Function at 0x70259da0
Capabilities:
Check if file exists

Disassembly:
push ebx
push ebp
push esi
push edi
mov esi, eax
call fcn.70259bd0
mov eax, dword [esi + 8]
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
lea ebx, [esi + 8]
cmp eax, 2
jne 0x70259df7
call fcn.70202720
cmp byte [0x7034d62b], 0
je 0x70259df7
mov eax, dword [esi + 0x10]
lea ebp, [esi + 0x10]
call fcn.702b4730
test eax, eax
je 0x70259df0
mov edi, dword [esp + 0x14]
mov eax, ebp
call fcn.70208e30
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
ret 4
push 1
push 3
push ebx
call edi
mov ecx, dword [esi + 0xc]
lea ebx, [esi + 0xc]
cmp ecx, 2
jne 0x70259e31
mov eax, dword [esi + 0x14]
add esi, 0x14
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x70259e2a
mov edi, dword [esp + 0x14]
mov eax, esi
call fcn.70208e30
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
ret 4
push 1
push 3
push ebx
call edi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 4

Function at 0x70259fc0
Capabilities:
Get file size
Read file on windows

Disassembly:
sub esp, 8
push esi
push 0
push 0
push 3
push 0
push 1
push SysReAllocStringLen
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x70259fe8
xor eax, eax
pop esi
add esp, 8
ret
push ebx
push edi
lea ecx, [esp + 0xc]
push ecx
push esi
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp dword [esp + 0xc], 0
mov edi, eax
mov dword [esp + 0x10], 0
ja 0x7025a05f
cmp edi, 0x1000000
jae 0x7025a05f
push edi
call fcn.702e20da
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x7025a05f
push 0
lea edx, [esp + 0x14]
push edx
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x7025a056
cmp dword [esp + 0x10], edi
jne 0x7025a056
mov eax, dword [esp + 0x18]
push esi
mov dword [eax], edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, ebx
pop ebx
pop esi
add esp, 8
ret
push ebx
call fcn.702e1dee
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop ebx
xor eax, eax
pop esi
add esp, 8
ret

Function at 0x7025a380
Capabilities:
Encode data using xor

Disassembly:
push 0
push 1
push 0x7036ee30
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, 1
je 0x7025a42e
push ebx
push esi
push edi
mov esi, 0x703532dc
mov ebx, 9
lea ecx, [esi - 0x20]
mov eax, ecx
lea edi, [eax + 1]
lea ecx, [ecx]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x7025a3b0
sub eax, edi
mov edx, eax
lea eax, [esi - 0x20]
test eax, eax
je 0x7025a3d1
xor eax, eax
test edx, edx
jbe 0x7025a3d1
xor byte [eax + ecx], 6
inc eax
cmp eax, edx
jb 0x7025a3c8
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x7025a3d6
sub eax, edx
mov ecx, eax
test esi, esi
je 0x7025a3f9
xor eax, eax
test ecx, ecx
jbe 0x7025a3f9
jmp 0x7025a3f0
xor byte [esi + eax], 6
inc eax
cmp eax, ecx
jb 0x7025a3f0
lea ecx, [esi + 0x20]
mov eax, ecx
lea edi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x7025a401
sub eax, edi
mov edx, eax
test ecx, ecx
je 0x7025a41f
xor eax, eax
test edx, edx
jbe 0x7025a41f
xor byte [eax + ecx], 6
inc eax
cmp eax, edx
jb 0x7025a416
add esi, 0x6c
sub ebx, 1
jne 0x7025a3a5
pop edi
pop esi
pop ebx
ret