Function at 0x428520
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
sub esp, 0xc
mov ax, word [0x42e90c]
xor ecx, ecx
mov dword [esp + 2], ecx
mov word [esp], ax
mov dword [esp + 6], ecx
xor eax, eax
mov word [esp + 0xa], cx
mov ecx, dword [esp + 0x18]
test ecx, 0x80000000
je 0x428550
mov eax, 1
push ebx
mov ebx, dword [esp + 0x14]
push ebp
push esi
push edi
push 0
push 0x80
push 3
push 0
push eax
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x428587
pop edi
pop esi
pop ebp
mov dword [0x73f54c], 2
or eax, eax
pop ebx
add esp, 0xc
ret
xor edi, edi
mov esi, 0x73f554
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x4285ab
add esi, 0x104
inc edi
cmp esi, 0x73f964
jl 0x42858e
jmp 0x4285bd
lea esi, [edi + edi*4]
shl esi, 0x10
add esi, 0x5af54c
jne 0x42872e
mov eax, dword [0x73f550]
push ebx
mov edx, eax
shl edx, 6
add edx, eax
lea eax, [edx*4 + 0x73f554]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
lea ecx, [esp + 0x28]
push 0
push ecx
lea edx, [esp + 0x18]
push 0xc
push edx
push ebp
call edi
test eax, eax
jne 0x42860f
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
mov dword [0x73f54c], 4
or eax, 0xffffffff
pop ebx
add esp, 0xc
ret
push 8
lea eax, [esp + 0x14]
push str.WARC_1.2
push eax
call fcn.004259f0
add esp, 0xc
test eax, eax
je 0x428639
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0xc
ret
mov esi, dword [esp + 0x18]
push 0
xor esi, 0xf182ad82
push 0
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x428670
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
mov dword [0x73f54c], 4
or eax, 0xffffffff
pop ebx
add esp, 0xc
ret
lea ecx, [esp + 0x28]
push 0
push ecx
push 0x50000
push 0x6ef54c
push ebp
call edi
test eax, eax
jne 0x4286a4
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
mov dword [0x73f54c], 4
or eax, 0xffffffff
pop ebx
add esp, 0xc
ret
push 0x50000
push 0x6ef54c
call fcn.00428f90
add esp, 8
mov eax, 0x6ef54c
mov edi, dword [eax]
add eax, 4
xor edi, esi
cmp eax, 0x73f54c
mov dword [eax - 4], edi
jb 0x4286bb
mov eax, dword [0x73f550]
mov edx, dword [esp + 0x28]
push edx
push 0x6ef54c
lea eax, [eax + eax*4]
shl eax, 0x10
add eax, 0x5af54c
push eax
call fcn.00429870
mov ecx, eax
mov eax, 0xcccccccd
mul ecx
mov eax, dword [0x73f550]
add esp, 0xc
shr edx, 5
lea esi, [eax + eax*4]
mov dword [eax*4 + 0x5af53c], edx
shl esi, 0x10
add esi, 0x5af54c
mov edi, eax
inc eax
mov dword [esp + 0x28], ecx
cmp eax, 4
mov dword [0x73f550], eax
jb 0x42872e
mov dword [0x73f550], 0
mov eax, dword [edi*4 + 0x5af53c]
xor ebx, ebx
test eax, eax
jle 0x428760
mov ecx, dword [esp + 0x24]
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x42875c
mov eax, dword [edi*4 + 0x5af53c]
add esi, 0x28
inc ebx
cmp ebx, eax
jl 0x42873b
jmp 0x428760
test esi, esi
jne 0x42877c
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
mov dword [0x73f54c], 4
or eax, 0xffffffff
pop ebx
add esp, 0xc
ret
mov ecx, dword [esp + 0x34]
mov eax, dword [esi + 0x10]
mov edx, dword [esi + 0x14]
test ecx, ecx
je 0x42878c
mov dword [ecx], esi
mov ecx, dword [esp + 0x2c]
test ecx, ecx
je 0x428796
mov dword [ecx], eax
mov ecx, dword [esp + 0x30]
test ecx, ecx
je 0x4287a0
mov dword [ecx], edx
push 0
push 0
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x4287cd
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
mov dword [0x73f54c], 4
or eax, 0xffffffff
pop ebx
add esp, 0xc
ret
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0xc
ret