Function at 0x10002e30
Capabilities:
Encode data using xor
Get common file path
Get file size
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x10026008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x104
lea eax, [ebp - 0x108]
mov dword [ebp - 0x110], ecx
push 0
push eax
call fcn.1000a170
add esp, 0xc
lea eax, [ebp - 0x108]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea edi, [ebp - 0x108]
dec edi
nop dword [eax + eax]
mov al, byte [edi + 1]
lea edi, [edi + 1]
test al, al
jne 0x10002e80
mov ax, word [0x10021b54]
mov edx, str.MUTEX_OBSFL
mov word [edi], ax
mov esi, edx
nop word [eax + eax]
mov al, byte [edx]
inc edx
test al, al
jne 0x10002ea0
lea edi, [ebp - 0x108]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x10002eb0
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x108]
dec ecx
nop dword [eax]
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x10002ed0
mov eax, dword [str..key]
push 0
push 0x80
push 4
mov dword [ecx], eax
mov al, byte [0x10021b5c]
push 0
push 2
mov byte [ecx + 4], al
lea eax, [ebp - 0x108]
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
mov dword [ebp - 0x10c], 0
push 0
push ebx
mov dword [ebp - 0x120], ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0x3200000
jae 0x10002f37
push 2
push 0
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov edi, dword [ebp - 0x110]
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
push esi
mov dword [ebp - 0x118], esi
call fcn.100083b9
add esp, 4
xor edx, edx
mov ebx, eax
test esi, esi
jle 0x10003036
cmp esi, 0x40
jb 0x10003015
lea eax, [edi - 1]
lea ecx, [ebx - 1]
add eax, esi
add ecx, esi
cmp ebx, eax
ja 0x10002f80
cmp ecx, edi
jae 0x10003015
mov eax, esi
and eax, 0x8000003f
jns 0x10002f8e
dec eax
or eax, 0xffffffc0
inc eax
movaps xmm2, xmmword [0x100235d0]
mov ecx, esi
sub ecx, eax
mov esi, edi
sub esi, ebx
mov dword [ebp - 0x114], ecx
mov dword [ebp - 0x11c], esi
lea ecx, [edi + 0x30]
mov esi, dword [ebp - 0x118]
lea eax, [ebx + 0x10]
mov edi, dword [ebp - 0x11c]
nop dword [eax + eax]
movups xmm0, xmmword [ecx - 0x30]
lea ecx, [ecx + 0x40]
add edx, 0x40
movaps xmm1, xmm2
lea eax, [eax + 0x40]
pxor xmm0, xmm2
movups xmmword [eax - 0x50], xmm0
movups xmm0, xmmword [edi + eax - 0x40]
pxor xmm0, xmm2
movups xmmword [eax - 0x40], xmm0
movups xmm0, xmmword [ecx - 0x50]
pxor xmm0, xmm2
movups xmmword [eax - 0x30], xmm0
movups xmm0, xmmword [ecx - 0x40]
pxor xmm1, xmm0
movups xmmword [eax - 0x20], xmm1
cmp edx, dword [ebp - 0x114]
jl 0x10002fc0
mov edi, dword [ebp - 0x110]
mov dword [ebp - 0x114], edx
cmp edx, esi
jge 0x10003036
sub edi, ebx
lea ecx, [edx + ebx]
sub esi, edx
nop dword [eax]
mov al, byte [ecx + edi]
lea ecx, [ecx + 1]
xor al, 0x62
mov byte [ecx - 1], al
sub esi, 1
jne 0x10003020
mov edi, dword [ebp - 0x110]
push 0
lea eax, [ebp - 0x10c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, dword [ebp - 0x120]
push eax
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10008398
mov esp, ebp
pop ebp
ret