Function at 0x40b160
Capabilities:
Write file on windows

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d6554
mov eax, dword fs:[0]
push eax
push ecx
push ebx
sub esp, 0x1d8
mov eax, dword [0x51f164]
xor eax, ebp
mov dword [ebp - 0x1c], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, edx
mov dword [ebp - 0x148], ecx
mov eax, dword [ebx + 0xc]
lea ecx, [ebp - 0x68]
mov esi, dword [ebx + 8]
mov dword [ebp - 4], 0
push 5
push str.wenf
mov dword [ebp - 0x144], eax
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x54], 0xf
mov byte [ebp - 0x68], 0
call fcn.00431f60
mov edx, dword [ebx + 0x10]
mov byte [ebp - 4], 1
test edx, edx
je 0x40b379
lea ecx, [ebp - 0x98]
call fcn.004022c0
lea eax, [ebp - 0x98]
mov byte [ebp - 4], 2
push eax
mov edx, 0x4fbf10
lea ecx, [ebp - 0x184]
call fcn.004396d0
add esp, 4
push 0x4fbf0c
mov ecx, eax
mov byte [ebp - 4], 3
call fcn.004320a0
mov edx, dword [ebp - 0x54]
movq xmm1, qword [eax + 0x10]
movq qword [ebp - 0x168], xmm1
movq qword [ebp - 0x1bc], xmm1
movups xmm0, xmmword [eax]
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
movups xmmword [ebp - 0x158], xmm0
movups xmmword [ebp - 0x1cc], xmm0
cmp edx, 0x10
jb 0x40b2a3
mov ecx, dword [ebp - 0x68]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40b28a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40ba5e
push edx
push ecx
call fcn.004913bc
movups xmm0, xmmword [ebp - 0x158]
add esp, 8
movq xmm1, qword [ebp - 0x168]
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x170]
movq qword [ebp - 0x58], xmm1
mov dword [ebp - 0x1bc], 0
mov dword [ebp - 0x1b8], 0xf
mov byte [ebp - 0x1cc], 0
movups xmmword [ebp - 0x68], xmm0
cmp edx, 0x10
jb 0x40b305
mov ecx, dword [ebp - 0x184]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40b2fb
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40ba5e
push edx
push ecx
call fcn.004913bc
add esp, 8
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x84]
mov dword [ebp - 0x174], 0
mov dword [ebp - 0x170], 0xf
mov byte [ebp - 0x184], 0
cmp edx, 0x10
jb 0x40b35e
mov ecx, dword [ebp - 0x98]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40b354
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40ba63
push edx
push ecx
call fcn.004913bc
add esp, 8
mov dword [ebp - 0x88], 0
mov dword [ebp - 0x84], 0xf
mov byte [ebp - 0x98], 0
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 0xf
mov byte [ebp - 0x50], 0
push edi
mov edx, str.d7j3
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x1b4]
call fcn.004396d0
add esp, 4
push str.y9a0
mov ecx, eax
mov byte [ebp - 4], 5
call fcn.004320a0
mov dword [ebp - 0x150], 0
mov dword [ebp - 0x14c], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x160], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x150], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
push esi
lea edx, [ebp - 0x160]
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x19c]
call fcn.00439eb0
add esp, 4
push str.m5ha
mov ecx, eax
mov byte [ebp - 4], 7
call fcn.004320a0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x38], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x28], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov byte [ebp - 4], 9
mov edx, dword [ebp - 0x188]
cmp edx, 0x10
jb 0x40b486
mov ecx, dword [ebp - 0x19c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40b47c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40ba68
push edx
push ecx
call fcn.004913bc
add esp, 8
mov dword [ebp - 0x18c], 0
mov dword [ebp - 0x188], 0xf
mov byte [ebp - 0x19c], 0
mov byte [ebp - 4], 0xa
mov edx, dword [ebp - 0x14c]
cmp edx, 0x10
jb 0x40b4df
mov ecx, dword [ebp - 0x160]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40b4d5
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40ba68
push edx
push ecx
call fcn.004913bc
add esp, 8
mov dword [ebp - 0x150], 0
mov dword [ebp - 0x14c], 0xf
mov byte [ebp - 0x160], 0
mov byte [ebp - 4], 0xb
mov edx, dword [ebp - 0x1a0]
cmp edx, 0x10
jb 0x40b538
mov ecx, dword [ebp - 0x1b4]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40b52e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40ba68
push edx
push ecx
call fcn.004913bc
add esp, 8
push 0x4c
lea eax, [ebp - 0x138]
mov dword [ebp - 0x1a4], 0
push 0
push eax
mov dword [ebp - 0x1a0], 0xf
mov byte [ebp - 0x1b4], 0
call fcn.004a9100
mov eax, dword [0x51fbe0]
lea ecx, [ebp - 0x138]
add esp, 0xc
mov eax, dword [eax + 4]
add eax, 0x51fbe0
push eax
call fcn.004301c0
push 0x38
lea eax, [ebp - 0xe8]
mov byte [ebp - 4], 0xc
push 0
push eax
call fcn.004a9100
add esp, 0xc
push 0x4c
call fcn.0049101a
add esp, 4
mov dword [ebp - 0x140], eax
mov dword [ebp - 0x16c], eax
push 0x4c
push 0
push eax
mov byte [ebp - 4], 0xd
call fcn.004a9100
add esp, 0xc
push 0x10
call fcn.0049101a
add esp, 4
mov dword [ebp - 0x13c], eax
mov dword [ebp - 0x164], eax
xorps xmm0, xmm0
mov byte [ebp - 4], 0xe
push 0
mov ecx, eax
movups xmmword [eax], xmm0
call fcn.00444ee0
mov eax, dword [ebp - 0x13c]
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 0xd
push dword [section..data]
mov dword [eax + 0xc], ecx
lea ecx, [ebp - 0x138]
mov dword [eax], vtable.CryptoPP::StringSinkTemplate_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___.0
mov dword [eax + 4], vtable.CryptoPP::StringSinkTemplate_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___.1.0
mov eax, dword [ebp - 0x138]
push 0
push dword [ebp - 0x144]
mov eax, dword [eax + 0x1c]
call eax
push dword [ebp - 0x13c]
mov ecx, dword [ebp - 0x140]
push 0
push 0
push eax
call fcn.0044ca40
mov eax, dword [ebp - 0x140]
push eax
push ecx
lea ecx, [ebp - 0xe8]
mov byte [ebp - 4], 0xc
mov dword [eax], vtable.CryptoPP::PK_EncryptorFilter.0
mov dword [eax + 4], vtable.CryptoPP::PK_EncryptorFilter.1.0
lea eax, [ebp - 0x38]
push eax
call fcn.004076c0
mov byte [ebp - 4], 0xf
lea eax, [ebp - 0x38]
mov ecx, 0x18
nop dword [eax]
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x40b670
mov eax, 0x18
mov byte [edi], 0
lea edi, [edi + 1]
sub eax, 1
jne 0x40b680
mov eax, 0x18
mov byte [esi], 0
lea esi, [esi + 1]
sub eax, 1
jne 0x40b690
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x148]
cmp dword [eax + 0x14], 8
jb 0x40b6ac
mov eax, dword [eax]
push 0
push 0x8000000
push 3
push 0
push 0
push 4
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x40b7cf
mov ecx, dword [ebp - 0xdc]
mov dword [ebp - 0xe8], vtable.CryptoPP::SourceTemplate_class_CryptoPP::StringStore_.0
mov dword [ebp - 0xe4], vtable.CryptoPP::SourceTemplate_class_CryptoPP::StringStore_.1.0
test ecx, ecx
je 0x40b6f1
mov eax, dword [ecx]
push 1
call dword [eax]
lea ecx, [ebp - 0x12c]
call fcn.00407d70
mov edx, dword [ebp - 0x24]
mov dword [ebp - 0xf0], vtable.CryptoPP::NameValuePairs.0
cmp edx, 0x10
jb 0x40b73a
mov ecx, dword [ebp - 0x38]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40b730
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40ba7c
push edx
push ecx
call fcn.004913bc
add esp, 8
mov edx, dword [ebp - 0x3c]
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0xf
mov byte [ebp - 0x38], 0
cmp edx, 0x10
jb 0x40b780
mov ecx, dword [ebp - 0x50]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40b776
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40ba7c
push edx
push ecx
call fcn.004913bc
add esp, 8
mov edx, dword [ebp - 0x54]
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 0xf
mov byte [ebp - 0x50], 0
cmp edx, 0x10
jb 0x40ba3e
mov ecx, dword [ebp - 0x68]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40b7c0
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40ba7c
push edx
push ecx
call fcn.004913bc
add esp, 8
jmp 0x40ba3e
push 2
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp byte [0x5200e9], 0
lea eax, [ebp - 0x50]
lea edx, [ebp - 0x68]
push eax
jne 0x40b85f
lea ecx, [ebp - 0xb0]
call fcn.00439d60
add esp, 4
lea ecx, [ebp - 0x20]
cmp dword [ebp - 0x9c], 0x10
lea eax, [ebp - 0xb0]
cmovae eax, dword [ebp - 0xb0]
push 0
push ecx
push dword [ebp - 0xa0]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [ebp - 0x9c]
cmp edx, 0x10
jb 0x40b929
mov ecx, dword [ebp - 0xb0]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40b91f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40ba6d
jmp 0x40b91f
lea ecx, [ebp - 0x1e4]
call fcn.00439d60
add esp, 4
push str.4r3d
mov ecx, eax
mov byte [ebp - 4], 0x10
call fcn.004320a0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x80], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x70], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov edx, dword [ebp - 0x1d0]
cmp edx, 0x10
jb 0x40b8d9
mov ecx, dword [ebp - 0x1e4]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40b8cf
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40ba72
push edx
push ecx
call fcn.004913bc
add esp, 8
cmp dword [ebp - 0x6c], 0x10
lea ecx, [ebp - 0x20]
push 0
push ecx
push dword [ebp - 0x70]
lea eax, [ebp - 0x80]
cmovae eax, dword [ebp - 0x80]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [ebp - 0x6c]
cmp edx, 0x10
jb 0x40b929
mov ecx, dword [ebp - 0x80]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40b91f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40ba77
push edx
push ecx
call fcn.004913bc
add esp, 8
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc dword [0x529514]
mov ecx, dword [ebp - 0xdc]
mov dword [ebp - 0xe8], vtable.CryptoPP::SourceTemplate_class_CryptoPP::StringStore_.0
mov dword [ebp - 0xe4], vtable.CryptoPP::SourceTemplate_class_CryptoPP::StringStore_.1.0
test ecx, ecx
je 0x40b95a
mov eax, dword [ecx]
push 1
call dword [eax]
lea ecx, [ebp - 0x12c]
call fcn.00407d70
mov edx, dword [ebp - 0x24]
mov dword [ebp - 0xf0], vtable.CryptoPP::NameValuePairs.0
cmp edx, 0x10
jb 0x40b9a3
mov ecx, dword [ebp - 0x38]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40b999
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40ba7c
push edx
push ecx
call fcn.004913bc
add esp, 8
mov edx, dword [ebp - 0x3c]
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0xf
mov byte [ebp - 0x38], 0
cmp edx, 0x10
jb 0x40b9e9
mov ecx, dword [ebp - 0x50]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40b9df
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40ba7c
push edx
push ecx
call fcn.004913bc
add esp, 8
mov edx, dword [ebp - 0x54]
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 0xf
mov byte [ebp - 0x50], 0
cmp edx, 0x10
jb 0x40ba2b
mov ecx, dword [ebp - 0x68]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40ba21
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40ba7c
push edx
push ecx
call fcn.004913bc
add esp, 8
mov eax, 1
jmp 0x40ba40
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.00490d3b
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.004b58b2
call fcn.004b58b2
call fcn.004b58b2
call fcn.004b58b2
call fcn.004b58b2
call fcn.004b58b2
call fcn.004b58b2
int3