Function at 0x401280
Capabilities:
Encode data using xor
Extract resource via kernel32 functions
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc38
mov eax, dword [0x41d040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_FindResourceW]
push edi
push str.MSI_FILE
mov edi, ecx
mov dword [ebp - 0xc24], edx
push 0xa7
push edi
mov dword [ebp - 0xc14], edi
call esi
test eax, eax
je 0x4017f7
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x4017f7
mov dl, byte [ebp + 8]
movzx ecx, dl
mov dword [ebp - 0xc08], 0
mov dword [ebp - 0xc0c], 0
mov ecx, dword [eax + ecx*4]
mov dword [ebp - 0xc38], ecx
test dl, dl
je 0x40130e
mov ecx, dword [eax + 8]
add eax, 0xc
mov dword [ebp - 0xc0c], ecx
mov dword [ebp - 0xc08], eax
push ebx
push str.MSI_FILE
push 0x84
push edi
call esi
mov ebx, eax
test ebx, ebx
je 0x401782
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0xc18], eax
test eax, eax
je 0x401782
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
mov dword [ebp - 0xc10], 0
call ebx
cmp byte [ebp + 8], 0
mov dword [ebp - 0xc20], eax
mov dword [ebp - 0xc28], 0
je 0x4015bf
push str.MSI_FILE
push 0xa4
push edi
call esi
mov esi, eax
test esi, esi
je 0x401546
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0xc10], eax
test eax, eax
je 0x401546
push esi
push edi
call ebx
xor edx, edx
mov dword [ebp - 0xc28], eax
xor esi, esi
mov dword [ebp - 0xc2c], edx
mov ecx, 0x811c9dc5
mov dword [ebp - 0xc1c], esi
cmp dword [ebp - 0xc0c], edx
jle 0x401470
mov ebx, dword [ebp - 0xc08]
mov eax, dword [ebp - 0xc0c]
add ebx, 8
mov edi, dword [ebp - 0xc10]
mov dword [ebp - 0xc30], eax
nop dword [eax + eax]
mov esi, dword [ebx - 4]
cmp edx, esi
jge 0x401411
sub esi, edx
xor edx, edx
test esi, esi
jle 0x401411
nop
movzx eax, byte [edi + edx]
inc edx
xor eax, ecx
imul ecx, eax, 0x1000193
cmp edx, esi
jl 0x401400
mov esi, dword [ebx]
test esi, esi
jle 0x401433
mov edx, dword [ebx - 8]
add edx, dword [ebp - 0xc18]
movzx eax, byte [edx]
lea edx, [edx + 1]
xor eax, ecx
imul ecx, eax, 0x1000193
sub esi, 1
jne 0x401420
mov eax, dword [ebx - 4]
sub eax, dword [ebp - 0xc2c]
mov edx, dword [ebx - 4]
mov esi, dword [ebp - 0xc1c]
add edx, dword [ebx]
add esi, eax
add ebx, 0xc
mov dword [ebp - 0xc1c], esi
sub dword [ebp - 0xc30], 1
lea edi, [eax + edi]
mov dword [ebp - 0xc2c], edx
jne 0x4013f0
mov edi, dword [ebp - 0xc14]
mov eax, dword [ebp - 0xc28]
cmp esi, eax
jge 0x4014a1
mov esi, eax
xor edx, edx
mov eax, dword [ebp - 0xc1c]
sub esi, eax
test esi, esi
jle 0x4014a1
mov ebx, dword [ebp - 0xc10]
add ebx, eax
nop dword [eax]
movzx eax, byte [ebx + edx]
inc edx
xor eax, ecx
imul ecx, eax, 0x1000193
cmp edx, esi
jl 0x401490
mov esi, dword [ebp - 0xc20]
cmp ecx, dword [ebp - 0xc38]
je 0x4015f2
cmp byte [ebp + 0xc], 0
jne 0x401530
mov esi, dword [sym.imp.USER32.dll_LoadStringW]
lea eax, [ebp - 0x204]
push 0x100
push eax
push 0x64
push edi
call esi
test eax, eax
jne 0x4014db
mov word [ebp - 0x204], ax
push 0x100
lea eax, [ebp - 0x404]
push eax
push 0x66
push edi
call esi
test eax, eax
jne 0x4014f7
mov word [ebp - 0x404], ax
push dword [ebp - 0xc24]
lea eax, [ebp - 0x404]
push eax
lea eax, [ebp - 0xc04]
push 0x400
push eax
call fcn.004020e0
add esp, 0x10
lea eax, [ebp - 0x204]
push 0x10
push eax
lea eax, [ebp - 0xc04]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
pop ebx
pop edi
mov eax, 0x69
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00402254
mov esp, ebp
pop ebp
ret
cmp byte [ebp + 0xc], 0
jne 0x4017e1
mov esi, dword [sym.imp.USER32.dll_LoadStringW]
lea eax, [ebp - 0x204]
push 0x100
push eax
push 0x64
push edi
call esi
test eax, eax
jne 0x401572
mov word [ebp - 0x204], ax
push 0x100
lea eax, [ebp - 0x404]
push eax
push 0xa6
push edi
call esi
test eax, eax
jne 0x401591
mov word [ebp - 0x404], ax
push 0x10
lea eax, [ebp - 0x204]
push eax
lea eax, [ebp - 0x404]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
pop ebx
pop edi
mov eax, 0x68
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00402254
mov esp, ebp
pop ebp
ret
mov esi, eax
xor edx, edx
mov ecx, 0x811c9dc5
test esi, esi
jle 0x4014a7
mov edi, dword [ebp - 0xc18]
movzx eax, byte [edi + edx]
inc edx
xor eax, ecx
imul ecx, eax, 0x1000193
cmp edx, esi
jl 0x4015d6
mov edi, dword [ebp - 0xc14]
jmp 0x4014a7
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push dword [ebp - 0xc24]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4016b1
mov esi, dword [sym.imp.USER32.dll_LoadStringW]
lea eax, [ebp - 0x204]
push 0x100
push eax
push 0x64
push edi
call esi
test eax, eax
jne 0x40163d
mov word [ebp - 0x204], ax
push 0x100
lea eax, [ebp - 0x404]
push eax
push 0xa7
push edi
call esi
test eax, eax
jne 0x40165c
mov word [ebp - 0x404], ax
push dword [ebp - 0xc24]
lea eax, [ebp - 0x404]
push eax
lea eax, [ebp - 0xc04]
push 0x400
push eax
call fcn.004020e0
add esp, 0x10
cmp byte [ebp + 0xc], 0
jne 0x40169b
push 0x10
lea eax, [ebp - 0x204]
push eax
lea eax, [ebp - 0xc04]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
pop ebx
pop edi
mov eax, 0x6b
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00402254
mov esp, ebp
pop ebp
ret
cmp byte [ebp + 8], 0
je 0x401757
xor edx, edx
xor edi, edi
mov dword [ebp - 0xc14], edx
cmp dword [ebp - 0xc0c], edx
jle 0x401742
mov esi, dword [ebp - 0xc08]
mov ecx, dword [ebp - 0xc10]
add esi, 8
mov dword [ebp - 0xc08], ecx
mov eax, dword [esi - 4]
cmp edi, eax
jge 0x4016f8
sub eax, edi
mov edx, ecx
push eax
mov ecx, ebx
call fcn.00401170
add esp, 4
mov edx, dword [esi - 8]
mov ecx, ebx
push dword [esi]
add edx, dword [ebp - 0xc18]
call fcn.00401170
mov ecx, dword [esi - 4]
add esp, 4
mov eax, dword [ebp - 0xc08]
sub ecx, edi
mov edi, dword [esi]
mov edx, dword [ebp - 0xc14]
add edi, dword [esi - 4]
add edx, ecx
lea eax, [eax + ecx]
mov dword [ebp - 0xc14], edx
add esi, 0xc
mov dword [ebp - 0xc08], eax
sub dword [ebp - 0xc0c], 1
mov ecx, eax
jne 0x4016e2
mov eax, dword [ebp - 0xc28]
cmp edx, eax
jge 0x401768
sub eax, edx
add edx, dword [ebp - 0xc10]
push eax
jmp 0x40175e
mov edx, dword [ebp - 0xc18]
push esi
mov ecx, ebx
call fcn.00401170
add esp, 4
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00402254
mov esp, ebp
pop ebp
ret
cmp byte [ebp + 0xc], 0
jne 0x4017e1
mov esi, dword [sym.imp.USER32.dll_LoadStringW]
lea eax, [ebp - 0x404]
push 0x100
push eax
push 0x64
push edi
call esi
test eax, eax
jne 0x4017aa
mov word [ebp - 0x404], ax
push 0x100
lea eax, [ebp - 0x204]
push eax
push 0xa6
push edi
call esi
test eax, eax
jne 0x4017c9
mov word [ebp - 0x204], ax
push 0x10
lea eax, [ebp - 0x404]
push eax
lea eax, [ebp - 0x204]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
pop ebx
pop edi
mov eax, 0x68
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00402254
mov esp, ebp
pop ebp
ret
cmp byte [ebp + 0xc], 0
jne 0x401856
mov esi, dword [sym.imp.USER32.dll_LoadStringW]
lea eax, [ebp - 0x404]
push 0x100
push eax
push 0x64
push edi
call esi
test eax, eax
jne 0x40181f
mov word [ebp - 0x404], ax
push 0x100
lea eax, [ebp - 0x204]
push eax
push 0xa6
push edi
call esi
test eax, eax
jne 0x40183e
mov word [ebp - 0x204], ax
push 0x10
lea eax, [ebp - 0x404]
push eax
lea eax, [ebp - 0x204]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, dword [ebp - 4]
mov eax, 0x67
pop edi
xor ecx, ebp
pop esi
call fcn.00402254
mov esp, ebp
pop ebp
ret