Function at 0x401280
Capabilities:
Encode data using xor
Extract resource via kernel32 functions
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc38
mov eax, dword [0x41c040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_FindResourceW]
push edi
push str.MSI_FILE
mov edi, ecx
mov dword [ebp - 0xc1c], edx
push 0xa7
push edi
mov dword [ebp - 0xc34], edi
call esi
test eax, eax
je 0x4017fd
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x4017fd
mov dl, byte [ebp + 8]
movzx ecx, dl
mov dword [ebp - 0xc20], 0
mov dword [ebp - 0xc0c], 0
mov ecx, dword [eax + ecx*4]
mov dword [ebp - 0xc38], ecx
test dl, dl
je 0x40130e
mov ecx, dword [eax + 8]
add eax, 0xc
mov dword [ebp - 0xc0c], ecx
mov dword [ebp - 0xc20], eax
push ebx
push str.MSI_FILE
push 0x84
push edi
call esi
mov ebx, eax
test ebx, ebx
je 0x401788
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0xc14], eax
test eax, eax
je 0x401788
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
mov dword [ebp - 0xc10], 0
call ebx
cmp byte [ebp + 8], 0
mov dword [ebp - 0xc18], eax
mov dword [ebp - 0xc24], 0
je 0x4015d4
push str.MSI_FILE
push 0xa4
push edi
call esi
mov esi, eax
test esi, esi
je 0x40155b
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0xc10], eax
test eax, eax
je 0x40155b
push esi
push edi
call ebx
mov edx, dword [ebp - 0xc0c]
mov ebx, eax
xor eax, eax
mov dword [ebp - 0xc24], ebx
xor esi, esi
mov dword [ebp - 0xc28], eax
mov dword [ebp - 0xc08], esi
mov ecx, 0x811c9dc5
test edx, edx
jle 0x401489
mov ebx, dword [ebp - 0xc20]
mov edi, dword [ebp - 0xc14]
add ebx, 8
mov dword [ebp - 0xc2c], ebx
mov dword [ebp - 0xc30], edx
nop
mov edx, dword [ebx - 4]
cmp eax, edx
jge 0x401427
mov esi, edx
xor edx, edx
sub esi, eax
test esi, esi
jle 0x401427
mov ebx, dword [ebp - 0xc10]
add ebx, dword [ebp - 0xc08]
nop dword [eax]
movzx eax, byte [ebx + edx]
inc edx
xor eax, ecx
imul ecx, eax, 0x1000193
cmp edx, esi
jl 0x401410
mov ebx, dword [ebp - 0xc2c]
mov esi, dword [ebx]
test esi, esi
jle 0x401445
mov edx, dword [ebx - 8]
add edx, edi
movzx eax, byte [edx]
lea edx, [edx + 1]
xor eax, ecx
imul ecx, eax, 0x1000193
sub esi, 1
jne 0x401432
mov eax, dword [ebx - 4]
sub eax, dword [ebp - 0xc28]
mov esi, dword [ebp - 0xc08]
add esi, eax
mov eax, dword [ebx]
add eax, dword [ebx - 4]
add ebx, 0xc
sub dword [ebp - 0xc30], 1
mov dword [ebp - 0xc08], esi
mov dword [ebp - 0xc28], eax
mov dword [ebp - 0xc2c], ebx
jne 0x4013f0
mov edi, dword [ebp - 0xc34]
mov ebx, dword [ebp - 0xc24]
cmp esi, ebx
jge 0x4014b6
mov eax, dword [ebp - 0xc08]
mov esi, ebx
sub esi, eax
xor edx, edx
test esi, esi
jle 0x4014b6
mov ebx, dword [ebp - 0xc10]
add ebx, eax
movzx eax, byte [ebx + edx]
inc edx
xor eax, ecx
imul ecx, eax, 0x1000193
cmp edx, esi
jl 0x4014a5
mov ebx, dword [ebp - 0xc18]
cmp ecx, dword [ebp - 0xc38]
je 0x40160c
cmp byte [ebp + 0xc], 0
jne 0x401545
mov esi, dword [sym.imp.USER32.dll_LoadStringW]
lea eax, [ebp - 0x204]
push 0x100
push eax
push 0x64
push edi
call esi
test eax, eax
jne 0x4014f0
mov word [ebp - 0x204], ax
push 0x100
lea eax, [ebp - 0x404]
push eax
push 0x66
push edi
call esi
test eax, eax
jne 0x40150c
mov word [ebp - 0x404], ax
push dword [ebp - 0xc1c]
lea eax, [ebp - 0x404]
push eax
lea eax, [ebp - 0xc04]
push 0x400
push eax
call fcn.004020f0
add esp, 0x10
lea eax, [ebp - 0x204]
push 0x10
push eax
lea eax, [ebp - 0xc04]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
pop ebx
pop edi
mov eax, 0x69
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00402264
mov esp, ebp
pop ebp
ret
cmp byte [ebp + 0xc], 0
jne 0x4017e7
mov esi, dword [sym.imp.USER32.dll_LoadStringW]
lea eax, [ebp - 0x204]
push 0x100
push eax
push 0x64
push edi
call esi
test eax, eax
jne 0x401587
mov word [ebp - 0x204], ax
push 0x100
lea eax, [ebp - 0x404]
push eax
push 0xa6
push edi
call esi
test eax, eax
jne 0x4015a6
mov word [ebp - 0x404], ax
push 0x10
lea eax, [ebp - 0x204]
push eax
lea eax, [ebp - 0x404]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
pop ebx
pop edi
mov eax, 0x68
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00402264
mov esp, ebp
pop ebp
ret
mov ebx, eax
xor edx, edx
mov ecx, 0x811c9dc5
test ebx, ebx
jle 0x4014bc
mov edi, dword [ebp - 0xc14]
nop dword [eax + eax]
movzx eax, byte [edx + edi]
inc edx
xor eax, ecx
imul ecx, eax, 0x1000193
cmp edx, ebx
jl 0x4015f0
mov edi, dword [ebp - 0xc34]
jmp 0x4014bc
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push dword [ebp - 0xc1c]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ecx, eax
mov dword [ebp - 0xc08], ecx
cmp ecx, 0xffffffff
jne 0x4016d1
mov esi, dword [sym.imp.USER32.dll_LoadStringW]
lea eax, [ebp - 0x204]
push 0x100
push eax
push 0x64
push edi
call esi
test eax, eax
jne 0x40165d
mov word [ebp - 0x204], ax
push 0x100
lea eax, [ebp - 0x404]
push eax
push 0xa7
push edi
call esi
test eax, eax
jne 0x40167c
mov word [ebp - 0x404], ax
push dword [ebp - 0xc1c]
lea eax, [ebp - 0x404]
push eax
lea eax, [ebp - 0xc04]
push 0x400
push eax
call fcn.004020f0
add esp, 0x10
cmp byte [ebp + 0xc], 0
jne 0x4016bb
push 0x10
lea eax, [ebp - 0x204]
push eax
lea eax, [ebp - 0xc04]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
pop ebx
pop edi
mov eax, 0x6b
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00402264
mov esp, ebp
pop ebp
ret
cmp byte [ebp + 8], 0
je 0x40175a
xor ebx, ebx
xor edi, edi
cmp dword [ebp - 0xc0c], ebx
jle 0x401742
mov esi, dword [ebp - 0xc20]
add esi, 8
mov eax, dword [esi - 4]
cmp edi, eax
jge 0x401711
mov edx, dword [ebp - 0xc10]
sub eax, edi
push eax
lea edx, [ebx + edx]
call fcn.00401170
mov ecx, dword [ebp - 0xc08]
add esp, 4
mov edx, dword [esi - 8]
push dword [esi]
add edx, dword [ebp - 0xc14]
call fcn.00401170
mov eax, dword [esi - 4]
add esp, 4
mov ecx, dword [ebp - 0xc08]
sub eax, edi
mov edi, dword [esi]
add ebx, eax
add edi, dword [esi - 4]
add esi, 0xc
sub dword [ebp - 0xc0c], 1
jne 0x4016f0
mov eax, dword [ebp - 0xc24]
cmp ebx, eax
jge 0x401769
mov edx, dword [ebp - 0xc10]
sub eax, ebx
push eax
lea edx, [ebx + edx]
jmp 0x401761
mov edx, dword [ebp - 0xc14]
push ebx
call fcn.00401170
add esp, 4
push dword [ebp - 0xc08]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00402264
mov esp, ebp
pop ebp
ret
cmp byte [ebp + 0xc], 0
jne 0x4017e7
mov esi, dword [sym.imp.USER32.dll_LoadStringW]
lea eax, [ebp - 0x404]
push 0x100
push eax
push 0x64
push edi
call esi
test eax, eax
jne 0x4017b0
mov word [ebp - 0x404], ax
push 0x100
lea eax, [ebp - 0x204]
push eax
push 0xa6
push edi
call esi
test eax, eax
jne 0x4017cf
mov word [ebp - 0x204], ax
push 0x10
lea eax, [ebp - 0x404]
push eax
lea eax, [ebp - 0x204]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
pop ebx
pop edi
mov eax, 0x68
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00402264
mov esp, ebp
pop ebp
ret
cmp byte [ebp + 0xc], 0
jne 0x40185c
mov esi, dword [sym.imp.USER32.dll_LoadStringW]
lea eax, [ebp - 0x404]
push 0x100
push eax
push 0x64
push edi
call esi
test eax, eax
jne 0x401825
mov word [ebp - 0x404], ax
push 0x100
lea eax, [ebp - 0x204]
push eax
push 0xa6
push edi
call esi
test eax, eax
jne 0x401844
mov word [ebp - 0x204], ax
push 0x10
lea eax, [ebp - 0x404]
push eax
lea eax, [ebp - 0x204]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, dword [ebp - 4]
mov eax, 0x67
pop edi
xor ecx, ebp
pop esi
call fcn.00402264
mov esp, ebp
pop ebp
ret