Function at 0x401cfc
Capabilities:
Check if file exists
Encode data using xor
Get file attributes
Set file attributes
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x401d27
test al, 1
je 0x401d27
and eax, 0xfffffffe
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x401d27
leave
ret
push esi
xor esi, esi
push esi
push esi
push 2
push esi
push 1
push 0x40000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0xc], eax
cmp eax, esi
je 0x401f1a
cmp eax, 0xffffffff
je 0x401f1a
push ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x401d61
push 3
call edi
cmp dword [0x413538], esi
jne 0x401d5d
push 1
call edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.004049b7
call fcn.004049c9
mov edi, eax
shl edi, 0xc
call fcn.004049c9
or eax, edi
xor edx, edx
mov ecx, 0xe2
div ecx
lea edi, [edx + 0x2d8]
push edi
mov dword [ebp - 0x1c], edi
call fcn.004041d5
pop ecx
pop ecx
mov ebx, eax
cmp edi, esi
jbe 0x401dbf
call fcn.004049c9
cdq
mov ecx, 0xff
idiv ecx
mov byte [esi + ebx], dl
inc esi
cmp esi, edi
jb 0x401daa
lea eax, [edi + ebx]
movzx ecx, byte [eax - 1]
movzx edx, byte [eax - 2]
shl cx, 8
or cx, dx
movzx ecx, cx
mov dword [ebp - 8], ecx
movzx ecx, byte [eax - 3]
movzx eax, byte [eax - 4]
shl cx, 8
or cx, ax
movzx esi, cx
call fcn.004049c9
mov dword [ebp - 4], eax
shl dword [ebp - 4], 0xc
call fcn.004049c9
or eax, dword [ebp - 4]
mov ecx, edi
shr ecx, 1
xor edx, edx
div ecx
shr edi, 2
xor esi, 0x44
add edx, edi
mov eax, edx
xor eax, dword [ebp - 8]
lea ecx, [edx + ebx]
mov word [ebx], ax
lea eax, [ecx + 2]
mov word [eax], si
mov esi, dword [ebp + 0x18]
add esi, 0x18
lea edi, [eax + 2]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, dword [ebp + 0x18]
add esi, 0x28
lea edi, [eax + 0x12]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, dword [ebp + 0xc]
mov edi, dword [esi]
mov dword [eax + 0x22], edi
mov esi, dword [esi + 4]
mov dword [eax + 0x26], esi
mov esi, dword [0x413530]
and dword [ebp - 4], 0
mov dword [eax + 0x2a], esi
mov esi, dword [0x413534]
mov dword [eax + 0x2e], esi
mov esi, dword [ebp + 0x10]
mov edi, dword [esi]
mov dword [eax + 0x32], edi
mov esi, dword [esi + 4]
mov dword [eax + 0x36], esi
mov esi, dword [ebp + 0x14]
mov edi, dword [esi]
mov dword [eax + 0x3a], edi
mov esi, dword [esi + 4]
mov dword [eax + 0x3e], esi
mov dword [ebp - 8], 0x81c3d17
mov edi, dword [ebp - 4]
movzx esi, byte [edi + ecx + 4]
mov dword [ebp - 0x14], esi
imul esi, edi
add esi, dword [ebp - 8]
mov dword [ebp - 0x18], esi
mov esi, dword [ebp - 0x14]
imul esi, dword [ebp - 8]
add esi, 0xd1a3
xor esi, dword [ebp - 0x18]
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x40
mov dword [ebp - 8], esi
jl 0x401e7f
push dword [ebp + 0x20]
add esi, edx
push dword [ebp + 0x1c]
mov dword [eax + 0x42], esi
mov esi, dword [ebp - 0x1c]
mov ecx, 0xffff
push esi
push ebx
mov word [eax + 0x46], cx
call fcn.004029dc
push dword [0x416214]
push dword [0x416210]
push esi
push ebx
call fcn.004029dc
and dword [ebp - 0x10], 0
add esp, 0x20
push 0
lea eax, [ebp - 0x10]
push eax
push esi
push ebx
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop edi
pop ebx
test eax, eax
je 0x401f11
cmp dword [ebp - 0x10], esi
jne 0x401f11
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
inc eax
jmp 0x401f1c
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop esi
leave
ret