Function at 0x403c40
Capabilities:
Contain obfuscated stackstrings
Get file size
Read file via mapping
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xdc
mov byte [ebp - 0x98], 0x52
mov byte [ebp - 0x97], 0x61
mov byte [ebp - 0x96], 0x72
mov byte [ebp - 0x95], 0x21
mov byte [ebp - 0x94], 0x1a
mov byte [ebp - 0x93], 7
mov byte [ebp - 0x92], 0
mov byte [ebp - 0x91], 0xcf
mov byte [ebp - 0x90], 0x90
mov byte [ebp - 0x8f], 0x73
mov byte [ebp - 0x8e], 0
mov byte [ebp - 0x8d], 0
mov byte [ebp - 0x8c], 0xd
mov byte [ebp - 0x8b], 0
mov byte [ebp - 0x8a], 0
mov byte [ebp - 0x89], 0
mov byte [ebp - 0x88], 0
mov byte [ebp - 0x87], 0
mov byte [ebp - 0x86], 0
mov byte [ebp - 0x85], 0
mov byte [ebp - 0xdc], 0xc4
mov byte [ebp - 0xdb], 0x3d
mov byte [ebp - 0xda], 0x7b
mov byte [ebp - 0xd9], 0
mov byte [ebp - 0xd8], 0x40
mov byte [ebp - 0xd7], 7
mov byte [ebp - 0xd6], 0
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 0xffffffff
jne 0x403d38
xor eax, eax
jmp 0x4040b1
push 0
mov ecx, dword [ebp - 0xc0]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 0xffffffff
jne 0x403d6a
mov edx, dword [ebp - 0xc0]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x4040b1
push 0
push 0x80
push 3
push 0
push 1
push 0x40000000
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0xd4], eax
cmp dword [ebp - 0xd4], 0xffffffff
jne 0x403df5
push 0
push 0x80
push 1
push 0
push 1
push 0x40000000
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0xd4], eax
cmp dword [ebp - 0xd4], 0xffffffff
jne 0x403dd4
mov edx, dword [ebp - 0xc0]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x4040b1
push 0
lea eax, [ebp - 0xbc]
push eax
push 0x14
lea ecx, [ebp - 0x98]
push ecx
mov edx, dword [ebp - 0xd4]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x403e4f
push 0
mov eax, dword [ebp - 0xd4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 0xffffffff
jne 0x403e34
mov ecx, dword [ebp - 0xc0]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0xd4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x4040b1
push 0
push 0
mov eax, dword [ebp - 0xcc]
sub eax, 7
push eax
mov ecx, dword [ebp - 0xd4]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
push 0
push 0
push 2
push 0
mov edx, dword [ebp - 0xc0]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 0
jne 0x403e96
mov eax, dword [ebp - 0xc0]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0xd4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x4040b1
push 0
push 0
push 0
push 4
mov edx, dword [ebp - 0xc8]
push edx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 0
jne 0x403ee8
mov eax, dword [ebp - 0xc8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0xc0]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0xd4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x4040b1
push 0x20
push 0
lea eax, [ebp - 0xb8]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
mov byte [ebp - 0xb6], 0x74
mov ecx, dword [ebp - 0xd0]
push ecx
mov edx, dword [ebp - 0xc4]
push edx
call fcn.00403b90
add esp, 8
mov dword [ebp - 0xa8], eax
mov eax, 0x8000
mov word [ebp - 0xb5], ax
mov byte [ebp - 0x9f], 0x30
mov byte [ebp - 0xa0], 0x14
mov ecx, dword [ebp + 0x14]
mov dword [ebp - 0x9c], ecx
mov edx, dword [ebp - 0xd0]
mov dword [ebp - 0xad], edx
mov eax, dword [ebp - 0xd0]
mov dword [ebp - 0xb1], eax
mov ecx, dword [ebp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov word [ebp - 0x9e], ax
movzx edx, word [ebp - 0x9e]
add edx, 0x20
mov word [ebp - 0xb3], dx
push 0x80
push 0
lea eax, [ebp - 0x80]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x20
lea ecx, [ebp - 0xb8]
push ecx
lea edx, [ebp - 0x80]
push edx
call sub.MSVCRT.dll_memcpy
add esp, 0xc
lea eax, [ebp - 0x80]
mov dword [ebp - 0x84], eax
mov ecx, dword [ebp - 0x84]
add ecx, 0x20
mov dword [ebp - 0x84], ecx
movzx edx, word [ebp - 0x9e]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 0x84]
push ecx
call sub.MSVCRT.dll_memcpy
add esp, 0xc
movzx edx, word [ebp - 0x9e]
add edx, 0x1e
push edx
lea eax, [ebp - 0x7e]
push eax
call fcn.00403b90
add esp, 8
mov word [ebp - 0xb8], ax
push 0
lea ecx, [ebp - 0xbc]
push ecx
push 0x20
lea edx, [ebp - 0xb8]
push edx
mov eax, dword [ebp - 0xd4]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea ecx, [ebp - 0xbc]
push ecx
movzx edx, word [ebp - 0x9e]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 0xd4]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea edx, [ebp - 0xbc]
push edx
mov eax, dword [ebp - 0xd0]
push eax
mov ecx, dword [ebp - 0xc4]
push ecx
mov edx, dword [ebp - 0xd4]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea eax, [ebp - 0xbc]
push eax
push 7
lea ecx, [ebp - 0xdc]
push ecx
mov edx, dword [ebp - 0xd4]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 0xc4]
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [ebp - 0xc8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0xc0]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0xd4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov esp, ebp
pop ebp
ret