Function at 0x401270
Capabilities:
Encode data using xor
Extract resource via kernel32 functions
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc34
mov eax, dword [0x41c00c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_FindResourceW]
push edi
push str.MSI_FILE
mov edi, ecx
mov dword [ebp - 0xc1c], edx
push 0xa7
push edi
mov dword [ebp - 0xc2c], edi
call esi
test eax, eax
je 0x4017c5
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x4017c5
mov dl, byte [ebp + 8]
movzx ecx, dl
mov dword [ebp - 0xc20], 0
mov dword [ebp - 0xc0c], 0
mov ecx, dword [eax + ecx*4]
mov dword [ebp - 0xc34], ecx
test dl, dl
je 0x4012fe
mov ecx, dword [eax + 8]
add eax, 0xc
mov dword [ebp - 0xc0c], ecx
mov dword [ebp - 0xc20], eax
push ebx
push str.MSI_FILE
push 0x84
push edi
call esi
mov ebx, eax
test ebx, ebx
je 0x401750
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0xc14], eax
test eax, eax
je 0x401750
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
mov dword [ebp - 0xc10], 0
call ebx
cmp byte [ebp + 8], 0
mov dword [ebp - 0xc18], eax
mov dword [ebp - 0xc24], 0
je 0x4015a1
push str.MSI_FILE
push 0xa4
push edi
call esi
mov esi, eax
test esi, esi
je 0x401528
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0xc10], eax
test eax, eax
je 0x401528
push esi
push edi
call ebx
mov ebx, eax
xor esi, esi
mov eax, dword [ebp - 0xc0c]
xor edx, edx
mov dword [ebp - 0xc24], ebx
mov ecx, 0x811c9dc5
mov dword [ebp - 0xc08], esi
test eax, eax
jle 0x401456
mov edi, dword [ebp - 0xc20]
add edi, 4
mov dword [ebp - 0xc28], eax
nop dword [eax]
mov ebx, dword [edi]
sub ebx, edx
cmp edx, dword [edi]
jge 0x4013fb
xor edx, edx
test ebx, ebx
jle 0x4013fb
add esi, dword [ebp - 0xc10]
movzx eax, byte [esi + edx]
inc edx
xor eax, ecx
imul ecx, eax, 0x1000193
cmp edx, ebx
jl 0x4013e4
mov esi, dword [ebp - 0xc08]
mov eax, dword [edi + 4]
mov dword [ebp - 0xc30], eax
test eax, eax
jle 0x401432
mov edx, dword [edi - 4]
mov esi, eax
add edx, dword [ebp - 0xc14]
movzx eax, byte [edx]
lea edx, [edx + 1]
xor eax, ecx
imul ecx, eax, 0x1000193
sub esi, 1
jne 0x401413
mov eax, dword [ebp - 0xc30]
mov esi, dword [ebp - 0xc08]
mov edx, dword [edi]
add esi, ebx
add edx, eax
mov dword [ebp - 0xc08], esi
add edi, 0xc
sub dword [ebp - 0xc28], 1
jne 0x4013d0
mov edi, dword [ebp - 0xc2c]
mov ebx, dword [ebp - 0xc24]
cmp esi, ebx
jge 0x401483
mov eax, dword [ebp - 0xc08]
mov esi, ebx
sub esi, eax
xor edx, edx
test esi, esi
jle 0x401483
mov ebx, dword [ebp - 0xc10]
add ebx, eax
movzx eax, byte [ebx + edx]
inc edx
xor eax, ecx
imul ecx, eax, 0x1000193
cmp edx, esi
jl 0x401472
mov ebx, dword [ebp - 0xc18]
cmp ecx, dword [ebp - 0xc34]
je 0x4015d4
cmp byte [ebp + 0xc], 0
jne 0x401512
mov esi, dword [sym.imp.USER32.dll_LoadStringW]
lea eax, [ebp - 0x204]
push 0x100
push eax
push 0x64
push edi
call esi
test eax, eax
jne 0x4014bd
mov word [ebp - 0x204], ax
push 0x100
lea eax, [ebp - 0x404]
push eax
push 0x66
push edi
call esi
test eax, eax
jne 0x4014d9
mov word [ebp - 0x404], ax
push dword [ebp - 0xc1c]
lea eax, [ebp - 0x404]
push eax
lea eax, [ebp - 0xc04]
push 0x400
push eax
call fcn.004020b0
add esp, 0x10
lea eax, [ebp - 0x204]
push 0x10
push eax
lea eax, [ebp - 0xc04]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
pop ebx
pop edi
mov eax, 0x69
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00402224
mov esp, ebp
pop ebp
ret
cmp byte [ebp + 0xc], 0
jne 0x4017af
mov esi, dword [sym.imp.USER32.dll_LoadStringW]
lea eax, [ebp - 0x204]
push 0x100
push eax
push 0x64
push edi
call esi
test eax, eax
jne 0x401554
mov word [ebp - 0x204], ax
push 0x100
lea eax, [ebp - 0x404]
push eax
push 0xa6
push edi
call esi
test eax, eax
jne 0x401573
mov word [ebp - 0x404], ax
push 0x10
lea eax, [ebp - 0x204]
push eax
lea eax, [ebp - 0x404]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
pop ebx
pop edi
mov eax, 0x68
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00402224
mov esp, ebp
pop ebp
ret
mov ebx, eax
xor edx, edx
mov ecx, 0x811c9dc5
test ebx, ebx
jle 0x401489
mov edi, dword [ebp - 0xc14]
movzx eax, byte [edx + edi]
inc edx
xor eax, ecx
imul ecx, eax, 0x1000193
cmp edx, ebx
jl 0x4015b8
mov edi, dword [ebp - 0xc2c]
jmp 0x401489
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push dword [ebp - 0xc1c]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ecx, eax
mov dword [ebp - 0xc08], ecx
cmp ecx, 0xffffffff
jne 0x401699
mov esi, dword [sym.imp.USER32.dll_LoadStringW]
lea eax, [ebp - 0x204]
push 0x100
push eax
push 0x64
push edi
call esi
test eax, eax
jne 0x401625
mov word [ebp - 0x204], ax
push 0x100
lea eax, [ebp - 0x404]
push eax
push 0xa7
push edi
call esi
test eax, eax
jne 0x401644
mov word [ebp - 0x404], ax
push dword [ebp - 0xc1c]
lea eax, [ebp - 0x404]
push eax
lea eax, [ebp - 0xc04]
push 0x400
push eax
call fcn.004020b0
add esp, 0x10
cmp byte [ebp + 0xc], 0
jne 0x401683
push 0x10
lea eax, [ebp - 0x204]
push eax
lea eax, [ebp - 0xc04]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
pop ebx
pop edi
mov eax, 0x6b
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00402224
mov esp, ebp
pop ebp
ret
cmp byte [ebp + 8], 0
je 0x401722
xor ebx, ebx
xor edi, edi
cmp dword [ebp - 0xc0c], ebx
jle 0x40170a
mov esi, dword [ebp - 0xc20]
add esi, 8
mov eax, dword [esi - 4]
cmp edi, eax
jge 0x4016d9
mov edx, dword [ebp - 0xc10]
sub eax, edi
push eax
lea edx, [ebx + edx]
call fcn.00401170
mov ecx, dword [ebp - 0xc08]
add esp, 4
mov edx, dword [esi - 8]
push dword [esi]
add edx, dword [ebp - 0xc14]
call fcn.00401170
mov eax, dword [esi - 4]
add esp, 4
mov ecx, dword [ebp - 0xc08]
sub eax, edi
mov edi, dword [esi]
add ebx, eax
add edi, dword [esi - 4]
add esi, 0xc
sub dword [ebp - 0xc0c], 1
jne 0x4016b8
mov eax, dword [ebp - 0xc24]
cmp ebx, eax
jge 0x401731
mov edx, dword [ebp - 0xc10]
sub eax, ebx
push eax
lea edx, [ebx + edx]
jmp 0x401729
mov edx, dword [ebp - 0xc14]
push ebx
call fcn.00401170
add esp, 4
push dword [ebp - 0xc08]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00402224
mov esp, ebp
pop ebp
ret
cmp byte [ebp + 0xc], 0
jne 0x4017af
mov esi, dword [sym.imp.USER32.dll_LoadStringW]
lea eax, [ebp - 0x404]
push 0x100
push eax
push 0x64
push edi
call esi
test eax, eax
jne 0x401778
mov word [ebp - 0x404], ax
push 0x100
lea eax, [ebp - 0x204]
push eax
push 0xa6
push edi
call esi
test eax, eax
jne 0x401797
mov word [ebp - 0x204], ax
push 0x10
lea eax, [ebp - 0x404]
push eax
lea eax, [ebp - 0x204]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
pop ebx
pop edi
mov eax, 0x68
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00402224
mov esp, ebp
pop ebp
ret
cmp byte [ebp + 0xc], 0
jne 0x401824
mov esi, dword [sym.imp.USER32.dll_LoadStringW]
lea eax, [ebp - 0x404]
push 0x100
push eax
push 0x64
push edi
call esi
test eax, eax
jne 0x4017ed
mov word [ebp - 0x404], ax
push 0x100
lea eax, [ebp - 0x204]
push eax
push 0xa6
push edi
call esi
test eax, eax
jne 0x40180c
mov word [ebp - 0x204], ax
push 0x10
lea eax, [ebp - 0x404]
push eax
lea eax, [ebp - 0x204]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, dword [ebp - 4]
mov eax, 0x67
pop edi
xor ecx, ebp
pop esi
call fcn.00402224
mov esp, ebp
pop ebp
ret