Function at 0x48dd10
Capabilities:
Encode data using xor
Get file size
Read file on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x52b008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push 0
call fcn.004dba23
add esp, 4
push 0
push 0xc8
push edx
push eax
call fcn.004f0b80
add eax, 0x190
mov ebx, 0
mov dword [ebp - 0x228], eax
je 0x48de04
push edi
push 0x104
lea eax, [ebp - 0x21c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
push 0
cmp esi, 0xffffffff
je 0x48df9d
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push eax
mov dword [ebp - 0x224], eax
call fcn.00490df1
add esp, 4
mov edi, eax
lea eax, [ebp - 0x224]
push 0
push eax
push dword [ebp - 0x224]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor esi, esi
cmp dword [ebp - 0x224], esi
jbe 0x48dded
push 0
call fcn.004dba23
xor byte [esi + edi], al
lea ecx, [esi + edi]
inc esi
add esp, 4
cmp esi, dword [ebp - 0x224]
jb 0x48ddd4
push edi
call fcn.00490dec
inc ebx
add esp, 4
cmp ebx, dword [ebp - 0x228]
jb 0x48dd54
pop edi
mov edx, 0x21
mov ecx, 0x20
sub edx, 0x5a5500
mov eax, ecx
and eax, 0x1f
movzx eax, byte [eax + 0x5a54e0]
xor byte [ecx + 0x5a54e0], al
lea eax, [edx + 0x5a54e0]
add eax, ecx
and eax, 0x1f
movzx eax, byte [eax + 0x5a54e0]
xor byte [ecx + 0x5a54e1], al
add ecx, 2
cmp ecx, 0x26a
jb 0x48de14
push dword [0x5a5720]
call fcn.00490df1
push dword [0x5a5720]
mov dword [0x5a5500], eax
push int.00478d10
push eax
call fcn.004d8ea0
push dword [0x5a5730]
mov dword [0x5a5504], 0x52bb90
call fcn.00490df1
push dword [0x5a5730]
mov dword [0x5a5508], eax
push fcn.00414b70
push eax
call fcn.004d8ea0
mov eax, dword [0x509014]
add esp, 0x20
movq xmm0, qword [0x50900c]
mov ecx, 0xd
mov dword [ebp - 0xc], eax
mov ax, word [0x509018]
mov word [ebp - 8], ax
mov al, byte [0x50901a]
movq qword [ebp - 0x14], xmm0
mov byte [ebp - 6], al
mov al, byte [ebp + ecx - 0x15]
xor byte [ebp + ecx - 0x14], al
dec ecx
test ecx, ecx
jg 0x48dec4
xor byte [ebp - 0x14], 0x29
lea eax, [ebp - 0x14]
push eax
push str.Kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
mov dword [0x5a550c], 0x401110
lea eax, [ebp - 0x220]
mov dword [ebp - 0x220], 0
push eax
push 4
push dword [0x5a5740]
push fcn.00414b70
call esi
push dword [0x5a5740]
push fcn.004039f0
push fcn.00414b70
call fcn.004d8ea0
mov eax, dword [0x5a5740]
add esp, 0xc
xor edx, edx
test eax, eax
je 0x48df5f
nop word [eax + eax]
mov eax, edx
mov ecx, edx
and eax, 0x1f
add ecx, fcn.00414b70
inc edx
mov al, byte [eax + 0x5a54e0]
xor byte [ecx], al
mov eax, dword [0x5a5740]
cmp edx, eax
jb 0x48df40
lea ecx, [ebp - 0x220]
push ecx
push dword [ebp - 0x220]
push eax
push fcn.00414b70
call esi
push 0x5a54e0
call fcn.00414b70
push 0x5a54e0
call int.00478d10
push 0x5a54e0
call fcn.004039f0
pop esi
pop ebx
cmp eax, 0x10000
je 0x48dfa3
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.00490dde
mov esp, ebp
pop ebp
ret