Function at 0x40fee0
Capabilities:
Encode data using xor
Get file size
Read file via mapping

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x13c
test eax, eax
je 0x410249
cmp dword [esp + 0x144], 0xd0
jb 0x410249
mov dword [esp + 0x10], 0
call fcn.0040fd20
mov byte [esp + 3], al
mov eax, dword [esp + 0x14c]
push eax
lea ecx, [esp + 0x3c]
push 0x104
push ecx
call fcn.0040fdb0
add esp, 0xc
test eax, eax
je 0x410249
push ebx
push esi
mov esi, dword [esp + 0x150]
push 0
push 0x80
push 3
test esi, esi
push 0
je 0x40ff68
push 1
lea edx, [esp + 0x54]
push bind
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
mov dword [esp + 0xc], ebx
jmp 0x40ff80
push 0
lea eax, [esp + 0x54]
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [esp + 0xc], eax
mov ebx, eax
cmp ebx, 0xffffffff
je 0x41023c
push ebp
push edi
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0x2100
jb 0x410233
push 0
push 0
test esi, esi
push 0
je 0x40ffbf
push 2
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov ebp, eax
mov dword [esp + 0x18], ebp
jmp 0x40ffd0
push 4
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [esp + 0x18], eax
mov ebp, eax
test ebp, ebp
je 0x410233
push 0
push 0
test esi, esi
push 0
je 0x40fff3
push 4
push ebp
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
mov dword [esp + 0x1c], esi
jmp 0x410002
push 6
push ebp
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esp + 0x1c], eax
mov esi, eax
test esi, esi
je 0x41022c
mov eax, dword [esi + 0x3c]
lea ecx, [eax + 0x18]
cmp ecx, edi
jae 0x410225
lea eax, [eax + esi + 4]
xor edx, edx
lea ecx, [esi + edi]
mov dx, word [eax + 0x10]
lea eax, [edx + eax + 0x14]
cmp ecx, eax
jbe 0x410225
mov ecx, dword [eax + 0x10]
cmp ecx, edi
ja 0x410225
cmp ecx, 0x2100
jb 0x410225
mov edx, dword [eax + 0x14]
mov ecx, dword [esp + 0x158]
xor eax, eax
cmp ecx, eax
lea ebx, [edx + esi + 0x100]
je 0x410147
xor ecx, ecx
xor esi, esi
xor edx, edx
mov dl, byte [eax + 0x4182bc]
add ecx, edx
inc eax
cmp eax, 8
mov dl, byte [ecx + ebx]
mov byte [esp + esi + 0x28], dl
jb 0x410080
xor eax, eax
inc esi
cmp esi, 0x20
jb 0x410067
mov edx, dword [esp + 0x28]
test edx, edx
jne 0x410219
mov edx, dword [esp + 0x2c]
test edx, edx
jne 0x410219
mov edx, dword [esp + 0x30]
test edx, edx
jne 0x410219
mov edx, dword [esp + 0x34]
test edx, edx
jne 0x410219
cmp dword [esp + 0x44], 0xd0
jne 0x410219
mov edi, dword [esp + 0x150]
xor esi, esi
xor edx, edx
mov dl, byte [eax + 0x4182bc]
add ecx, edx
inc eax
cmp eax, 8
mov dl, byte [ecx + ebx]
mov byte [esi + edi], dl
jb 0x4100e5
xor eax, eax
inc esi
cmp esi, 0xd0
jb 0x4100cd
lea eax, [esp + 0x24]
or esi, 0xffffffff
push eax
push edi
push 0xd0
push esi
mov dword [esp + 0x34], esi
call fcn.00410b90
mov ecx, dword [esp + 0x34]
mov eax, dword [esp + 0x48]
add esp, 0x10
cmp ecx, eax
jne 0x410219
mov edx, dword [esp + 0x44]
lea ecx, [edx - 1]
test ecx, ecx
jbe 0x410138
lea eax, [ecx + edi]
mov dl, byte [esi + eax]
mov bl, byte [eax]
xor dl, bl
xor dl, cl
dec ecx
mov byte [eax], dl
dec eax
test ecx, ecx
ja 0x410127
mov al, byte [esp + 0x13]
mov cl, byte [edi]
xor cl, al
mov byte [edi], cl
jmp 0x410211
xor ecx, ecx
push 0xd0
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x48], 0xd0
mov dword [esp + 0x30], ecx
mov dword [esp + 0x40], eax
mov dword [esp + 0x34], ecx
mov dword [esp + 0x44], eax
mov dword [esp + 0x38], ecx
call fcn.00407ec5
mov edi, eax
add esp, 4
test edi, edi
je 0x410221
mov eax, dword [esp + 0x44]
xor ecx, ecx
test eax, eax
jbe 0x4101b0
mov ebp, dword [esp + 0x150]
sub ebp, edi
mov dl, byte [esp + 0x13]
lea esi, [ecx + edi]
mov al, byte [esi + ebp]
xor al, cl
xor al, dl
inc ecx
mov byte [esi], al
mov byte [esp + 0x13], al
mov eax, dword [esp + 0x44]
cmp ecx, eax
jb 0x410193
lea edx, [esp + 0x38]
mov dword [esp + 0x38], 0xffffffff
push edx
push edi
push eax
push 0xffffffffffffffff
call fcn.00410b90
add esp, 0x10
xor ecx, ecx
xor eax, eax
xor esi, esi
xor edx, edx
mov dl, byte [eax + 0x4182bc]
add ecx, edx
mov dl, byte [esp + esi + 0x28]
inc eax
cmp eax, 8
mov byte [ecx + ebx], dl
jb 0x4101e8
xor eax, eax
inc esi
cmp esi, 0x20
jb 0x4101cf
xor esi, esi
xor edx, edx
mov dl, byte [eax + 0x4182bc]
add ecx, edx
mov dl, byte [esi + edi]
inc eax
cmp eax, 8
mov byte [ecx + ebx], dl
jb 0x410208
xor eax, eax
inc esi
cmp esi, 0xd0
jb 0x4101f0
mov dword [esp + 0x20], 1
mov esi, dword [esp + 0x1c]
mov ebp, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop ebp
mov eax, dword [esp + 0x18]
pop esi
pop ebx
add esp, 0x13c
ret
xor eax, eax
add esp, 0x13c
ret