Function at 0x403440
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45ed9a
mov eax, dword fs:[0]
push eax
sub esp, 0x108
mov eax, dword [0x47b0fc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x64], ecx
mov edx, dword [ebp + 8]
mov ecx, edx
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x78], edx
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x70], 0
lea esi, [ecx + 1]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
nop dword [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4034a0
sub ecx, esi
push ecx
push edx
lea ecx, [ebp - 0x28]
call fcn.00403c50
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 0x28]
mov edi, dword [ebp - 0x28]
lea ecx, [ebp - 0x28]
mov ebx, dword [ebp - 0x18]
lea esi, [ebp - 0x28]
cmp edx, 0x10
mov dword [ebp - 4], 0
cmovae eax, edi
cmovae ecx, edi
add eax, ebx
cmp edx, 0x10
cmovae esi, edi
cmp esi, eax
je 0x403504
sub ecx, esi
mov ebx, eax
mov edi, ecx
movsx eax, byte [esi]
push eax
call fcn.00442247
mov byte [edi + esi], al
add esp, 4
inc esi
cmp esi, ebx
jne 0x4034e7
mov edx, dword [ebp - 0x14]
mov ebx, dword [ebp - 0x18]
mov edi, dword [ebp - 0x28]
xor ecx, ecx
test ebx, ebx
je 0x40353a
nop word [eax + eax]
cmp edx, 0x10
lea eax, [ebp - 0x28]
cmovae eax, edi
cmp byte [eax + ecx], 0x5c
jne 0x403535
cmp edx, 0x10
lea eax, [ebp - 0x28]
cmovae eax, edi
mov byte [eax + ecx], 0x2f
mov edx, dword [ebp - 0x14]
mov ebx, dword [ebp - 0x18]
mov edi, dword [ebp - 0x28]
inc ecx
cmp ecx, ebx
jb 0x403510
lea ecx, [ebp - 0x84]
call fcn.0042f5b0
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
push dword [ebp - 0x18]
cmovae eax, dword [ebp - 0x28]
lea ecx, [ebp - 0x84]
push eax
mov eax, dword [ebp - 0x84]
call dword [eax + 0x10]
lea eax, [ebp - 0x70]
push eax
mov eax, dword [ebp - 0x84]
lea ecx, [ebp - 0x84]
call dword [eax + 0x18]
mov edx, dword [ebp - 0x78]
mov ecx, edx
lea esi, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x403580
sub ecx, esi
mov dword [ebp - 0x4c], 0x14
movzx eax, cx
mov dword [ebp - 0x74], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp + 0x10]
push ecx
mov dword [ebp - 0x48], eax
lea ecx, [ebp - 0x40]
mov eax, dword [ebp - 0x70]
push edx
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0xf
mov byte [ebp - 0x40], 0
call fcn.00403c50
mov edx, dword [ebp - 0x2c]
lea eax, [ebp - 0x40]
mov edi, dword [ebp - 0x40]
lea ecx, [ebp - 0x40]
mov ebx, dword [ebp - 0x30]
lea esi, [ebp - 0x40]
cmp edx, 0x10
mov byte [ebp - 4], 1
cmovae eax, edi
cmovae ecx, edi
add eax, ebx
cmp edx, 0x10
cmovae esi, edi
cmp esi, eax
je 0x40361d
sub ecx, esi
mov ebx, eax
mov edi, ecx
nop dword [eax + eax]
movsx eax, byte [esi]
push eax
call fcn.00442247
mov byte [edi + esi], al
add esp, 4
inc esi
cmp esi, ebx
jne 0x403600
mov edx, dword [ebp - 0x2c]
mov ebx, dword [ebp - 0x30]
mov edi, dword [ebp - 0x40]
xor ecx, ecx
test ebx, ebx
je 0x40364d
cmp edx, 0x10
lea eax, [ebp - 0x40]
cmovae eax, edi
cmp byte [eax + ecx], 0x5c
jne 0x403648
cmp edx, 0x10
lea eax, [ebp - 0x40]
cmovae eax, edi
mov byte [eax + ecx], 0x2f
mov edx, dword [ebp - 0x2c]
mov ebx, dword [ebp - 0x30]
mov edi, dword [ebp - 0x40]
inc ecx
cmp ecx, ebx
jb 0x403623
mov ebx, dword [ebp - 0x64]
lea eax, [ebp - 0xb4]
push 1
lea ecx, [ebp - 0xb0]
mov dword [ebp - 0x64], eax
lea esi, [ebx + 0x20]
call fcn.0041d6f0
push 0
push 0
lea ecx, [ebp - 0xa4]
mov dword [ebp - 0xa0], 0x3fffffff
mov dword [ebp - 0x9c], 0
call fcn.00403a00
mov dword [ebp - 0x98], eax
mov dword [ebp - 0x90], 0xffffffff
mov dword [ebp - 0x8c], 0
mov dword [ebp - 0x88], 0
mov dword [ebp - 0xb4], vtable.CryptoPP::BlockCipherFinal_0__class_CryptoPP::Rijndael::Enc_.0
mov dword [ebp - 0xb0], vtable.CryptoPP::BlockCipherFinal_0__class_CryptoPP::Rijndael::Enc_.1.0
push 1
lea ecx, [ebp - 0xec]
mov byte [ebp - 4], 3
call fcn.0041d6f0
mov dword [ebp - 0xe0], 0xffffffff
mov dword [ebp - 0xdc], 0
mov dword [ebp - 0xd8], 0
mov dword [ebp - 0xcc], 0xffffffff
mov dword [ebp - 0xc8], 0
mov dword [ebp - 0xc4], 0
mov dword [ebp - 0xc0], 0
mov dword [ebp - 0xbc], 0
lea eax, [ebp - 0xb4]
mov byte [ebp - 4], 5
mov dword [ebp - 0xe8], eax
lea ecx, [ebp - 0xb0]
mov eax, dword [ebp - 0xb0]
mov dword [ebp - 0xf0], 0x4625d0
mov dword [ebp - 0xec], 0x462624
mov dword [ebp - 0xd4], 0x462668
call dword [eax + 0x14]
mov dword [ebp - 0x104], 0xffffffff
mov dword [ebp - 0x100], 0
mov dword [ebp - 0xfc], 0
mov dword [ebp - 0x110], esi
mov dword [ebp - 0x10c], eax
mov byte [ebp - 0x114], 0
push 1
lea eax, [ebp - 0x114]
mov byte [ebp - 4], 7
push eax
lea eax, [ebp - 0x6c]
push 0x4623e8
push eax
call fcn.004014a0
add esp, 0x10
push eax
push 0x20
push ebx
lea ecx, [ebp - 0xf0]
mov byte [ebp - 4], 8
call fcn.0041ed90
mov ecx, dword [ebp - 0x68]
mov byte [ebp - 4], 9
test ecx, ecx
je 0x4037d5
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [ebp - 0x6c], vtable.CryptoPP::NameValuePairs.0
xor al, al
mov byte [ebp - 4], 0xa
xor ecx, ecx
xor edi, edi
rep stosb byte es:[edi], al
push 0
call fcn.0041f860
add esp, 4
mov edi, dword [ebp + 0x10]
lea ecx, [ebp - 0xec]
mov eax, dword [ebp - 0x7c]
push edi
push eax
push eax
mov byte [ebp - 4], 0xb
call fcn.0042cbf0
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
lea eax, [ebp - 0x58]
push 0
push eax
push 2
lea eax, [ebp - 0x74]
push eax
push dword [ebx + 0x5c]
call esi
push 0
lea eax, [ebp - 0x58]
push eax
movzx eax, word [ebp - 0x74]
push eax
push dword [ebp - 0x78]
push dword [ebx + 0x5c]
call esi
push 0
lea eax, [ebp - 0x58]
push eax
push 4
lea eax, [ebp + 0x14]
push eax
push dword [ebx + 0x5c]
call esi
push 1
lea eax, [ebp - 0xf8]
xorps xmm0, xmm0
push eax
movlpd qword [ebp - 0x68], xmm0
push dword [ebp - 0x64]
push dword [ebp - 0x68]
push dword [ebx + 0x58]
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov eax, dword [ebp - 0xf8]
add dword [ebp - 0x4c], eax
lea eax, [ebp - 0x58]
push 0
push eax
push 0x14
lea eax, [ebp - 0x54]
push eax
push dword [ebx + 0x58]
call esi
push 0
lea eax, [ebp - 0x58]
push eax
mov eax, dword [ebp - 0x7c]
push edi
push eax
push dword [ebx + 0x58]
call esi
mov dword [ebp - 0xf0], vtable.CryptoPP::ConcretePolicyHolder_class_CryptoPP::Empty__class_CryptoPP::CFB_EncryptionTemplate_class_CryptoPP::AbstractPolicyHolder_class_CryptoPP::CFB_CipherAbstractPolicy__class_CryptoPP::CFB_ModePolicy____class_CryptoPP::CFB_CipherAbstractPolicy_.0
mov dword [ebp - 0xec], vtable.CryptoPP::ConcretePolicyHolder_class_CryptoPP::Empty__class_CryptoPP::CFB_EncryptionTemplate_class_CryptoPP::AbstractPolicyHolder_class_CryptoPP::CFB_CipherAbstractPolicy__class_CryptoPP::CFB_ModePolicy____class_CryptoPP::CFB_CipherAbstractPolicy_.1.0
mov dword [ebp - 0xd4], vtable.CryptoPP::ConcretePolicyHolder_class_CryptoPP::Empty__class_CryptoPP::CFB_EncryptionTemplate_class_CryptoPP::AbstractPolicyHolder_class_CryptoPP::CFB_CipherAbstractPolicy__class_CryptoPP::CFB_ModePolicy____class_CryptoPP::CFB_CipherAbstractPolicy_.2.0
mov ecx, dword [ebp - 0xc8]
mov eax, dword [ebp - 0xcc]
cmp eax, ecx
mov edx, dword [ebp - 0xc4]
mov byte [ebp - 4], 0xc
cmovb ecx, eax
mov edi, edx
xor al, al
rep stosb byte es:[edi], al
push edx
call fcn.0041f860
mov eax, dword [ebp - 0xe0]
mov ecx, dword [ebp - 0xdc]
cmp eax, ecx
mov edx, dword [ebp - 0xd8]
mov edi, edx
cmovb ecx, eax
mov byte [ebp - 4], 0xd
xor al, al
rep stosb byte es:[edi], al
push edx
call fcn.0041f860
mov eax, dword [ebp - 0x90]
mov ecx, dword [ebp - 0x8c]
cmp eax, ecx
mov edx, dword [ebp - 0x88]
mov edi, edx
cmovb ecx, eax
mov byte [ebp - 4], 0xe
xor al, al
rep stosb byte es:[edi], al
push edx
call fcn.0041f860
add esp, 0xc
mov edx, dword [ebp - 0x9c]
cmp dword [ebp - 0xa0], edx
mov esi, dword [ebp - 0x98]
mov edi, esi
cmovb edx, dword [ebp - 0xa0]
xor eax, eax
mov byte [ebp - 4], 0xf
mov ecx, edx
rep stosd dword es:[edi], eax
push esi
test edx, edx
je 0x403956
call fcn.0041f7f0
jmp 0x40395b
call fcn.0041f860
mov edx, dword [ebp - 0x2c]
add esp, 4
cmp edx, 0x10
jb 0x40398e
mov ecx, dword [ebp - 0x40]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x403984
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4039f0
push edx
push ecx
call fcn.00437616
add esp, 8
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0xf
mov byte [ebp - 0x40], 0
cmp edx, 0x10
jb 0x4039d0
mov ecx, dword [ebp - 0x28]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4039c6
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4039f0
push edx
push ecx
call fcn.00437616
add esp, 8
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00437624
mov esp, ebp
pop ebp
ret 0x14
call fcn.0044205f
int3