esi
neg ecx
or ecx, eax
push ecx
call fcn.0040adb8
mov ebx, esi
imul ebx, ebx, 0x68
push ebx
push 0
push eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x38], ebx
call fcn.0040afd0
xor esi, esi
add esp, 0x10
cmp dword [esp + 0xb8], esi
jbe 0x40385e
mov edi, dword [esp + 0x1c]
mov ebp, dword [esp + 0x30]
sub ebp, edi
push 0x68
lea eax, [edi + ebp]
push eax
push edi
call fcn.0040b620
add esi, 1
add esp, 0xc
add edi, 0x68
cmp esi, dword [esp + 0xb8]
jb 0x403840
push 0x400
lea ecx, [esp + 0x1a970]
push 0
push ecx
call fcn.0040afd0
imul esi, esi, 0x68
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x60]
mov edi, dword [esi + edx - 0x24]
mov ebp, dword [esi + edx - 0x28]
add esi, edx
add esp, 0xc
test eax, eax
je 0x40389f
push 0
push 0
push eax
call fcn.0040cd9e
mov eax, dword [esp + 0x60]
add esp, 0xc
mov ecx, dword [esp + 0xbc]
add ecx, ebp
add ecx, edi
test eax, eax
je 0x4038be
push 0
push ecx
push eax
call fcn.0040cd9e
mov eax, dword [esp + 0x60]
add esp, 0xc
add ebp, edi
and edi, 3
mov dword [esp + 0x18], ebp
je 0x4038ee
mov esi, 4
sub esi, edi
test eax, eax
je 0x4038e8
push eax
push esi
lea edx, [esp + 0x1a974]
push 1
push edx
call fcn.0040ca8f
add esp, 0x10
add ebp, esi
mov dword [esp + 0x18], ebp
cmp dword [esp + 0x100], 0
mov dword [esp + 0x20], 0
jbe 0x403a0b
mov ebp, dword [esp + 0x2c]
mov eax, dword [esp + 0xb8]
mov ecx, dword [esp + 0x1c]
add ebp, 0x44
imul eax, eax, 0x68
lea ebx, [eax + ecx + 0x44]
lea ecx, [ecx]
cmp byte [ebp - 0x44], 0
lea eax, [ebp - 0x44]
je 0x4039e8
push 0x40
push eax
lea edx, [ebx - 0x44]
push 0x40
push edx
call fcn.0040b1f5
mov eax, dword [esp + 0x28]
mov dword [ebx - 4], eax
mov ecx, dword [ebp]
mov dword [ebx], ecx
mov esi, dword [ebp]
push esi
call fcn.0040adb8
push esi
mov edi, eax
push 0
push edi
call fcn.0040afd0
mov eax, dword [ebp - 4]
mov ecx, dword [esp + 0x98]
add eax, dword [esp + 0x124]
add esp, 0x20
test ecx, ecx
je 0x403997
push 0
push eax
push ecx
call fcn.0040cd9e
mov eax, dword [esp + 0x84]
add esp, 0xc
test eax, eax
je 0x403997
push eax
push esi
push 1
push edi
call fcn.0040c915
add esp, 0x10
mov eax, dword [esp + 0x54]
test eax, eax
je 0x4039ac
push eax
push esi
push 1
push edi
call fcn.0040ca8f
add esp, 0x10
push edi
call fcn.0040b985
add dword [esp + 0x1c], esi
add esp, 4
and esi, 3
je 0x4039e5
mov eax, dword [esp + 0x54]
mov edi, 4
sub edi, esi
test eax, eax
je 0x4039e1
push eax
push edi
lea edx, [esp + 0x1a974]
push 1
push edx
call fcn.0040ca8f
add esp, 0x10
add dword [esp + 0x18], edi
add ebx, 0x68
mov eax, dword [esp + 0x20]
add eax, 1
add ebp, 0x68
cmp eax, dword [esp + 0x100]
mov dword [esp + 0x20], eax
jb 0x403920
mov ebp, dword [esp + 0x18]
mov ebx, dword [esp + 0x28]
lea edi, [ebx + ebx]
push edi
call fcn.0040b2f7
push edi
mov esi, eax
push 0
push esi
call fcn.0040afd0
mov eax, dword [esp + 0x2c]
add esp, 0x10
push edi
push ebx
push esi
push eax
lea ecx, [esp + 0x11c]
call fcn.00407370
mov ecx, dword [esp + 0xb4]
test ecx, ecx
mov edi, eax
je 0x403a5e
xor eax, eax
test edi, edi
jle 0x403a5e
lea esp, [esp]
mov dl, al
and dl, cl
xor byte [eax + esi], dl
add eax, 1
cmp eax, edi
jl 0x403a50
mov eax, dword [esp + 0x54]
test eax, eax
je 0x403a73
push eax
push edi
push 1
push esi
call fcn.0040ca8f
add esp, 0x10
push esi
call fcn.0040b3ba
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0xc0]
or dword [esp + 0xb0], 1
mov dword [esp + 0xbc], ecx
mov ecx, dword [esp + 0x58]
add eax, ebp
add esp, 4
test ecx, ecx
mov dword [esp + 0xb0], edi
mov dword [esp + 0xc0], eax
je 0x403adc
push 0
push 0
push ecx
call fcn.0040cd9e
mov ecx, dword [esp + 0x60]
add esp, 0xc
test ecx, ecx
je 0x403adc
push ecx
push 0x48
lea edx, [esp + 0x84]
push 1
push edx
call fcn.0040ca8f
mov ecx, dword [esp + 0x64]
add esp, 0x10
mov eax, dword [esp + 0x4c]
or esi, 0xffffffff
cmp eax, 0xffffffff
mov ebx, 0x10
jae 0x403af3
test eax, eax
mov esi, eax
jbe 0x403b37
mov edx, dword [esp + 0x50]
cmp edx, ebx
mov ecx, dword [esp + 0x3c]
mov edi, ecx
jae 0x403b07
lea edi, [esp + 0x3c]
mov ecx, edi
sub eax, esi
push eax
add edi, esi
push edi
push edx
push ecx
call fcn.0040aecb
mov eax, dword [esp + 0x5c]
mov ecx, dword [esp + 0x4c]
sub eax, esi
add esp, 0x10
cmp dword [esp + 0x50], ebx
mov dword [esp + 0x4c], eax
jae 0x403b2f
lea ecx, [esp + 0x3c]
mov byte [ecx + eax], 0
mov ecx, dword [esp + 0x54]
xor ebp, ebp
cmp ecx, ebp
je 0x403b4a
push ecx
call fcn.0040c4e9
add esp, 4
mov dword [esp + 0x54], ebp
mov eax, dword [esp + 0x70]
or esi, 0xffffffff
cmp eax, 0xffffffff
jae 0x403b5c
cmp eax, ebp
mov esi, eax
jbe 0x403b9f
mov edx, dword [esp + 0x74]
cmp edx, ebx
mov ecx, dword [esp + 0x60]
mov edi, ecx
jae 0x403b70
lea edi, [esp + 0x60]
mov ecx, edi
sub eax, esi
push eax
add edi, esi
push edi
push edx
push ecx
call fcn.0040aecb
mov eax, dword [esp + 0x80]
mov ecx, dword [esp + 0x70]
sub eax, esi
add esp, 0x10
cmp dword [esp + 0x74], ebx
mov dword [esp + 0x70], eax
jae 0x403b9b
lea ecx, [esp + 0x60]
mov byte [ecx + eax], 0
mov eax, dword [esp + 0x78]
cmp eax, ebp
je 0x403bb4
push eax
call fcn.0040c4e9
add esp, 4
mov dword [esp + 0x78], ebp
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x403bc5
push eax
call fcn.0040b985
add esp, 4
mov eax, dword [esp + 0x30]
test eax, eax
je 0x403bd6
push eax
call fcn.0040b985
add esp, 4
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x403be7
push eax
call fcn.0040b985
add esp, 4
lea ecx, [esp + 0x34]
mov byte [esp + 0x1ad7c], 0
call fcn.00406bc0
lea ecx, [esp + 0x58]
mov dword [esp + 0x1ad7c], 0xffffffff
call fcn.00406bc0
mov eax, 1
mov ecx, dword [esp + 0x1ad74]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x1ad58]
xor ecx, esp
call fcn.0040b16b
add esp, 0x1ad6c
ret 4