Function at 0x404920
Capabilities:
Encode data using xor
Read file on windows
Resolve function by parsing pe exports
Write file on windows

Disassembly:
sub esp, 0x188
push ebx
push ebp
push esi
push edi
mov ecx, 7
xor eax, eax
lea edi, [esp + 0x51]
mov byte [esp + 0x50], 0
rep stosd dword es:[edi], eax
mov ecx, 0x3f
lea edi, [esp + 0x99]
mov byte [esp + 0x98], al
mov ebx, dword [sym.imp.KERNEL32.dll_CreateFileA]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov dword [esp + 0x18], 0xa0
mov dword [esp + 0x25], eax
mov byte [esp + 0x24], 0
mov dword [esp + 0x29], eax
mov dword [esp + 0x2d], eax
push eax
push 0x80
push 3
push eax
push 1
push SysReAllocString
push str.password.ini
mov dword [esp + 0x4d], eax
call ebx
mov esi, eax
cmp esi, 0xffffffff
je 0x4049b7
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
lea ecx, [esp + 0x10]
push 0
push ecx
lea edx, [esp + 0x2c]
push 0x10
push edx
push esi
call edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4049bd
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x19c]
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
push eax
call ebx
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4049ef
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x188
ret 0xc
xor esi, esi
lea ebp, [esp + 0x84]
mov dword [esp + 0x1c], esi
mov dword [esp + 0x14], ebp
jmp 0x404a10
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
mov esi, dword [esp + 0x1c]
mov ebp, dword [esp + 0x14]
push 0
push 0
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea ecx, [esp + 0x10]
push 0
push ecx
lea edx, [esp + 0x58]
push 0x1c
push edx
push ebx
call edi
test eax, eax
je 0x404c36
lea eax, [esp + 0x10]
push 0
push eax
push 4
push ebp
push ebx
call edi
test eax, eax
je 0x404c17
test esi, esi
jbe 0x404a53
mov eax, dword [ebp - 4]
jmp 0x404a55
xor eax, eax
mov ecx, dword [esp + 0x18]
mov esi, str.nllfile
add ecx, eax
lea eax, [esp + 0x50]
mov dword [esp + 0x18], ecx
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x404a8c
test cl, cl
je 0x404a88
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x404a8c
add eax, 2
add esi, 2
test cl, cl
jne 0x404a68
xor eax, eax
jmp 0x404a91
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x404bdd
mov edi, dword [esp + 0x1a4]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x98]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x98]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
mov edi, 0x438290
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x80
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
lea edx, [esp + 0xa0]
and ecx, 3
push 2
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x5c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push eax
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
push 2
and ecx, 3
lea eax, [esp + 0xac]
push 0x40000000
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
mov dword [esp + 0x20], edi
je 0x404c36
mov ecx, dword [esp + 0x18]
push 0
push 0
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
xor ebp, ebp
lea edx, [esp + 0x10]
push 0
push edx
lea eax, [esp + 0x44]
push 0x10
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x404c4c
mov esi, dword [esp + 0x10]
xor eax, eax
test esi, esi
jbe 0x404bac
mov edi, dword [esp + 0x1a0]
lea ecx, [esp + 0x3c]
sub edi, ecx
lea ecx, [esp + eax + 0x3c]
mov dl, byte [edi + ecx]
xor dl, byte [ecx]
inc eax
cmp eax, esi
mov byte [esp + eax + 0x6f], dl
jb 0x404b96
mov edi, dword [esp + 0x20]
lea eax, [esp + 0x38]
push 0
push eax
lea ecx, [esp + 0x78]
push esi
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x404c4c
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
add ebp, ecx
cmp ebp, dword [edx]
jb 0x404b62
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x14]
add eax, 0x20
add edx, 4
cmp eax, 0xa0
mov dword [esp + 0x1c], eax
mov dword [esp + 0x14], edx
jb 0x404a02
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x188
ret 0xc
mov eax, dword [esp + 0x20]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call esi
push ebx
call esi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x188
ret 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x188
ret 0xc
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call esi
push ebx
call esi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x188
ret 0xc