Function at 0x406ff6
Capabilities:
Encode data using xor
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2be4
call fcn.00409e80
push ebx
xor ebx, ebx
cmp dword [0x4176f0], ebx
push esi
push edi
mov dword [ebp - 0x18], ebx
je 0x4074c7
cmp dword [0x4176f4], ebx
je 0x407026
push 0xfffffffffffffff6
jmp 0x4070b3
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
push 1
pop eax
mov byte [ebp - 0x38], bl
mov dword [0x4176f4], eax
mov byte [ebp - 0x37], bl
mov word [ebp - 0x36], bx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], ebx
mov word [ebp - 0x2c], bx
mov word [ebp - 0x2a], bx
mov word [ebp - 0x28], bx
mov word [ebp - 0x26], bx
mov word [ebp - 0x24], bx
mov dword [ebp - 0x22], ebx
mov dword [ebp - 0x1e], ebx
mov dword [ebp - 8], eax
push ebx
push 0x80000000
push 3
push ebx
push ebx
push 0xc0000000
push 0x41787c
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
mov dword [ebp - 4], esi
jne 0x4070bd
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x20
jne 0x4070a1
push 0x64
call edi
inc dword [ebp - 8]
cmp word [ebp - 8], 0x14
jle 0x407061
push esi
jmp 0x407103
cmp eax, 2
mov dword [0x4176f4], ebx
je 0x4070b9
cmp eax, 3
je 0x4070b9
push 0xffffffffffffffde
pop eax
jmp 0x4074d2
push 0xffffffffffffffe0
jmp 0x4070b3
mov dword [ebp - 8], 1
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push ebx
push eax
push ebx
push ebx
push esi
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_LockFile]
test eax, eax
jne 0x407111
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x21
je 0x4070f0
cmp eax, 0xd4
jne 0x4070f4
push 0x64
call edi
inc dword [ebp - 8]
cmp word [ebp - 8], 0x14
jle 0x4070c4
cmp esi, ebx
je 0x407109
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xffffffffffffffdf
pop esi
jmp 0x4074ca
push ebx
push ebx
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
lea eax, [ebp - 0x40]
push ebx
push eax
lea eax, [ebp - 0x38]
push 0x1e
push eax
push esi
call edi
test eax, eax
jne 0x407154
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ebx
push dword [ebp - 0xc]
push ebx
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_UnlockFile]
cmp esi, ebx
je 0x40741b
push esi
jmp 0x407415
lea eax, [ebp - 0x38]
xor esi, esi
cmp si, 0xe
jl 0x407165
cmp si, 0x11
jle 0x407171
mov cl, byte [eax]
add cl, byte [ebp - 0x2a]
inc cl
xor cl, byte [ebp - 0x28]
mov byte [eax], cl
inc eax
inc esi
cmp si, 0x1e
jb 0x407159
call fcn.00408606
cmp word [ebp - 0x36], bx
je 0x4074d9
cmp dword [ebp - 0x34], ebx
je 0x4074d9
mov ecx, eax
sub ecx, dword [ebp - 0x34]
movsx esi, word [ebp - 0x36]
mov eax, ecx
cdq
xor eax, edx
sub eax, edx
lea edx, [esi + 5]
imul edx, edx, 0x3c
cmp eax, edx
jg 0x4074d9
cmp word [ebp + 0x1c], 0x21
jl 0x407230
cmp word [ebp + 0x1c], 0x24
jg 0x407230
movsx eax, word [ebp + 0x1c]
sub eax, 0x21
je 0x4071ec
dec eax
je 0x40720a
dec eax
je 0x4071da
dec eax
je 0x4071d4
push 0xfffffffffffffff9
pop esi
jmp 0x40720a
movsx esi, word [ebp - 0x26]
jmp 0x40720a
mov eax, ecx
push 0x3c
cdq
pop ecx
idiv ecx
mov esi, eax
cmp esi, ebx
jge 0x40720a
neg esi
jmp 0x40720a
movsx ecx, byte [ebp - 0x37]
mov eax, ecx
push 0xa
cdq
pop esi
idiv esi
lea edx, [eax + eax*4]
shl edx, 1
sub ecx, edx
movsx eax, ax
movzx esi, cx
shl eax, 0x10
or esi, eax
push ebx
push dword [ebp - 0xc]
push ebx
push ebx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_UnlockFile]
cmp dword [ebp - 4], ebx
je 0x4074ca
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4074ca
mov ax, word [ebp - 0x2c]
cmp word [ebp + 0x18], ax
jle 0x40725f
push ebx
push dword [ebp - 0xc]
push ebx
push ebx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_UnlockFile]
cmp dword [ebp - 4], ebx
je 0x407257
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or esi, 0xffffffff
jmp 0x4074ca
movsx esi, ax
lea eax, [ebp - 0x40]
push ebx
lea esi, [esi + esi*2]
push eax
shl esi, 2
lea eax, [ebp - 0xb10]
push esi
push eax
push dword [ebp - 4]
call edi
test eax, eax
je 0x4073f8
xor edi, edi
cmp esi, ebx
lea eax, [ebp - 0xb10]
jle 0x4072a3
mov cl, byte [eax]
add cl, byte [ebp - 0x2a]
inc cl
xor cl, byte [ebp - 0x28]
mov byte [eax], cl
inc eax
inc edi
movsx ecx, di
cmp ecx, esi
jl 0x40728e
mov ax, word [ebp + 0x1c]
mov dword [ebp - 0x18], ebx
cmp ax, 9
je 0x40731f
cmp ax, 7
je 0x40731f
cmp ax, 8
je 0x40731f
movsx eax, ax
dec eax
je 0x407316
dec eax
je 0x407316
dec eax
je 0x407316
dec eax
je 0x4072ff
dec eax
je 0x4072ec
dec eax
je 0x4072d8
xor esi, esi
jmp 0x40720a
movsx eax, word [ebp + 0x18]
lea eax, [eax + eax*2]
movsx esi, word [ebp + eax*4 - 0xb1a]
jmp 0x40720a
movsx eax, word [ebp + 0x18]
lea eax, [eax + eax*2]
mov esi, dword [ebp + eax*4 - 0xb18]
jmp 0x40720a
movsx eax, word [ebp + 0x18]
lea eax, [eax + eax*2]
movsx esi, word [ebp + eax*4 - 0xb1c]
sub esi, 4
jmp 0x40720a
movsx esi, word [ebp - 0x2c]
jmp 0x40720a
cmp word [ebp - 0x2c], bx
mov dword [ebp - 8], ebx
jle 0x4074aa
push 1
push ebx
push ebx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
movsx edi, word [ebp - 8]
mov dword [ebp - 0x14], eax
push ebx
lea eax, [edi + edi*2]
lea esi, [ebp + eax*4 - 0xb10]
lea eax, [ebp - 0x40]
push eax
movsx eax, word [esi]
push eax
lea eax, [ebp - 0x2be4]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4073f8
movsx eax, word [ebp + 0x18]
dec eax
cmp edi, eax
mov dword [ebp - 0x48], eax
jl 0x4073e2
movsx ecx, word [esi]
xor eax, eax
cmp ecx, ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x44], ecx
jle 0x4073dd
mov edx, dword [ebp - 0x14]
mov ecx, edx
imul ecx, ecx, 0x11
imul edx, edx, 0xb
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x3c], edx
lea esi, [ebp + eax - 0x2be4]
mov eax, dword [ebp - 0x3c]
cdq
mov ebx, 0xff
mov cl, byte [esi]
idiv ebx
add cl, byte [ebp - 0x2a]
mov eax, dword [ebp - 0x14]
inc cl
xor cl, byte [ebp - 0x28]
add cl, dl
cdq
idiv ebx
inc cl
mov eax, dword [ebp - 0x10]
xor cl, dl
inc eax
mov byte [esi], cl
mov dword [ebp - 0x10], eax
movsx ecx, word [ebp - 0x2a]
add dword [ebp - 0x3c], ecx
movsx ecx, word [ebp - 0x28]
add dword [ebp - 0x14], ecx
cmp eax, dword [ebp - 0x44]
jl 0x407397
xor ebx, ebx
cmp edi, dword [ebp - 0x48]
je 0x407422
inc dword [ebp - 8]
mov ax, word [ebp - 8]
cmp ax, word [ebp - 0x2c]
jl 0x40732c
jmp 0x4074aa
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ebx
push dword [ebp - 0xc]
push ebx
push ebx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_UnlockFile]
cmp dword [ebp - 4], ebx
je 0x40741b
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xffffffffffffffde
jmp 0x40710b
mov eax, dword [ebp - 0x2be4]
cmp eax, dword [ebp + 8]
je 0x407436
mov dword [ebp - 0x18], 0xfffffffe
jmp 0x4074aa
cmp word [ebp + 0x1c], 9
jne 0x40744d
movsx eax, word [ebp - 8]
lea eax, [eax + eax*2]
mov eax, dword [ebp + eax*4 - 0xb08]
jmp 0x4074a7
mov eax, dword [ebp + 0x10]
dec eax
cmp ax, bx
jge 0x407458
xor eax, eax
movsx ecx, ax
movsx eax, word [ebp + 0x14]
add eax, ecx
mov dword [ebp - 0x10], ebx
cmp ecx, eax
mov dword [ebp + 0x18], eax
jge 0x4074a4
movsx eax, word [ebp - 8]
push 4
lea eax, [eax + eax*2]
pop esi
movsx eax, word [ebp + eax*4 - 0xb10]
cdq
idiv esi
lea edx, [ebp + ecx*4 - 0x2be0]
lea esi, [eax - 1]
mov eax, dword [ebp + 0xc]
cmp ecx, esi
jg 0x4074a4
mov edi, dword [edx]
inc dword [ebp - 0x10]
mov dword [eax], edi
add eax, 4
inc ecx
add edx, 4
cmp ecx, dword [ebp + 0x18]
jl 0x40748d
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
push ebx
push dword [ebp - 0xc]
push ebx
push ebx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_UnlockFile]
cmp dword [ebp - 4], ebx
je 0x4074c7
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x18]
mov dword [0x4176f4], ebx
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 0x18
push ebx
push dword [ebp - 0xc]
push ebx
push ebx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_UnlockFile]
cmp dword [ebp - 4], ebx
je 0x4074f6
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xffffffffffffffdd
jmp 0x40710b