Function at 0x10002ce0
Capabilities:
Encode data using xor
Get file size
Read file on windows

Disassembly:
mov eax, 0x220c
call fcn.1000d2b0
mov eax, dword [0x1001703c]
xor eax, esp
mov dword [esp + 0x2208], eax
mov eax, dword [esp + 0x2210]
push esi
push edi
mov esi, edx
mov dword [esp + 8], 0
cmp eax, 1
jne 0x10002de4
push 0
push 0
dec ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x10002fbf
push 0
lea eax, [esp + 0xc]
push eax
push 0x1000
lea ecx, [esp + 0x21c]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10002fbf
mov ecx, dword [0x10019df0]
or eax, 0xffffffff
xor edx, edx
jmp 0x10002d60
movzx esi, byte [esp + edx + 0x210]
mov edi, eax
and edi, 0xff
xor esi, edi
movzx edi, byte [esp + edx + 0x211]
shr eax, 8
xor eax, dword [ecx + esi*4]
add edx, 4
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
xor eax, dword [ecx + esi*4]
movzx esi, byte [esp + edx + 0x20e]
mov edi, eax
and edi, 0xff
xor esi, edi
shr eax, 8
xor eax, dword [ecx + esi*4]
movzx esi, byte [esp + edx + 0x20f]
mov edi, eax
and edi, 0xff
xor esi, edi
shr eax, 8
xor eax, dword [ecx + esi*4]
cmp edx, 0x1000
jb 0x10002d60
pop edi
not eax
pop esi
mov ecx, dword [esp + 0x2208]
xor ecx, esp
call fcn.1000536e
add esp, 0x220c
ret
test eax, eax
jne 0x10002ea8
push eax
push eax
dec ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x10002fbf
push 0
lea edx, [esp + 0xc]
push edx
push 0x200
lea eax, [esp + 0x1c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10002fbf
mov ecx, dword [0x10019df0]
or eax, 0xffffffff
xor edx, edx
jmp 0x10002e30
movzx esi, byte [esp + edx + 0x10]
mov edi, eax
and edi, 0xff
xor esi, edi
movzx edi, byte [esp + edx + 0x11]
shr eax, 8
xor eax, dword [ecx + esi*4]
add edx, 4
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
xor eax, dword [ecx + esi*4]
movzx esi, byte [esp + edx + 0xe]
mov edi, eax
and edi, 0xff
xor esi, edi
shr eax, 8
xor eax, dword [ecx + esi*4]
movzx esi, byte [esp + edx + 0xf]
mov edi, eax
and edi, 0xff
xor esi, edi
shr eax, 8
xor eax, dword [ecx + esi*4]
cmp edx, 0x200
jb 0x10002e30
pop edi
not eax
pop esi
mov ecx, dword [esp + 0x2208]
xor ecx, esp
call fcn.1000536e
add esp, 0x220c
ret
cmp eax, 2
jne 0x10002f54
mov edi, dword [sym.imp.KERNEL32.dll_GetFileSize]
push ebx
push ebp
push 0
push esi
call edi
mov ebp, eax
mov dword [esp + 0x14], 0x2fc77e8
cmp ebp, 0x2fc77e8
jae 0x10002ed4
mov dword [esp + 0x14], ebp
test ebp, ebp
jne 0x10002edc
push ebp
push esi
call edi
mov edi, 0x2fc77e8
cmp eax, 0x2fc77e8
ja 0x10002eea
mov edi, eax
push edi
call fcn.100053f2
add esp, 4
push 0
push 0
push 0
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x10002f0b
xor edi, edi
jmp 0x10002f23
push 0
lea ecx, [esp + 0x14]
push ecx
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edi, eax
neg edi
sbb edi, edi
and edi, ebx
mov edx, dword [esp + 0x14]
call fcn.100010c0
mov esi, eax
push edi
xor esi, ebp
call fcn.1000537d
add esp, 4
pop ebp
pop ebx
pop edi
mov eax, esi
pop esi
mov ecx, dword [esp + 0x2208]
xor ecx, esp
call fcn.1000536e
add esp, 0x220c
ret
cmp eax, 3
jne 0x10002fbf
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, 0x2000
cmp eax, edi
jae 0x10002f6d
mov edi, eax
push 0
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x10002fbf
push 0
lea edx, [esp + 0xc]
push edx
push edi
lea eax, [esp + 0x21c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10002fbf
mov edx, edi
lea edi, [esp + 0x210]
call fcn.100010c0
pop edi
pop esi
mov ecx, dword [esp + 0x2208]
xor ecx, esp
call fcn.1000536e
add esp, 0x220c
ret
mov ecx, dword [esp + 0x2210]
pop edi
pop esi
xor ecx, esp
xor eax, eax
call fcn.1000536e
add esp, 0x220c
ret