Function at 0x401269
Capabilities:
Write file on windows

Disassembly:
inc ebx
cmp al, byte [eax]
dec esp
outsd dx, dword [esi]
arpl word [ecx + 0x6c], sp
push ebx
jns 0x401162
je 0x401156
insd dword es:[edi], dx
add byte [ebp + 0x72], al
jb 0x401166
jb 0x40113c
outsd dx, dword [esi]
outsb dx, byte [esi]
je 0x40116f
outsd dx, dword [esi]
insb byte es:[edi], dx
add byte [esi + 0x74], ch
insb byte es:[edi], dx
insb byte es:[edi], dx
add byte [ebx + 0x79], dl
jae 0x40117e
insd dword es:[edi], dx
push edx
outsd dx, dword [esi]
outsd dx, dword [esi]
je 0x401111
and eax, 0x74737953
insd dword es:[edi], dx
push edx
outsd dx, dword [esi]
outsd dx, dword [esi]
je 0x401142
pop esp
push ebx
jns 0x401194
je 0x401188
insd dword es:[edi], dx
xor esi, dword [edx]
pop esp
jb 0x401199
arpl word [esi + 0x65], bp
je 0x40119e
js 0x401197
add byte [ebx + edx*2 + 0x79], bl
jae 0x4011ac
insd dword es:[edi], dx
push edx
outsd dx, dword [esi]
outsd dx, dword [esi]
je 0x40119b
push ebx
jns 0x4011b5
je 0x4011a9
insd dword es:[edi], dx
xor esi, dword [edx]
pop esp
jb 0x4011ba
arpl word [esi + 0x65], bp
je 0x4011bf
js 0x4011b8
add byte [ebx + edx*2 + 0x79], bl
jae 0x4011cd
jns 0x4011cb
je 0x4011bf
insd dword es:[edi], dx
insd dword es:[edi], dx
push edx
outsd dx, dword [esi]
outsd dx, dword [esi]
je 0x4011bc
push ebx
jns 0x4011d6
jae 0x4011d8
je 0x4011ca
insd dword es:[edi], dx
insd dword es:[edi], dx
xor esi, dword [edx]
pop esp
inc ecx
push ebp
push esp
dec edi
inc ebx
dec eax
dec ebx
inc ebp
pop eax
inc ebp
cmp al, byte [edx + 0x41]
dec ebx
add byte [ebx + 0x74], dl
popal
jb 0x4011f2
add byte [ecx + edi*2 + 0x70], dl
add byte gs:[ebx + edx*2 + 0x79], bl
jae 0x4011fd
je 0x4011ef
insd dword es:[edi], dx
insd dword es:[edi], dx
push edx
outsd dx, dword [esi]
outsd dx, dword [esi]
je 0x4011ec
push ebx
jns 0x401206
push edi
dec edi
push edi
xor al, 0x5c
xor al, 0x5c
jb 0x40120b
arpl word [esi + 0x65], bp
je 0x401210
js 0x401209
add byte [ebx + edx*2 + 0x79], bl
jae 0x40121e
je 0x401210
insd dword es:[edi], dx
insd dword es:[edi], dx
push edx
outsd dx, dword [esi]
outsd dx, dword [esi]
je 0x40120d
push ebx
jns 0x401227
je 0x40121b
insd dword es:[edi], dx
insd dword es:[edi], dx
xor esi, dword [edx]
pop esp
xor bl, byte [ecx + eax*2 + 0x55]
inc ecx
push ebp
push esp
dec edi
inc ebx
dec eax
dec ebx
inc edx
inc ecx
dec ebx
add byte [edi + 0x62], cl
push 0x65
arpl word [esi + ecx*2 + 0x61], si
je 0x40121b
popal
insd dword es:[edi], dx
add byte gs:[edx + edx*2 + 0x65], bl
imul esi, dword [bp + di + 0x74], 0x4d5c7972
jae 0x40124c
jb 0x401253
pop esp
dec ebp
popal
arpl word [eax + 0x69], bp
outsb dx, byte [esi]
pop esp
push ebx
jns 0x401259
je 0x40124d
insd dword es:[edi], dx
pop esp
inc ebx
jne 0x40125f
jb 0x401260
jb 0x401254
outsb dx, byte gs:[esi]
outsb dx, byte [esi]
je 0x401235
outsd dx, dword [esi]
outsb dx, byte [esi]
je 0x401268
outsd dx, dword [esi]
insb byte es:[edi], dx
push ebx
je 0x401258
push ebx
jb 0x401276
imul esp, dword [ebx + 0x65], 0x70725c73
arpl word [esi + 0x65], bp
je 0x40127c
jo 0x40126b
outsb dx, byte [esi]
je 0x40127c
jo 0x40120d
add byte [eax], al
dec ecx
insd dword es:[edi], dx
add byte [ecx + 0x6d], cl
popal
push eax
popal
je 0x40127f
add byte [eax], al
add byte [eax], al
add byte [eax + 0x15], dh
inc eax
add byte [ecx + 0x12], ch
inc eax
add ah, bl
pop ss
inc eax
add byte [edi + edx], ch
inc eax
add bl, bh
adc al, byte [eax]
jo 0x401247
inc eax
add byte [eax], al
add byte [eax], al
add bh, bh
jmp dword [sym.imp.ntdll.dll_wcscpy]
jne 0x401255
jle 0x40125e
or byte [edi - 0x39], bl
push es
sbb byte [eax], al
add byte [eax], al
inc esi
or al, 0x40
inc eax
add byte [eax], al
add byte [esi + 0x5d], bl
add byte [ebp - 0x75], dl
in al, dx
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
lea eax, [esi + 0xd2]
xor edi, edi
mov ebx, 0x40000000
xchg dl, dl
add byte [eax], al
add byte [ebx], dh
invalid
add byte [eax], al
inc eax
push eax
push esi
mov dword [ebp + 8], eax
call fcn.0040123e
mov dword [esi + 0x18], 0x80110000
push edi
push edi
push 0x22
push edi
push 3
push 0x80
push edi
lea eax, [ebp - 0xc]
push eax
push esi
push dword [esi + 0x18]
lea eax, [ebp - 4]
push eax
call dword [sym.imp.ntdll.dll_NtCreateFile]
test eax, eax
js 0x4012db
push edi
push edi
push 0x4400
push 0x401928
lea eax, [ebp - 0xc]
push eax
push edi
push edi
push edi
push dword [ebp - 4]
call dword [sym.imp.ntdll.dll_NtWriteFile]
push dword [ebp - 4]
call dword [sym.imp.ntdll.dll_NtClose]
mov eax, dword [esi + 0x18]
test ebx, eax
jne 0x4012e9
or eax, ebx
mov dword [esi + 0x18], eax
jmp 0x401293
lea eax, [esi + 0x174]
cmp dword [ebp + 8], eax
jne 0x401282
pop edi
pop esi
pop ebx
leave
ret 4