Function at 0x401460
Capabilities:
Delete file
Encode data using xor
Move file
Read file on windows
Write file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x84c
mov eax, dword [esp + 0x860]
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x80000000
mov dword [esp], eax
call sub.KERNEL32.dll_CreateFileA
sub esp, 0x1c
cmp eax, 0xffffffff
je 0x401758
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], pe_nt_image_headers32
mov edi, eax
mov dword [esp + 0x10], 2
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x40000000
mov dword [esp], str.temp.bin
call sub.KERNEL32.dll_CreateFileA
sub esp, 0x1c
cmp eax, 0xffffffff
mov dword [esp + 0x28], eax
lea ebx, [esp + 0x40]
lea esi, [esp + 0x3c]
movzx ecx, byte [esp + 0x864]
je 0x40177d
mov byte [esp + 0x2f], cl
mov esi, esi
lea edi, [edi]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], esi
mov dword [esp + 8], 0x400
mov dword [esp + 4], ebx
mov dword [esp], edi
call sub.KERNEL32.dll_ReadFile
sub esp, 0x14
test eax, eax
je 0x401592
mov ebp, dword [esp + 0x3c]
test ebp, ebp
je 0x401592
movzx ecx, byte [esp + 0x2f]
lea edx, [ebx + ebp]
mov eax, ebx
lea esi, [esi]
xor byte [eax], cl
add eax, 1
cmp edx, eax
jne 0x401560
mov eax, dword [esp + 0x28]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], ebp
mov dword [esp + 4], ebx
mov dword [esp], eax
call sub.KERNEL32.dll_WriteFile
sub esp, 0x14
jmp 0x401520
mov dword [esp], edi
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
mov eax, dword [esp + 0x28]
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
mov eax, dword [esp + 0x860]
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x10], 2
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x40000000
mov dword [esp], eax
call sub.KERNEL32.dll_CreateFileA
sub esp, 0x1c
cmp eax, 0xffffffff
mov ebp, eax
je 0x401733
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x80000000
mov dword [esp], str.temp.bin.LRW
call sub.KERNEL32.dll_CreateFileA
sub esp, 0x1c
cmp eax, 0xffffffff
mov edi, eax
jne 0x40166f
jmp 0x4017a4
mov eax, dword [esp + 0x3c]
test eax, eax
je 0x401696
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
mov dword [esp + 4], ebx
mov dword [esp], ebp
call sub.KERNEL32.dll_WriteFile
sub esp, 0x14
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], esi
mov dword [esp + 8], 0x400
mov dword [esp + 4], ebx
mov dword [esp], edi
call sub.KERNEL32.dll_ReadFile
sub esp, 0x14
test eax, eax
jne 0x401644
mov dword [esp], ebp
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
mov dword [esp], edi
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
mov eax, dword [esp + 0x860]
lea ebx, [esp + 0x440]
mov dword [esp + 8], 0x400
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.msvcrt.dll_strncpy
mov edx, ebx
mov ecx, dword [edx]
add edx, 4
lea eax, [ecx - 0x1010101]
not ecx
and eax, ecx
and eax, 0x80808080
je 0x4016d0
test eax, 0x8080
jne 0x4016f3
shr eax, 0x10
add edx, 2
mov ecx, eax
add cl, al
mov eax, dword [esp + 0x860]
sbb edx, 3
mov dword [edx], 0x57524c2e
mov byte [edx + 4], 0
mov dword [esp + 4], ebx
mov dword [esp], eax
call sub.msvcrt.dll_rename
mov dword [esp], str.temp.bin.LRW
call sub.KERNEL32.dll_DeleteFileA
xor eax, eax
sub esp, 4
add esp, 0x84c
pop ebx
pop esi
pop edi
pop ebp
ret
call sub.KERNEL32.dll_GetLastError
mov dword [esp], str.Error_opening_input_file_for_writing:__d_n
mov dword [esp + 4], eax
call sub.msvcrt.dll_printf
add esp, 0x84c
mov eax, 1
pop ebx
pop esi
pop edi
pop ebp
ret
call sub.KERNEL32.dll_GetLastError
mov dword [esp], str.Error_opening_input_file:__d_n
mov dword [esp + 4], eax
call sub.msvcrt.dll_printf
add esp, 0x84c
mov eax, 1
pop ebx
pop esi
pop edi
pop ebp
ret
call sub.KERNEL32.dll_GetLastError
mov dword [esp], str.Error_creating_temporary_file:__d_n
mov dword [esp + 4], eax
call sub.msvcrt.dll_printf
mov dword [esp], edi
call sub.KERNEL32.dll_CloseHandle
mov eax, 1
sub esp, 4
jmp 0x401728
call sub.KERNEL32.dll_GetLastError
mov dword [esp], str.Error_opening_temporary_file:__d_n
mov dword [esp + 4], eax
call sub.msvcrt.dll_printf
mov dword [esp], ebp
call sub.KERNEL32.dll_CloseHandle
mov eax, 1
sub esp, 4
jmp 0x401728