Function at 0x10043993
Capabilities:
Delete file
Encode data using xor
Get file size
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1007ac3b
mov eax, dword fs:[0]
push eax
mov eax, 0x3068
call fcn.1004e980
mov eax, dword [0x100a0070]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x3044], edx
mov edi, ecx
mov esi, dword [ebp + 8]
call fcn.100434f0
and dword [ebp - 0x3058], 0
and dword [ebp - 0x3054], 0
and dword [ebp - 0x3050], 0
and dword [ebp - 4], 0
lea ecx, [ebp - 0x3058]
push esi
call fcn.100448af
mov dword [ebp - 4], 1
mov eax, dword [ebp - 0x3054]
sub eax, dword [ebp - 0x3058]
push 0x1c
cdq
pop ecx
idiv ecx
test eax, eax
jg 0x10043a1b
xor esi, esi
jmp 0x10043a84
push 0
push 0x8000000
push 3
push 0
push 3
push 0x80000000
push edi
call dword [0x100a3d50]
mov esi, eax
mov dword [ebp - 0x3048], esi
mov byte [ebp - 4], 2
test esi, esi
je 0x10043a77
cmp esi, 0xffffffff
je 0x10043a77
and dword [ebp - 0x3040], 0
lea eax, [ebp - 0x3040]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
mov edx, 0x1000
mov ecx, dword [ebp - 0x3040]
test eax, eax
jne 0x10043aad
test ecx, ecx
jne 0x10043ab5
xor esi, esi
lea ecx, [ebp - 0x3048]
call fcn.1000391f
lea ecx, [ebp - 0x3058]
call fcn.1004055e
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1004d78e
mov esp, ebp
pop ebp
ret
cmp eax, edx
jae 0x10043ab5
test ecx, ecx
je 0x10043b23
push edx
xor edi, edi
lea eax, [ebp - 0x2014]
push edi
push eax
call fcn.10050900
add esp, 0xc
mov dword [ebp - 0x3030], edi
lea eax, [ebp - 0x3030]
push edi
push eax
push 0x1000
lea eax, [ebp - 0x2014]
push eax
push esi
call ebx
test eax, eax
je 0x10043a77
cmp dword [ebp - 0x2014], 0x70bfbbef
jne 0x10043b17
cmp dword [ebp - 0x2010], 0x706c646f
jne 0x10043b17
cmp dword [ebp - 0x200c], 2
jl 0x10043b17
cmp dword [ebp - 0x200c], 0xa
jle 0x10043a77
push edi
push edi
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x10043b25
xor edi, edi
push edi
push 0x8000080
push 2
push edi
push 1
push 0x40000000
push dword [ebp - 0x3044]
call dword [0x100a3d50]
mov edi, eax
mov dword [ebp - 0x3030], edi
mov byte [ebp - 4], 3
test edi, edi
je 0x10043df4
cmp edi, 0xffffffff
je 0x10043df4
push 0
push 0
push 0x1000
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push edi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov edx, dword [ebp - 0x3058]
lea ecx, [ebp - 0x302c]
call fcn.100435fa
mov byte [ebp - 4], 4
lea eax, [ebp - 0x302c]
cmp dword [ebp - 0x3018], 0x10
lea ecx, [ebp - 0x2014]
cmovae eax, dword [ebp - 0x302c]
push eax
call fcn.1004343b
mov dword [esp], 0x1000
lea eax, [ebp - 0x1014]
push 0
push eax
call fcn.10050900
add esp, 0xc
xor eax, eax
mov dword [ebp - 0x3034], eax
mov dword [ebp - 0x303c], eax
mov dword [ebp - 0x3038], eax
push eax
lea eax, [ebp - 0x3034]
push eax
push 0x1000
lea eax, [ebp - 0x1014]
push eax
push esi
call ebx
jmp 0x10043d28
mov eax, dword [ebp - 0x3034]
test eax, eax
je 0x10043d30
mov ebx, eax
cmp eax, 0x1000
je 0x10043c1c
and ebx, 0xfffffe00
test eax, 0x1ff
je 0x10043c1c
add ebx, 0x200
and dword [ebp - 0x305c], 0
test ebx, ebx
je 0x10043cd2
mov edi, dword [ebp - 0x305c]
mov esi, dword [ebp - 0x303c]
lea ecx, [ebp - 0x303c]
call fcn.10043593
push 0
push 0x1000
push dword [ebp - 0x3038]
mov ecx, dword [eax]
xor dword [ebp + edi - 0x1014], ecx
mov ecx, dword [eax + 4]
xor dword [ebp + edi - 0x1010], ecx
mov ecx, dword [eax + 8]
xor dword [ebp + edi - 0x100c], ecx
mov eax, dword [eax + 0xc]
xor dword [ebp + edi - 0x1008], eax
push esi
call fcn.100715e0
lea ecx, [ebp - 0x2014]
add ecx, eax
mov eax, dword [ecx]
xor dword [ebp + edi - 0x1014], eax
mov eax, dword [ecx + 4]
xor dword [ebp + edi - 0x1010], eax
mov eax, dword [ecx + 8]
xor dword [ebp + edi - 0x100c], eax
mov eax, dword [ecx + 0xc]
xor dword [ebp + edi - 0x1008], eax
add esi, 0x10
mov dword [ebp - 0x303c], esi
adc dword [ebp - 0x3038], 0
add edi, 0x10
cmp edi, ebx
jb 0x10043c37
mov esi, dword [ebp - 0x3048]
mov edi, dword [ebp - 0x3030]
and dword [ebp - 0x304c], 0
lea eax, [ebp - 0x304c]
push 0
push eax
push ebx
lea eax, [ebp - 0x1014]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x10043dd7
mov ebx, 0x1000
lea eax, [ebp - 0x1014]
push ebx
push 0
push eax
call fcn.10050900
add esp, 0xc
lea eax, [ebp - 0x3034]
push 0
push eax
push ebx
lea eax, [ebp - 0x1014]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x10043bf2
lea eax, [ebp - 0x3070]
xor ebx, ebx
push eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x3060], ebx
call esi
mov dword [ebp - 0x3074], eax
lea eax, [ebp - 0x3068]
push eax
push edi
call esi
sub esp, 0x18
mov dword [ebp - 0x306c], eax
mov ecx, esp
push 0x1008f704
call fcn.100017d6
lea eax, [ebp - 0x302c]
push eax
push dword [ebp - 0x3068]
lea edx, [ebp - 0x3058]
push dword [ebp - 0x306c]
lea ecx, [ebp - 0x3014]
push dword [ebp - 0x3070]
push dword [ebp - 0x3074]
call fcn.100436e8
add esp, 0x2c
push ebx
push ebx
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push ebx
lea eax, [ebp - 0x3060]
push eax
push 0x1000
lea eax, [ebp - 0x3014]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov esi, eax
push ebx
push 1
lea ecx, [ebp - 0x302c]
call fcn.10001805
jmp 0x10043df6
lea ecx, [ebp - 0x3030]
call fcn.1000391f
push dword [ebp - 0x3044]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor ebx, ebx
mov esi, ebx
jmp 0x10043dc7
xor esi, esi
lea ecx, [ebp - 0x3030]
call fcn.1000391f
jmp 0x10043a79