Function at 0x41f310
Capabilities:
Check if file exists
Encode data using xor
Get file attributes
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d5a38
mov eax, dword fs:[0]
push eax
sub esp, 0x1b0
mov eax, dword [0x50e770]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push ecx
lea edx, [ebp + 8]
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x40]
call fcn.00421980
lea edx, [ebp + 0x20]
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x58]
call fcn.00421980
add esp, 4
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x198]
cmp dword [ebp - 0x2c], 0x10
lea eax, [ebp - 0x40]
push ecx
cmovae eax, dword [ebp - 0x40]
xor edi, edi
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
push eax
cmovne edi, dword [ebp - 0x178]
mov dword [ebp - 0x1b0], edi
call dword [sym.imp.KERNEL32.dll_FindClose]
push edi
call fcn.0045febf
add esp, 4
mov esi, eax
mov dword [ebp - 0x1a8], esi
push edi
push 0
push esi
call fcn.00464400
add esp, 0xc
mov dword [ebp - 0x19c], 0
cmp dword [ebp - 0x2c], 0x10
lea ecx, [ebp - 0x40]
lea eax, [ebp - 0x19c]
cmovae ecx, dword [ebp - 0x40]
push 0x500c60
push ecx
push eax
call fcn.0045fbbc
add esp, 0xc
test eax, eax
je 0x41f3ea
xor esi, esi
jmp 0x41f641
push dword [ebp - 0x19c]
push edi
push 1
push esi
call fcn.00460116
push dword [ebp - 0x19c]
call fcn.0045fe48
xor ecx, ecx
add esp, 0x14
mov eax, edi
add eax, 8
setb cl
neg ecx
or ecx, eax
push ecx
call fcn.0045febf
add esp, 4
mov dword [ebp - 0x1a4], eax
lea ecx, [edi + 8]
push ecx
push 0
push eax
call fcn.00464400
add esp, 0xc
xor edx, edx
test edi, edi
je 0x41f504
mov ecx, dword [ebp - 0x1a4]
cmp edi, 0x20
jb 0x41f4d6
lea eax, [esi - 1]
add eax, edi
cmp ecx, eax
ja 0x41f45e
lea eax, [ecx - 1]
add eax, edi
cmp eax, esi
jae 0x41f4d6
movdqa xmm1, xmmword [0x509080]
mov eax, edi
mov dword [ebp - 0x1ac], edi
and eax, 0x1f
sub dword [ebp - 0x1ac], eax
mov edi, ecx
sub edi, esi
mov eax, esi
mov dword [ebp - 0x1b4], edi
lea edi, [ecx + 0x10]
mov ecx, dword [ebp - 0x1b4]
mov dword [ebp - 0x1b8], edi
mov edi, dword [ebp - 0x1b0]
mov esi, dword [ebp - 0x1b8]
mov edi, edi
movdqu xmm0, xmmword [eax]
lea eax, [eax + 0x20]
pxor xmm0, xmm1
movdqu xmmword [ecx + eax - 0x20], xmm0
movdqu xmm0, xmmword [eax - 0x10]
pxor xmm0, xmm1
movdqu xmmword [esi + edx], xmm0
add edx, 0x20
cmp edx, dword [ebp - 0x1ac]
jb 0x41f4a0
mov esi, dword [ebp - 0x1a8]
mov ecx, dword [ebp - 0x1a4]
cmp edx, edi
jae 0x41f504
sub esi, dword [ebp - 0x1a4]
add ecx, edx
mov dword [ebp - 0x1a8], edi
sub edi, edx
lea ebx, [ebx]
mov al, byte [esi + ecx]
lea ecx, [ecx + 1]
xor al, 2
mov byte [ecx - 1], al
dec edi
jne 0x41f4f0
mov edi, dword [ebp - 0x1b0]
lea ecx, [ebp - 0x28]
call fcn.00425f20
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x18]
inc eax
push eax
call fcn.0045dcd1
mov ecx, dword [ebp - 0x18]
add esp, 4
inc ecx
mov esi, eax
push ecx
push 0
push esi
call fcn.00464400
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x28]
add esp, 0xc
cmp dword [ebp - 0x14], 0x10
cmovae ecx, dword [ebp - 0x28]
inc eax
push ecx
push eax
push esi
call fcn.0045fa8e
movzx eax, byte [esi]
add esp, 0xc
mov ecx, dword [ebp - 0x1a4]
xor al, 2
push esi
mov byte [edi + ecx], al
movzx eax, byte [esi + 1]
xor al, 2
mov byte [edi + ecx + 1], al
movzx eax, byte [esi + 2]
xor al, 2
mov byte [edi + ecx + 2], al
movzx eax, byte [esi + 3]
xor al, 2
mov byte [edi + ecx + 3], al
movzx eax, byte [esi + 4]
xor al, 2
mov byte [edi + ecx + 4], al
movzx eax, byte [esi + 5]
xor al, 2
mov byte [edi + ecx + 5], al
movzx eax, byte [esi + 6]
xor al, 2
mov byte [edi + ecx + 6], al
movzx eax, byte [esi + 7]
xor al, 2
mov byte [edi + ecx + 7], al
call fcn.0045f0eb
add esp, 4
mov dword [ebp - 0x1a0], 0
cmp dword [ebp - 0x44], 0x10
lea eax, [ebp - 0x58]
cmovae eax, dword [ebp - 0x58]
push 0x500c5c
push eax
lea eax, [ebp - 0x1a0]
push eax
call fcn.0045fbbc
add esp, 0xc
test eax, eax
jne 0x41f61c
push dword [ebp - 0x1a0]
lea eax, [edi + 8]
push 1
push eax
mov eax, dword [ebp - 0x1a4]
push eax
call fcn.0045fd5a
push dword [ebp - 0x1a0]
call fcn.0045fe48
add esp, 0x14
lea eax, [ebp + 0x20]
cmp dword [ebp + 0x34], 8
cmovae eax, dword [ebp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x41f61c
test al, 0x10
jne 0x41f61c
mov esi, 1
jmp 0x41f61e
xor esi, esi
cmp dword [ebp - 0x14], 0x10
jb 0x41f62f
push dword [ebp - 0x28]
call fcn.0045e46c
add esp, 4
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
cmp dword [ebp - 0x44], 0x10
jb 0x41f652
push dword [ebp - 0x58]
call fcn.0045e46c
add esp, 4
cmp dword [ebp - 0x2c], 0x10
mov dword [ebp - 0x44], 0xf
mov dword [ebp - 0x48], 0
mov byte [ebp - 0x58], 0
jb 0x41f675
push dword [ebp - 0x40]
call fcn.0045e46c
add esp, 4
cmp dword [ebp + 0x1c], 8
mov dword [ebp - 0x2c], 0xf
mov dword [ebp - 0x30], 0
mov byte [ebp - 0x40], 0
jb 0x41f698
push dword [ebp + 8]
call fcn.0045e46c
add esp, 4
xor eax, eax
mov dword [ebp + 0x1c], 7
cmp dword [ebp + 0x34], 8
mov dword [ebp + 0x18], 0
mov word [ebp + 8], ax
jb 0x41f6bd
push dword [ebp + 0x20]
call fcn.0045e46c
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045e471
mov esp, ebp
pop ebp
ret