Function at 0x101afc0
Capabilities:
Encode data using xor
Get file size
Read file via mapping

Disassembly:
push 0x1c
mov eax, 0x1055095
call fcn.01021eb9
xor esi, esi
mov dword [ebp - 0x20], esi
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x10], esi
call fcn.010151da
mov ecx, dword [ebp + 8]
xor edi, edi
inc edi
mov dword [ebp - 4], esi
mov dword [ebp - 0x20], edi
call fcn.01014fc6
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
push esi
push esi
push 3
push esi
push edi
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
mov dword [ebp - 0x28], ebx
cmp ebx, 0xffffffff
je 0x101b1f9
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0xffffffff
je 0x101b1f0
push esi
push edi
push esi
push 2
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [ebp - 0x24], eax
cmp eax, esi
je 0x101b1f0
push edi
push esi
push esi
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ebx, eax
mov dword [ebp - 0x18], ebx
test ebx, ebx
je 0x101b1e7
movzx eax, word [ebx]
mov dword [ebp - 0x1c], eax
movzx eax, ax
mov dword [ebp + 0xc], ebx
cmp eax, 0xbbef
je 0x101b085
cmp eax, 0xfeff
je 0x101b07b
cmp eax, 0xfffe
jne 0x101b130
shr edi, 1
dec edi
mov esi, edi
jmp 0x101b16a
cmp edi, 2
jbe 0x101b130
cmp byte [ebx + 2], 0xbf
jne 0x101b130
add ebx, 3
mov dword [ebp - 0x10], 0xfde9
mov dword [ebp + 0xc], ebx
sub edi, 3
mov ebx, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xor eax, eax
push eax
push eax
push edi
push dword [ebp + 0xc]
push eax
push dword [ebp - 0x10]
call ebx
mov esi, eax
test esi, esi
je 0x101b1dd
mov ecx, dword [ebp + 8]
lea eax, [esi + 1]
push eax
call fcn.010158a3
push esi
push eax
push edi
push dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
push 0
push dword [ebp - 0x10]
call ebx
test eax, eax
jne 0x101b0f4
mov ecx, dword [ebp + 8]
push 0xffffffffffffffff
call fcn.01015023
and dword [ebp - 0x14], 0
mov ebx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
test edx, edx
je 0x101b1e0
mov eax, edx
test esi, esi
jbe 0x101b11b
mov ecx, esi
cmp word [eax], 0
jne 0x101b116
push 0x20
pop edi
mov word [eax], di
inc eax
inc eax
dec ecx
jne 0x101b10a
mov ecx, dword [ebp + 8]
xor eax, eax
push 0xffffffffffffffff
mov word [edx + esi*2], ax
call fcn.01015023
jmp 0x101b1e0
or dword [ebp - 0x14], 0xffffffff
lea eax, [ebp - 0x14]
push eax
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_IsTextUnicode]
mov dword [ebp - 0x14], eax
test eax, eax
je 0x101b14d
mov esi, edi
shr esi, 1
jmp 0x101b160
push edi
push ebx
call fcn.0101a85e
neg eax
sbb eax, eax
and eax, 0xfde9
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x14], 0
je 0x101b0a8
mov ecx, dword [ebp + 8]
lea eax, [esi + 1]
push eax
call fcn.010158a3
mov ecx, eax
mov eax, 0xfeff
mov dword [ebp - 0x14], ecx
cmp word [ebp - 0x1c], ax
jne 0x101b190
lea eax, [esi + esi]
push eax
lea eax, [ebx + 2]
push eax
jmp 0x101b1cf
mov eax, 0xfffe
cmp word [ebp - 0x1c], ax
jne 0x101b1ca
lea eax, [ebx + 2]
test esi, esi
jbe 0x101b0f7
sub ecx, eax
mov dword [ebp + 0xc], esi
movzx dx, byte [eax + 1]
mov di, word [eax]
shl di, 8
xor dx, di
mov word [ecx + eax], dx
inc eax
inc eax
dec dword [ebp + 0xc]
jne 0x101b1ab
jmp 0x101b0f7
lea eax, [esi + esi]
push eax
push ebx
push ecx
call fcn.01022620
add esp, 0xc
jmp 0x101b0f7
mov ebx, dword [ebp - 0x18]
push ebx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x28]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + 8]
call fcn.01021fa5
ret 8