Function at 0x433370
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov ax, word [0x85b894]
xor ecx, ecx
mov dword [ebp - 0x1a], ecx
mov dword [ebp - 0x16], ecx
push ebx
mov word [ebp - 0x12], cx
mov ecx, dword [ebp + 0x10]
mov word [ebp - 0x1c], ax
push esi
xor eax, eax
test ecx, 0x80000000
push edi
je 0x4333a1
mov eax, 1
mov edx, dword [ebp + 8]
push 0
push 0x10000080
push 3
push 0
push eax
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
mov dword [ebp - 8], edi
jne 0x4333d5
mov dword [0x85b888], 2
or eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor ebx, ebx
mov esi, 0x71a7c8
mov eax, dword [ebp + 8]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x4333fc
add esi, 0x104
inc ebx
cmp esi, 0x71b808
jl 0x4333dc
jmp 0x433410
mov eax, dword [ebx*4 + 0x85b848]
test eax, eax
mov dword [ebp - 4], eax
mov esi, ebx
jne 0x4335fe
mov eax, dword [0x85b88c]
mov ecx, dword [eax*4 + 0x85b848]
test ecx, ecx
je 0x433437
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [0x85b88c]
mov dword [eax*4 + 0x85b848], 0
mov ecx, dword [ebp + 8]
mov edx, eax
shl edx, 6
add edx, eax
push ecx
lea eax, [edx*4 + 0x71a7c8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
lea ecx, [ebp + 0x10]
push ecx
push 0xc
lea edx, [ebp - 0x1c]
push edx
push edi
call ebx
test eax, eax
jne 0x43346f
push edi
jmp 0x43369e
push 6
lea eax, [ebp - 0x1c]
push str.WARC_1.7
push eax
call sub.MSVCRT.dll_strncmp
add esp, 0xc
test eax, eax
je 0x433497
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [ebp - 0x16], 0x2e
mov eax, dword [ebp - 0x17]
jne 0x4334c1
mov edx, dword [ebp - 0x15]
and eax, 0xff
lea ecx, [eax + eax*4]
and edx, 0xff
lea eax, [edx + ecx*2]
lea eax, [eax + eax*4]
lea ecx, [eax + eax - 0x14a0]
push ecx
jmp 0x4334e8
and eax, 0xff
lea edx, [eax + eax*4]
mov eax, dword [ebp - 0x16]
and eax, 0xff
lea eax, [eax + edx*2]
mov edx, dword [ebp - 0x15]
lea ecx, [eax + eax*4]
and edx, 0xff
lea eax, [edx + ecx*2 - 0x14d0]
push eax
call fcn.00434560
mov esi, dword [ebp - 0x14]
add esp, 4
push 0
push 0
xor esi, 0xf182ad82
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x433510
push edi
jmp 0x43369e
push 0
lea ecx, [ebp + 0x10]
push ecx
push 0xa0000
push 0x71b848
push edi
call ebx
test eax, eax
jne 0x43352d
push edi
jmp 0x43369e
push 0xa0000
push 0x71b848
call fcn.004342e0
add esp, 8
mov eax, 0x71b848
xor dword [eax], esi
add eax, 4
cmp eax, 0x7bb848
jb 0x433544
mov eax, dword [0x466b54]
mov ecx, eax
shl ecx, 8
add ecx, eax
shl ecx, 8
add ecx, eax
lea edx, [ebp + 0x10]
push edx
shl ecx, 8
add ecx, eax
push ecx
push 0x9fff8
push 0x71b850
push 0x7bb848
mov dword [ebp + 0x10], 0xa0000
call fcn.00434b40
add esp, 0x14
test eax, eax
jne 0x433593
push edi
jmp 0x43369e
mov edx, dword [ebp + 0x10]
push edx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ecx, dword [0x85b88c]
mov dword [ecx*4 + 0x85b848], eax
mov ecx, dword [ebp + 0x10]
mov edx, ecx
shr ecx, 2
mov edi, eax
mov esi, 0x7bb848
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [0x85b88c]
mov eax, dword [ecx*4 + 0x85b848]
mov dword [ebp - 4], eax
mov eax, 0xcccccccd
mul dword [ebp + 0x10]
shr edx, 5
mov dword [ecx*4 + 0x71b808], edx
mov esi, ecx
inc ecx
cmp ecx, 0x10
mov dword [0x85b88c], ecx
jb 0x4335fe
mov dword [0x85b88c], 0
mov edi, dword [ebp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [esi*4 + 0x71b808]
dec eax
push edi
mov dword [ebp + 8], eax
mov dword [ebp - 0xc], ecx
call dword [sym.imp.USER32.dll_CharUpperA]
pushfd
cld
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
mov ax, word [esi]
add esi, 2
mov ebx, edi
cmp word [edi], ax
jne 0x433643
mov ecx, dword [ebp + 8]
add edi, 2
push esi
or ecx, ecx
repe cmpsb byte [esi], byte es:[edi]
pop esi
je 0x43364b
lea edi, [ebx + 0x28]
dec edx
jne 0x43362e
xor ebx, ebx
mov dword [ebp - 0x10], ebx
popfd
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x43365c
mov edx, dword [ebp - 8]
push edx
jmp 0x43369e
mov ecx, dword [ebp + 0x20]
test ecx, ecx
mov edx, dword [eax + 0x10]
mov esi, dword [eax + 0x14]
je 0x43366b
mov dword [ecx], eax
mov ecx, dword [ebp + 0x14]
test ecx, ecx
je 0x433674
mov dword [ecx], edx
mov ecx, dword [ebp + 0x1c]
test ecx, ecx
je 0x43367d
mov dword [ecx], esi
mov ecx, dword [ebp + 0x18]
test ecx, ecx
je 0x433689
mov eax, dword [eax + 0x18]
mov dword [ecx], eax
mov esi, dword [ebp - 8]
push 0
push 0
push edx
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x4336b8
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x85b888], 4
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret