Function at 0x1000cce0
Capabilities:
Encode data using xor
Get file size
Read file on windows

Disassembly:
mov eax, 0x25868
call fcn.100d4920
mov eax, dword [0x10139d00]
xor eax, esp
mov dword [esp + 0x25864], eax
mov eax, dword [esp + 0x2586c]
push ebx
push ebp
push esi
xor ebp, ebp
push edi
mov edi, ecx
mov byte [esp + 0x17], 0
cmp eax, ebp
je 0x1000d088
cmp edi, ebp
je 0x1000d088
mov esi, dword [sym.imp.KERNEL32.dll_CreateFileW]
push ebp
push 0x80
push 3
push ebp
push 1
push SysReAllocString
push eax
call esi
mov ebx, eax
mov dword [esp + 0x24], ebx
cmp ebx, 0xffffffff
je 0x1000d082
lea eax, [esp + 0x38]
push eax
mov dword [esp + 0x3c], ebp
mov dword [esp + 0x40], ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
push ebx
call ebp
cmp dword [esp + 0x3c], 0
jl 0x1000d07b
jg 0x1000cd72
cmp dword [esp + 0x38], 0x53
jbe 0x1000d07b
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
push edi
call esi
mov ebx, eax
mov dword [esp + 0x34], ebx
cmp ebx, 0xffffffff
je 0x1000d077
lea ecx, [esp + 0x28]
push ecx
xor edi, edi
push ebx
mov dword [esp + 0x30], edi
mov dword [esp + 0x34], edi
call ebp
mov edx, dword [esp + 0x2c]
cmp edx, edi
jl 0x1000d070
mov ecx, dword [esp + 0x28]
lea ebp, [edi + 5]
jg 0x1000cdc5
cmp ecx, ebp
jbe 0x1000d070
mov eax, dword [esp + 0x38]
sub eax, ecx
mov ecx, dword [esp + 0x3c]
sbb ecx, edx
cmp eax, 0x4e
jne 0x1000d070
cmp ecx, edi
jne 0x1000d070
mov ecx, dword [esp + 0x24]
mov esi, dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
lea edx, [esp + 0x1c]
push edx
push ebp
lea eax, [esp + 0x25878]
push eax
push ecx
mov byte [esp + 0x25880], 0
mov dword [esp + 0x25881], edi
mov byte [esp + 0x25878], 0
mov dword [esp + 0x25879], edi
mov dword [esp + 0x2c], edi
call esi
test eax, eax
je 0x1000d070
cmp dword [esp + 0x18], ebp
jne 0x1000d070
push edi
lea edx, [esp + 0x1c]
push edx
push ebp
lea eax, [esp + 0x25870]
push eax
push ebx
call esi
test eax, eax
je 0x1000d070
cmp dword [esp + 0x18], ebp
jne 0x1000d070
mov ecx, dword [esp + 0x2586c]
cmp ecx, dword [esp + 0x25864]
jne 0x1000d070
mov dl, byte [esp + 0x25868]
cmp dl, byte [esp + 0x25870]
jne 0x1000d070
lea esi, [esp + 0x40]
mov byte [esp + 0x16], 0
call fcn.1000d120
mov ecx, dword [eax]
mov edx, dword [eax + 4]
lea esi, [esp + 0x40]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], edx
call fcn.1000d150
mov esi, eax
lea edi, [esp + 0x1c]
call fcn.1000d370
test al, al
je 0x1000cef9
lea esi, [esp + 0x1c]
call fcn.1000d300
mov ecx, dword [esp + 0x25864]
cmp ecx, dword [eax]
jne 0x1000ced4
mov dl, byte [eax + 4]
add eax, 4
cmp dl, byte [esp + 0x25868]
je 0x1000cf1e
lea edi, [esp + 0x48]
lea esi, [esp + 0x1c]
call fcn.1000d330
lea esi, [esp + 0x40]
call fcn.1000d150
mov esi, eax
lea edi, [esp + 0x1c]
call fcn.1000d370
test al, al
jne 0x1000ceb1
mov ecx, dword [esp + 0x2c]
mov esi, dword [esp + 0x28]
mov eax, esi
sub eax, ebp
sbb ecx, 0
mov dword [esp + 0x4c], ecx
js 0x1000cf64
jg 0x1000cf17
cmp eax, 0x25805
jbe 0x1000cf64
mov esi, 0x25805
jmp 0x1000cf67
lea esi, [esp + 0x1c]
mov byte [esp + 0x16], 1
call fcn.1000d300
cmp dword [eax + 0x2580c], 0x25805
jae 0x1000d070
call fcn.1000d300
mov eax, dword [eax + 0x2580c]
mov ecx, dword [esp + 0x2c]
xor edx, edx
add eax, ebp
cmp edx, ecx
jg 0x1000d070
jl 0x1000cefd
cmp eax, dword [esp + 0x28]
jb 0x1000cefd
jmp 0x1000d070
add esi, 0xfffffffb
mov edi, dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push esi
push 0x40
call edi
mov ebp, eax
test ebp, ebp
je 0x1000d070
mov ecx, dword [esp + 0x24]
push 0
lea eax, [esp + 0x1c]
push eax
push esi
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1000d069
cmp dword [esp + 0x18], esi
jne 0x1000d069
push esi
push 0x40
call edi
mov ebx, eax
test ebx, ebx
je 0x1000d065
mov eax, dword [esp + 0x34]
push 0
lea edx, [esp + 0x1c]
push edx
push esi
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1000d05e
cmp dword [esp + 0x18], esi
jne 0x1000d05e
push 0x2580b
lea ecx, [esp + 0x59]
push 0
push ecx
mov dword [esp + 0x5d], 0
call fcn.100d4cc0
mov edx, dword [esp + 0x25870]
mov al, byte [esp + 0x25874]
add esp, 0xc
mov dword [esp + 0x2585c], esi
mov dword [esp + 0x50], edx
mov byte [esp + 0x54], al
test esi, esi
jbe 0x1000d02f
mov ecx, ebx
lea edi, [esp + 0x55]
sub ecx, ebp
mov eax, ebp
sub edi, ebp
mov dl, byte [ecx + eax]
xor dl, byte [eax]
inc eax
sub esi, 1
mov byte [edi + eax - 1], dl
jne 0x1000d020
cmp byte [esp + 0x16], 0
je 0x1000d049
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
push eax
push ecx
lea esi, [esp + 0x50]
call fcn.1000d230
lea eax, [esp + 0x50]
call fcn.1000d180
mov byte [0x101e06ac], 1
mov byte [esp + 0x17], 1
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov ebx, dword [esp + 0x34]
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [esp + 0x24]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, byte [esp + 0x17]
jmp 0x1000d08a
xor al, al
mov ecx, dword [esp + 0x25874]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.100d0738
add esp, 0x25868
ret 4