Function at 0x40df80
Capabilities:
Encode data using xor
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14c
mov eax, dword [0x43b004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor edi, edi
mov esi, edx
push edi
push edi
push 3
push edi
push 3
push Ordinal_1
push ecx
mov dword [ebp - 0x140], edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x144], eax
cmp eax, 0xffffffff
je 0x40e265
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x13c], eax
add eax, 0x400
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
mov dword [ebp - 0x148], ebx
test ebx, ebx
je 0x40e253
push edi
lea eax, [ebp - 0x13c]
push eax
push dword [ebp - 0x13c]
push ebx
push dword [ebp - 0x144]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40e243
push dword [ebp - 0x144]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [ebp - 0x13c]
xor ecx, ecx
mov dword [ebp - 0x144], 0xffffffff
mov dl, 0x77
test edi, edi
je 0x40e053
nop dword [eax]
xor byte [ecx + ebx], dl
lea eax, [ecx + ebx]
add dl, cl
inc ecx
cmp ecx, edi
jb 0x40e040
mov edi, dword [ebp - 0x13c]
sub esp, 8
mov edx, edi
mov ecx, ebx
call fcn.00413c50
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x40e23b
cmp dword [ebx], 1
je 0x40e095
mov dword [0x43c560], 0x80000
xor edi, edi
cmp dword [ebx], 1
je 0x40e1b1
mov dword [0x43c560], 0x80000
jmp 0x40e23d
mov eax, dword [ebx + 4]
mov dword [ebp - 0x14c], eax
lea edi, [eax + 0x140]
mov ecx, edi
sub ecx, esi
nop dword [eax + eax]
mov al, byte [esi]
lea esi, [esi + 1]
mov byte [ecx + esi - 1], al
test al, al
jne 0x40e0b0
mov ecx, edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40e0c2
mov eax, dword [ebp - 0x14c]
sub ecx, edx
mov al, byte [ecx + eax + 0x13f]
cmp al, 0x5c
je 0x40e0f4
cmp al, 0x2f
je 0x40e0f4
dec edi
mov al, byte [edi + 1]
lea edi, [edi + 1]
test al, al
jne 0x40e0e1
mov ax, word [0x435f5c]
mov word [edi], ax
lea eax, [ebp - 0x138]
mov dword [0x43c560], 0
push eax
or edx, 0xffffffff
mov ecx, ebx
call fcn.00413df0
add esp, 4
test eax, eax
jne 0x40e07b
mov edi, dword [ebp - 0x138]
xor esi, esi
test edi, edi
jle 0x40e18e
mov dword [ebp - 0x138], 0
mov byte [ebp - 0x134], 0
mov dword [ebp - 0x10], 0
cmp dword [ebx], 1
jne 0x40e184
mov ecx, dword [ebx + 4]
lea eax, [ebp - 0x138]
push eax
push esi
call fcn.00413100
mov dword [0x43c560], eax
test eax, eax
jne 0x40e18e
cmp dword [ebx], 1
jne 0x40e184
mov ecx, dword [ebx + 4]
lea eax, [ebp - 0x134]
sub esp, 8
push eax
push esi
call fcn.00413910
mov dword [0x43c560], eax
test eax, eax
jne 0x40e18e
inc esi
cmp esi, edi
jl 0x40e126
jmp 0x40e18e
mov dword [0x43c560], 0x80000
xor eax, eax
cmp esi, edi
mov dword [ebp - 0x140], eax
mov eax, 1
mov edi, dword [ebp - 0x140]
cmove edi, eax
mov dword [ebp - 0x140], edi
jmp 0x40e07d
mov esi, dword [ebx + 4]
cmp dword [esi + 4], 0xffffffff
je 0x40e1c1
mov ecx, dword [esi]
call fcn.00413090
mov edi, dword [esi]
mov dword [esi + 4], 0xffffffff
test edi, edi
je 0x40e210
cmp dword [edi + 0x7c], 0
je 0x40e1db
mov ecx, edi
call fcn.00413090
mov eax, dword [edi]
mov dword [ebp - 0x14c], eax
test eax, eax
je 0x40e207
cmp byte [eax + 0x10], 0
je 0x40e1fc
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x14c]
push 0x20
push eax
call fcn.004157ab
add esp, 8
push edi
call fcn.004194d4
add esp, 4
push ecx
mov ecx, esi
mov dword [esi], 0
mov dword [0x43c560], 0
call fcn.00413d90
push 8
push ebx
call fcn.004157ab
mov edi, dword [ebp - 0x140]
add esp, 8
jmp 0x40e23d
xor edi, edi
mov ebx, dword [ebp - 0x148]
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 0x144]
cmp eax, 0xffffffff
je 0x40e265
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041559f
mov esp, ebp
pop ebp
ret