Function at 0x401b00
Capabilities:
Access peb ldr_data
Encode data using xor
Get file size
Hash data using murmur2
Read file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x3c
mov ebx, dword [esp + 0x50]
mov eax, dword [0x431880]
xor eax, esp
mov dword [esp + 0x38], eax
mov edi, dword fs:[0x30]
mov edi, dword [edi + 0xc]
mov esi, dword [edi + 0xc]
mov eax, dword [esi]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
mov dword [0x432668], eax
push 0x2fa52d62
push dword [0x432668]
call section..text
sub esp, 0x14
movaps xmm0, xmmword [0x427020]
movups xmmword [esp + 4], xmm0
mov dword [esp], ebx
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x80
call eax
cmp eax, 0xffffffff
je 0x401e39
mov edi, eax
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
je 0x401e12
push eax
mov esi, eax
call fcn.00406615
add esp, 4
mov ebp, eax
lea ebx, [esp + 0x20]
push 0
push ebx
push esi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x401e09
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + 0x3c]
movzx ecx, word [ebp + eax + 6]
mov dword [esp + 0x18], ecx
test ecx, ecx
je 0x401e1b
mov esi, ebp
add esi, eax
add esi, 0xf8
xor ecx, ecx
mov dword [esp], 0
mov dword [esp + 4], 0
mov dword [esp + 0x10], ebp
jmp 0x401bfe
add esi, 0x28
inc ecx
cmp ecx, dword [esp + 0x18]
je 0x401e2a
mov dword [esp + 0x1c], ecx
xorps xmm0, xmm0
movsd qword [esp + 0x30], xmm0
xorps xmm0, xmm0
movups xmmword [esp + 0x20], xmm0
push esi
call fcn.00414390
add esp, 4
test eax, eax
js 0x401e4e
mov edi, eax
cmp eax, 0xf
mov dword [esp + 0xc], esi
ja 0x401c50
mov dword [esp + 0x30], edi
mov dword [esp + 0x34], 0xf
push edi
push esi
push ebx
call fcn.0040cb60
add esp, 0xc
add edi, esp
add edi, 0x20
jmp 0x401cae
mov eax, edi
or eax, 0xf
cmp eax, 0x17
mov esi, 0x16
cmovae esi, eax
cmp eax, 0xfff
jb 0x401c80
lea eax, [esi + 0x24]
push eax
call fcn.004065af
add esp, 4
lea ebx, [eax + 0x23]
and ebx, 0xffffffe0
mov dword [ebx - 4], eax
jmp 0x401c8e
lea eax, [esi + 1]
push eax
call fcn.004065af
add esp, 4
mov ebx, eax
mov dword [esp + 0x20], ebx
mov dword [esp + 0x30], edi
mov dword [esp + 0x34], esi
push edi
push dword [esp + 0x10]
push ebx
call fcn.0040cb60
add esp, 0xc
add edi, ebx
lea ebx, [esp + 0x20]
mov byte [edi], 0
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x30]
mov edi, eax
xor edi, 0x235
mov edx, dword [esp + 0x34]
mov dword [esp + 8], edx
cmp edx, 0x10
mov edx, ebx
cmovae edx, ecx
cmp eax, 4
jb 0x401d58
mov dword [esp + 0x14], ecx
mov ebx, eax
shr ebx, 2
xor esi, esi
cmp ebx, 1
je 0x401d30
and ebx, 0xfffffffe
xor esi, esi
nop
imul ebp, dword [edx + esi*4], 0x5bd1e995
mov ecx, ebp
shr ecx, 0x18
xor ecx, ebp
imul ecx, ecx, 0x5bd1e995
imul edi, edi, 0x5bd1e995
xor edi, ecx
imul ecx, dword [edx + esi*4 + 4], 0x5bd1e995
mov ebp, ecx
shr ebp, 0x18
xor ebp, ecx
imul ecx, ebp, 0x5bd1e995
imul edi, edi, 0x5bd1e995
xor edi, ecx
add esi, 2
cmp ebx, esi
jne 0x401cf0
test al, 4
mov ebp, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
je 0x401d58
imul esi, dword [edx + esi*4], 0x5bd1e995
mov ebx, esi
shr ebx, 0x18
xor ebx, esi
imul esi, ebx, 0x5bd1e995
imul edi, edi, 0x5bd1e995
xor edi, esi
mov ebx, eax
and ebx, 0xfffffffc
and eax, 3
xor esi, esi
cmp eax, 1
je 0x401d83
cmp eax, 2
je 0x401d79
cmp eax, 3
jne 0x401d91
movsx esi, byte [edx + ebx + 2]
shl esi, 0x10
movsx eax, byte [edx + ebx + 1]
shl eax, 8
xor esi, eax
movsx eax, byte [edx + ebx]
xor eax, esi
imul eax, eax, 0x5bd1e995
xor edi, eax
mov eax, dword [esp + 8]
cmp eax, 0x10
lea ebx, [esp + 0x20]
mov esi, dword [esp + 0xc]
jb 0x401dd1
lea edx, [eax + 1]
cmp edx, 0x1000
jb 0x401dc7
mov eax, dword [ecx - 4]
add ecx, 0xfffffffc
sub ecx, eax
cmp ecx, 0x20
jae 0x401e53
mov edx, dword [esp + 8]
add edx, 0x24
mov ecx, eax
push edx
push ecx
call fcn.004065e4
add esp, 8
mov eax, edi
shr eax, 0xd
xor eax, edi
imul eax, eax, 0x5bd1e995
mov ecx, eax
shr ecx, 0xf
xor ecx, eax
cmp ecx, 0x57d08554
mov ecx, dword [esp + 0x1c]
jne 0x401bf0
mov eax, dword [esi + 0x14]
add eax, ebp
mov dword [esp + 4], eax
mov eax, dword [esi + 0x10]
mov dword [esp], eax
jmp 0x401bf0
push ebp
call fcn.0040661e
add esp, 4
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x401e39
mov dword [esp + 4], 0
mov dword [esp], 0
push dword [esp]
push dword [esp + 8]
call fcn.00401a40
add esp, 8
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.00406623
mov al, 1
add esp, 0x3c
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.00402400
call fcn.00412433
int3