Function at 0x10001d60
Capabilities:
Encrypt data using rc4 ksa
Get file size
Read file on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x338
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
call fcn.10001050
push 0x104
lea eax, [ebp - 0x110]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
call fcn.10001050
call fcn.10001ab0
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
mov dword [ebp - 0x124], ebx
cmp ebx, 0xffffffff
jne 0x10001dd0
call fcn.10001d50
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push esi
push edi
call fcn.10001050
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
call fcn.10001050
mov dword [ebp - 0xc], 0xeffcadfb
mov dword [ebp - 8], 0xbfdacffe
call fcn.10001ab0
push esi
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
mov dword [ebp - 0x128], edi
call fcn.10001050
call fcn.10001ab0
push 0
lea eax, [ebp - 0x114]
push eax
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
call fcn.10001050
call fcn.10001050
lea eax, [esi - 8]
mov dword [ebp - 0x118], 0
mov ecx, edi
mov dword [ebp - 0x120], eax
lea ebx, [ebp - 0xc]
mov dword [ebp - 0x11c], ecx
sub ebx, edi
nop dword [eax + eax]
mov edi, 8
mov esi, ecx
call fcn.10001ab0
nop dword [eax]
mov al, byte [esi]
dec edi
cmp al, byte [ebx + esi]
jne 0x10001ff8
inc esi
test edi, edi
jne 0x10001e70
mov ebx, dword [ebp - 0x11c]
test ebx, ebx
je 0x1000201f
call fcn.10001050
mov eax, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 0x3000
push 8
call eax
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
movaps xmm0, xmmword [str.1Uh9D7vA_wB_62q]
mov dword [ebp - 0x118], eax
movups xmmword [ebp - 0x138], xmm0
call fcn.10001050
lea esi, [ebp - 0x138]
lea ecx, [esi + 1]
nop dword [eax + eax]
mov al, byte [esi]
inc esi
test al, al
jne 0x10001ed0
sub esi, ecx
xor edi, edi
call fcn.10001050
xor ecx, ecx
mov eax, ecx
mov byte [ebp + ecx - 0x238], cl
cdq
idiv esi
mov al, byte [ebp + edx - 0x138]
mov byte [ebp + ecx - 0x338], al
inc ecx
cmp ecx, 0x100
jl 0x10001ee2
call fcn.10001ab0
xor esi, esi
nop dword [eax]
mov dl, byte [ebp + esi - 0x238]
movzx eax, byte [ebp + esi - 0x338]
add edi, eax
movzx ecx, dl
add edi, ecx
and edi, 0x800000ff
jns 0x10001f36
dec edi
or edi, 0xffffff00
inc edi
mov al, byte [ebp + edi - 0x238]
mov byte [ebp + edi - 0x238], dl
mov byte [ebp + esi - 0x238], al
inc esi
cmp esi, 0x100
jl 0x10001f10
xor esi, esi
xor edx, edx
xor edi, edi
nop word [eax + eax]
inc edi
and edi, 0x800000ff
jns 0x10001f71
dec edi
or edi, 0xffffff00
inc edi
mov cl, byte [ebp + edi - 0x238]
movzx eax, cl
add esi, eax
and esi, 0x800000ff
jns 0x10001f8d
dec esi
or esi, 0xffffff00
inc esi
mov al, byte [ebp + esi - 0x238]
mov byte [ebp + esi - 0x238], cl
movzx ecx, al
mov byte [ebp + edi - 0x238], al
movzx eax, byte [ebp + esi - 0x238]
add ecx, eax
movzx eax, cl
mov ecx, dword [ebp - 0x118]
movzx eax, byte [ebp + eax - 0x238]
xor al, byte [edx + ebx + 8]
mov byte [ecx + edx], al
inc edx
cmp edx, 0x3000
jl 0x10001f60
pop edi
pop esi
call fcn.10001ab0
push dword [ebp - 0x124]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x118]
xor ecx, ebp
pop ebx
call fcn.1000223c
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x118]
dec ebx
mov ecx, dword [ebp - 0x11c]
inc eax
inc ecx
mov dword [ebp - 0x118], eax
mov dword [ebp - 0x11c], ecx
cmp eax, dword [ebp - 0x120]
jbe 0x10001e60
call fcn.10001d50
push dword [ebp - 0x128]
mov eax, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 0
call eax
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]