Function at 0x1000242cc
Capabilities:
Encode data using xor
Get file size
Read file via mapping

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov rdi, rdx
mov rbp, rcx
xor r13d, r13d
mov dword [rax + 0x18], r13d
mov ebx, r13d
mov r12d, r13d
lea rcx, [0x100081100]
mov rax, qword [0x100081100]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp], rax
mov dword [rsp + 0xb0], 1
mov rcx, rbp
call fcn.10001e65c
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [r13 + 1]
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
mov qword [rsp + 0x40], rax
cmp rax, 0xffffffffffffffff
je 0x100024713
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp eax, 0xffffffff
je 0x10002470a
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor edx, edx
lea r8d, [r13 + 2]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov qword [rsp + 0x48], rax
cmp rax, r13
je 0x10002470a
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
lea edx, [r13 + 4]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov r14, rax
xor r9d, r9d
cmp rax, r9
je 0x1000246ff
mov r15, rax
movzx r13d, word [rax]
mov ecx, r13d
mov eax, 0xfffe
mov edx, 0xfeff
cmp r13d, 0xbbef
je 0x100024408
cmp ecx, edx
je 0x1000243fd
cmp ecx, eax
jne 0x100024426
mov ebx, esi
shr ebx, 1
dec ebx
jmp 0x1000244c5
mov ebx, esi
shr ebx, 1
dec ebx
jmp 0x1000244c5
cmp esi, 2
jbe 0x100024426
cmp byte [r14 + 2], 0xbf
jne 0x100024426
mov r12d, 0xfde9
lea r15, [r14 + 3]
add esi, 0xfffffffd
jmp 0x100024595
or dword [rsp + 0xb8], 0xffffffff
lea r8, [rsp + 0xb8]
mov edx, esi
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_IsTextUnicode]
mov r11d, eax
xor r9d, r9d
cmp eax, r9d
je 0x100024452
mov ebx, esi
shr ebx, 1
jmp 0x1000244bc
mov r8d, 1
mov eax, r9d
mov edx, r9d
cmp esi, r9d
jle 0x1000244b9
mov rdi, r14
mov r10b, 0x80
or r12d, 0xffffffff
mov cl, byte [rdi]
test r10b, cl
cmovne r8d, r9d
cmp eax, r9d
jne 0x100024490
cmp cl, r10b
jb 0x10002449b
add cl, cl
inc eax
test r10b, cl
jne 0x100024480
add eax, r12d
je 0x1000244b9
jmp 0x10002449b
and cl, 0xc0
cmp cl, r10b
jne 0x1000244b9
add eax, r12d
inc edx
inc rdi
cmp edx, esi
jl 0x10002446d
cmp eax, r9d
ja 0x1000244b9
cmp r8d, r9d
jne 0x1000244b9
mov r12d, 0xfde9
jmp 0x100024595
mov r12d, r9d
cmp r11d, r9d
je 0x100024595
lea esi, [rbx + 1]
mov rax, qword [rbp]
mov ecx, 1
sub ecx, dword [rax - 8]
mov eax, dword [rax - 0xc]
sub eax, esi
or eax, ecx
jge 0x1000244e7
mov edx, esi
mov rcx, rbp
call fcn.10001edf8
mov rdi, qword [rbp]
xor r12d, r12d
cmp esi, r12d
jl 0x10002458a
cmp esi, dword [rdi - 0xc]
jg 0x10002458a
mov dword [rdi - 0x10], esi
movsxd rcx, esi
mov rax, qword [rbp]
mov word [rax + rcx*2], r12w
mov eax, 0xfeff
cmp r13w, ax
jne 0x100024531
mov r8d, ebx
add r8, r8
lea rdx, [r14 + 2]
mov rcx, rdi
call sub.msvcrt.dll_memcpy
jmp 0x100024672
mov eax, 0xfffe
cmp r13w, ax
jne 0x100024574
lea rdx, [r14 + 2]
cmp ebx, r12d
jbe 0x100024672
mov r8, rdi
sub r8, rdx
mov r9d, ebx
movzx ecx, byte [rdx + 1]
movzx eax, word [rdx]
shl ax, 8
xor cx, ax
mov word [r8 + rdx], cx
add rdx, 2
sub r9, 1
jne 0x100024552
jmp 0x100024672
mov r8d, ebx
add r8, r8
mov rdx, r14
mov rcx, rdi
call sub.msvcrt.dll_memcpy
jmp 0x100024672
mov ecx, 0x80070057
call fcn.10001f28c
int3
mov dword [rsp + 0x28], r9d
mov qword [rsp + 0x20], r9
mov r9d, esi
mov r8, r15
xor edx, edx
mov ecx, r12d
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ebx, eax
test eax, eax
je 0x1000246f1
lea r13d, [rax + 1]
mov rcx, qword [rbp]
mov edx, 1
sub edx, dword [rcx - 8]
mov ecx, dword [rcx - 0xc]
sub ecx, r13d
or ecx, edx
jge 0x1000245df
mov edx, r13d
mov rcx, rbp
call fcn.10001edf8
mov rdi, qword [rbp]
xor ecx, ecx
cmp r13d, ecx
jl 0x1000246e6
cmp r13d, dword [rdi - 0xc]
jg 0x1000246e6
mov dword [rdi - 0x10], r13d
movsxd rdx, r13d
mov rax, qword [rbp]
mov word [rax + rdx*2], cx
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rdi
mov r9d, esi
mov r8, r15
xor edx, edx
mov ecx, r12d
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xor r12d, r12d
cmp eax, r12d
jne 0x100024672
mov rdx, qword [rbp]
cmp rdx, r12
jne 0x100024637
mov ecx, r12d
jmp 0x10002464e
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
dec rcx
cmp ecx, r12d
jl 0x100024667
cmp ecx, dword [rdx - 0xc]
jg 0x100024667
mov dword [rdx - 0x10], ecx
movsxd rcx, ecx
mov rax, qword [rbp]
mov word [rax + rcx*2], r12w
jmp 0x1000246f1
mov ecx, 0x80070057
call fcn.10001f28c
int3
cmp rdi, r12
je 0x1000246f1
mov rax, rdi
cmp ebx, r12d
jbe 0x100024699
mov ecx, ebx
cmp word [rax], r12w
jne 0x10002468f
mov edx, 0x20
mov word [rax], dx
add rax, 2
sub rcx, 1
jne 0x100024681
mov eax, ebx
mov word [rdi + rax*2], r12w
mov rdx, qword [rbp]
cmp rdx, r12
jne 0x1000246ae
mov ecx, r12d
jmp 0x1000246c5
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
dec rcx
cmp ecx, r12d
jl 0x1000246db
cmp ecx, dword [rdx - 0xc]
jg 0x1000246db
mov dword [rdx - 0x10], ecx
movsxd rcx, ecx
mov rax, qword [rbp]
mov word [rax + rcx*2], r12w
jmp 0x1000246f1
mov ecx, 0x80070057
call fcn.10001f28c
int3
mov ecx, 0x80070057
call fcn.10001f28c
int3
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rdi, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, rbp
mov rbx, qword [rsp + 0xa8]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret