Function at 0x63f7a0
Capabilities:
Encode data using xor
Get file size
Read file on windows
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x6a1850
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
push esi
push edi
mov esi, ecx
mov eax, dword [esp + 0x3c]
lea edx, [esp + 0x2c]
push eax
xor ebx, ebx
sub esp, 0x10
mov dword [esp + 0x30], ebx
mov ecx, esp
mov dword [esp + 0x24], esp
push edx
call fcn.0041cf60
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x38]
push eax
push ecx
mov ecx, esi
mov byte [esp + 0x38], bl
call fcn.0063f520
cmp eax, ebx
jne 0x63f80d
push 1
lea ecx, [esp + 0x30]
mov dword [esp + 0x20], 0xffffffff
call fcn.004031c0
xor eax, eax
jmp 0x63fa00
mov eax, dword [esp + 0x30]
cmp eax, ebx
jne 0x63f81a
mov eax, 0x6a3560
push ebx
push 0x80
push 3
push ebx
push ebx
push SysReAllocString
push eax
call dword [sym.imp.kernel32.dll_CreateFileA]
mov edi, eax
or esi, 0xffffffff
cmp edi, esi
jne 0x63f868
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x1c], esi
cmp ecx, ebx
je 0x63f9af
mov al, byte [ecx - 1]
test al, al
je 0x63f9a5
cmp al, 0xff
je 0x63f9a5
dec al
mov byte [ecx - 1], al
xor eax, eax
jmp 0x63fa00
lea edx, [esp + 0x3c]
push edx
push edi
call dword [sym.imp.kernel32.dll_GetFileSize]
cmp eax, esi
mov dword [esp + 0x28], eax
jne 0x63f8b2
push edi
call dword [sym.imp.kernel32.dll_CloseHandle]
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x1c], esi
cmp ecx, ebx
je 0x63f9af
mov al, byte [ecx - 1]
test al, al
je 0x63f9a5
cmp al, 0xff
je 0x63f9a5
dec al
mov byte [ecx - 1], al
xor eax, eax
jmp 0x63fa00
lea ebp, [eax + 8]
push ebp
call fcn.00673b05
push ebx
mov esi, eax
call fcn.00675056
push eax
call fcn.00674662
add esp, 0xc
call fcn.0067466f
and eax, 0x800000ff
jns 0x63f8df
dec eax
or eax, 0xffffff00
inc eax
mov byte [ebx + esi], al
inc ebx
cmp ebx, 4
jb 0x63f8cc
mov ecx, dword [esp + 0x28]
lea eax, [esp + 0x3c]
push 0
push eax
lea edx, [esi + 8]
push ecx
push edx
push edi
mov byte [esi + 4], 0x4b
mov byte [esi + 5], 0x53
mov byte [esi + 6], 0x43
mov byte [esi + 7], 1
call dword [sym.imp.kernel32.dll_ReadFile]
push edi
call dword [sym.imp.kernel32.dll_CloseHandle]
xor ecx, ecx
mov word [0x6d8e90], 0x464
test ebp, ebp
jbe 0x63f95e
mov dl, byte [ecx + esi]
mov ebx, dword [0x6d8e90]
xor eax, eax
mov edi, dword [0x6d8e94]
mov al, byte [0x6d8e91]
xor al, dl
xor dx, dx
mov dl, al
add edx, ebx
imul dx, word [0x6d8e92]
add edx, edi
inc ecx
mov word [0x6d8e90], dx
mov byte [ecx + esi - 1], al
cmp ecx, ebp
jb 0x63f925
mov eax, dword [esp + 0x30]
test eax, eax
jne 0x63f96b
mov eax, 0x6a3560
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.kernel32.dll_CreateFileA]
mov edi, eax
or ebx, 0xffffffff
cmp edi, ebx
jne 0x63f9b3
push esi
call fcn.006713a0
mov ecx, dword [esp + 0x34]
add esp, 4
mov dword [esp + 0x1c], ebx
test ecx, ecx
jmp 0x63f88d
dec ecx
push ecx
call fcn.006713a0
add esp, 4
xor eax, eax
jmp 0x63fa00
lea eax, [esp + 0x3c]
push 0
push eax
push ebp
push esi
push edi
call dword [sym.imp.kernel32.dll_WriteFile]
push edi
call dword [sym.imp.kernel32.dll_CloseHandle]
push esi
call fcn.006713a0
mov ecx, dword [esp + 0x34]
add esp, 4
test ecx, ecx
mov dword [esp + 0x1c], ebx
je 0x63f9fb
mov al, byte [ecx - 1]
test al, al
je 0x63f9f1
cmp al, 0xff
je 0x63f9f1
dec al
mov byte [ecx - 1], al
jmp 0x63f9fb
dec ecx
push ecx
call fcn.006713a0
add esp, 4
mov eax, 1
mov ecx, dword [esp + 0x14]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x10
ret 0x1c