Function at 0x401292
Capabilities:
Contain obfuscated stackstrings
Get file size
Read file via mapping
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xdc
push esi
push edi
mov byte [ebp - 0x98], 0x52
mov byte [ebp - 0x97], 0x61
mov byte [ebp - 0x96], 0x72
mov byte [ebp - 0x95], 0x21
mov byte [ebp - 0x94], 0x1a
mov byte [ebp - 0x93], 7
mov byte [ebp - 0x92], 0
mov byte [ebp - 0x91], 0xcf
mov byte [ebp - 0x90], 0x90
mov byte [ebp - 0x8f], 0x73
mov byte [ebp - 0x8e], 0
mov byte [ebp - 0x8d], 0
mov byte [ebp - 0x8c], 0xd
mov byte [ebp - 0x8b], 0
mov byte [ebp - 0x8a], 0
mov byte [ebp - 0x89], 0
mov byte [ebp - 0x88], 0
mov byte [ebp - 0x87], 0
mov byte [ebp - 0x86], 0
mov byte [ebp - 0x85], 0
mov byte [ebp - 0xdc], 0xc4
mov byte [ebp - 0xdb], 0x3d
mov byte [ebp - 0xda], 0x7b
mov byte [ebp - 0xd9], 0
mov byte [ebp - 0xd8], 0x40
mov byte [ebp - 0xd7], 7
mov byte [ebp - 0xd6], 0
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 0xffffffff
jne 0x40138b
xor eax, eax
jmp 0x4016d2
push 0
push dword [ebp - 0xc0]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 0xffffffff
jne 0x4013bb
push dword [ebp - 0xc0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x4016d2
push 0
push 0x80
push 3
push 0
push 1
push 0x40000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0xd4], eax
cmp dword [ebp - 0xd4], 0xffffffff
jne 0x401442
push 0
push 0x80
push 1
push 0
push 1
push 0x40000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0xd4], eax
cmp dword [ebp - 0xd4], 0xffffffff
jne 0x401422
push dword [ebp - 0xc0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x4016d2
push 0
lea eax, [ebp - 0xbc]
push eax
push 0x14
lea eax, [ebp - 0x98]
push eax
push dword [ebp - 0xd4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x401498
push 0
push dword [ebp - 0xd4]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 0xffffffff
jne 0x40147e
push dword [ebp - 0xc0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0xd4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x4016d2
push 0
push 0
mov eax, dword [ebp - 0xcc]
sub eax, 7
push eax
push dword [ebp - 0xd4]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
push 0
push 0
push 2
push 0
push dword [ebp - 0xc0]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 0
jne 0x4014dc
push dword [ebp - 0xc0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0xd4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x4016d2
push 0
push 0
push 0
push 4
push dword [ebp - 0xc8]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 0
jne 0x40152a
push dword [ebp - 0xc8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0xc0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0xd4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x4016d2
push 8
pop ecx
xor eax, eax
lea edi, [ebp - 0xb8]
rep stosd dword es:[edi], eax
mov byte [ebp - 0xb6], 0x74
push dword [ebp - 0xd0]
push dword [ebp - 0xc4]
call fcn.004011f2
pop ecx
pop ecx
mov dword [ebp - 0xa8], eax
mov eax, 0x8000
mov word [ebp - 0xb5], ax
mov byte [ebp - 0x9f], 0x30
mov byte [ebp - 0xa0], 0x14
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x9c], eax
mov eax, dword [ebp - 0xd0]
mov dword [ebp - 0xad], eax
mov eax, dword [ebp - 0xd0]
mov dword [ebp - 0xb1], eax
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov word [ebp - 0x9e], ax
movzx eax, word [ebp - 0x9e]
add eax, 0x20
mov word [ebp - 0xb3], ax
push 0x80
push 0
lea eax, [ebp - 0x80]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push 8
pop ecx
lea esi, [ebp - 0xb8]
lea edi, [ebp - 0x80]
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x80]
mov dword [ebp - 0x84], eax
mov eax, dword [ebp - 0x84]
add eax, 0x20
mov dword [ebp - 0x84], eax
movzx eax, word [ebp - 0x9e]
push eax
push dword [ebp + 0x10]
push dword [ebp - 0x84]
call sub.MSVCRT.dll_memcpy
add esp, 0xc
movzx eax, word [ebp - 0x9e]
add eax, 0x1e
push eax
lea eax, [ebp - 0x7e]
push eax
call fcn.004011f2
pop ecx
pop ecx
mov word [ebp - 0xb8], ax
push 0
lea eax, [ebp - 0xbc]
push eax
push 0x20
lea eax, [ebp - 0xb8]
push eax
push dword [ebp - 0xd4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea eax, [ebp - 0xbc]
push eax
movzx eax, word [ebp - 0x9e]
push eax
push dword [ebp + 0x10]
push dword [ebp - 0xd4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea eax, [ebp - 0xbc]
push eax
push dword [ebp - 0xd0]
push dword [ebp - 0xc4]
push dword [ebp - 0xd4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea eax, [ebp - 0xbc]
push eax
push 7
lea eax, [ebp - 0xdc]
push eax
push dword [ebp - 0xd4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebp - 0xc4]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push dword [ebp - 0xc8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0xc0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0xd4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
inc eax
pop edi
pop esi
leave
ret