Function at 0x49c5a0
Capabilities:
Encode data using xor
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0xa8120
call fcn.00545c90
mov eax, dword [0x57a040]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 0
push 0x20
push 2
push 0
push 1
push 0x40000000
push ebx
mov dword [ebp - 0xa810c], ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0xa8108], eax
cmp eax, 0xffffffff
jne 0x49c607
push ebx
push str.__s__Could_not_open_file
push 1
call fcn.005262e0
add esp, 0xc
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00529f01
mov esp, ebp
pop ebp
ret 4
push 0xa8000
lea eax, [ebp - 0xa800c]
mov dword [ebp - 0xa8104], 0
push 0
push eax
call fcn.0052bd20
add esp, 0xc
lea ebx, [ebp - 0xa7fed]
xor edi, edi
mov dword [ebp - 0xa8100], ebx
mov dword [ebp - 0xa80fc], edi
nop dword [eax + eax]
lea eax, [ebp - 0xa80f8]
mov dword [ebp - 0xa80f8], edi
push eax
lea eax, [ebp - 0xa811c]
mov ecx, 0x9ed0c4
push eax
call fcn.00405650
mov esi, dword [ebp - 0xa8114]
cmp byte [esi + 0xd], 0
jne 0x49c676
cmp edi, dword [esi + 0x10]
jl 0x49c676
mov eax, dword [0x9ed0c4]
jmp 0x49c67d
mov eax, dword [0x9ed0c4]
mov esi, eax
cmp esi, eax
je 0x49c836
lea eax, [ebp - 0xa80cc]
add esi, 0x14
push eax
lea eax, [ebx - 0x1f]
mov ecx, 0x38
lea edi, [ebp - 0xa80ec]
push 0x1f
rep movsd dword es:[edi], dword [esi]
push eax
call fcn.0052d6d0
movzx eax, byte [ebp - 0xa8088]
add esp, 0xc
mov byte [ebx], al
movzx eax, word [ebp - 0xa8098]
mov word [ebx + 1], ax
movzx eax, byte [ebp - 0xa80e8]
mov byte [ebx + 3], al
movzx eax, word [ebp - 0xa80e4]
mov word [ebx + 5], ax
movzx eax, byte [ebp - 0xa80e0]
mov byte [ebx + 7], al
movzx eax, byte [ebp - 0xa80dc]
mov byte [ebx + 8], al
movzx eax, byte [ebp - 0xa8094]
mov byte [ebx + 9], al
movzx eax, byte [ebp - 0xa8090]
mov byte [ebx + 0xa], al
movzx eax, byte [ebp - 0xa807c]
mov byte [ebx + 0xb], al
movzx eax, byte [ebp - 0xa8084]
mov byte [ebx + 0xc], al
movzx eax, byte [ebp - 0xa8080]
mov byte [ebx + 0xd], al
movzx eax, byte [ebp - 0xa8078]
mov byte [ebx + 0xe], al
movzx eax, byte [ebp - 0xa8074]
mov byte [ebx + 0xf], al
movzx eax, byte [ebp - 0xa8070]
mov byte [ebx + 0x10], al
movzx eax, byte [ebp - 0xa806c]
mov byte [ebx + 0x11], al
movzx eax, byte [ebp - 0xa808c]
mov byte [ebx + 0x12], al
movzx eax, word [ebp - 0xa8040]
mov word [ebx + 0x13], ax
movzx eax, word [ebp - 0xa803c]
mov word [ebx + 0x15], ax
movzx eax, word [ebp - 0xa8038]
mov word [ebx + 0x17], ax
movzx eax, word [ebp - 0xa8034]
mov word [ebx + 0x19], ax
movzx eax, word [ebp - 0xa8030]
mov word [ebx + 0x1b], ax
movzx eax, word [ebp - 0xa8044]
mov word [ebx + 0x1d], ax
movzx eax, byte [ebp - 0xa8068]
mov byte [ebx + 0x1f], al
mov eax, dword [ebp - 0xa8064]
mov dword [ebx + 0x21], eax
movzx eax, byte [ebp - 0xa802c]
mov byte [ebx + 0x25], al
movzx eax, byte [ebp - 0xa8060]
mov byte [ebx + 0x2d], al
movzx eax, byte [ebp - 0xa805c]
mov byte [ebx + 0x2e], al
movzx eax, byte [ebp - 0xa8058]
mov byte [ebx + 0x2f], al
movzx eax, byte [ebp - 0xa8054]
mov byte [ebx + 0x30], al
movzx eax, byte [ebp - 0xa8050]
mov byte [ebx + 0x31], al
movzx eax, byte [ebp - 0xa804c]
mov byte [ebx + 0x32], al
movzx eax, byte [ebp - 0xa8048]
mov byte [ebx + 0x33], al
movzx eax, byte [ebp - 0xa8028]
mov byte [ebx + 0x26], al
movzx eax, byte [ebp - 0xa8024]
mov byte [ebx + 0x27], al
movzx eax, byte [ebp - 0xa8020]
mov byte [ebx + 0x28], al
movzx eax, byte [ebp - 0xa801c]
mov byte [ebx + 0x29], al
movzx eax, byte [ebp - 0xa8018]
mov byte [ebx + 0x2a], al
movzx eax, byte [ebp - 0xa8014]
mov byte [ebx + 0x2b], al
movzx eax, byte [ebp - 0xa8010]
mov byte [ebx + 0x2c], al
mov dword [ebp - 0xa80f8], 0
lea edi, [ebx - 0x1e]
mov ebx, dword [ebp - 0xa80f8]
mov word [ebp - 0xa80f4], 0xcffc
mov byte [ebp - 0xa80f2], 0xab
nop dword [eax]
mov eax, 0xaaaaaaab
lea esi, [ebx + 2]
mul ebx
mov ecx, ebx
lea edi, [edi + 6]
shr edx, 1
lea eax, [edx + edx*2]
sub ecx, eax
movzx eax, byte [ebp + ecx - 0xa80f4]
lea ecx, [esi - 1]
xor byte [edi - 7], al
mov eax, 0xaaaaaaab
mul ecx
mov ecx, ebx
shr edx, 1
lea eax, [edx + edx*2]
sub ecx, eax
movzx eax, byte [ebp + ecx - 0xa80f3]
mov ecx, ebx
xor byte [edi - 6], al
mov eax, 0xaaaaaaab
mul esi
shr edx, 1
lea eax, [edx + edx*2]
sub ecx, eax
movzx eax, byte [ebp + ecx - 0xa80f2]
lea ecx, [esi + 1]
xor byte [edi - 5], al
mov eax, 0xaaaaaaab
mul ecx
mov ecx, ebx
shr edx, 1
lea eax, [edx + edx*2]
sub ecx, eax
movzx eax, byte [ebp + ecx - 0xa80f1]
lea ecx, [esi + 2]
xor byte [edi - 4], al
mov eax, 0xaaaaaaab
mul ecx
mov ecx, ebx
shr edx, 1
lea eax, [edx + edx*2]
sub ecx, eax
movzx eax, byte [ebp + ecx - 0xa80f0]
lea ecx, [esi + 3]
xor byte [edi - 3], al
mov eax, 0xaaaaaaab
mul ecx
mov ecx, ebx
add ebx, 6
shr edx, 1
lea eax, [edx + edx*2]
sub ecx, eax
movzx eax, byte [ebp + ecx - 0xa80ef]
xor byte [edi - 2], al
cmp ebx, 0x54
jl 0x49c860
mov edi, dword [ebp - 0xa80fc]
mov ebx, dword [ebp - 0xa8100]
inc edi
add ebx, 0x54
mov dword [ebp - 0xa80fc], edi
mov dword [ebp - 0xa8100], ebx
cmp edi, 0x2000
jl 0x49c640
mov ebx, dword [ebp - 0xa8108]
lea eax, [ebp - 0xa8104]
push 0
push eax
push 0xa8000
lea eax, [ebp - 0xa800c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x49ca1f
mov esi, 0x1c5e200
xor ebx, ebx
nop dword [eax]
mov edx, dword [ebp + ebx - 0xa800c]
mov edi, ebx
shr edi, 2
lea eax, [esi + edx]
xor esi, edx
lea ecx, [edi - 1]
test cl, 1
cmovne esi, eax
test ebx, 0xf
jne 0x49c9bc
and edi, 0x80000007
jns 0x49c9af
dec edi
or edi, 0xfffffff8
inc edi
lea eax, [esi + 0xe2f1]
lea ecx, [edi + 1]
shr eax, cl
xor esi, eax
add ebx, 4
cmp ebx, 0xa7ffc
jle 0x49c980
mov ebx, dword [ebp - 0xa8108]
lea eax, [ebp - 0xa8104]
push 0
push eax
push 4
lea eax, [ebp - 0xa8110]
mov dword [ebp - 0xa8110], esi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x49ca1f
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0xa810c]
push str.__s__create_successfully
push 3
call fcn.005262e0
add esp, 0xc
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00529f01
mov esp, ebp
pop ebp
ret 4
push dword [ebp - 0xa810c]
push str.__s__Could_not_read_file
push 1
call fcn.005262e0
add esp, 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00529f01
mov esp, ebp
pop ebp
ret 4