Function at 0x401000
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov dword [ebp - 8], 0xf
mov eax, dword [ebp - 8]
add eax, 0x353
mov ecx, dword [ebp - 8]
add ecx, 0x64
and eax, ecx
mov dword [ebp - 8], eax
mov ax, word [ebp - 8]
movzx eax, word [ebp - 8]
xor edx, edx
mov ecx, 0xb8
div ecx
mov ecx, dword [ebp - 8]
and eax, ecx
movzx esi, ax
mov edx, esi
mov ecx, 0x171
imul edx, edx, 0x365
xor edx, ecx
mov dword [ebp - 0xc], edx
cmp word [ebp - 0xc], cx
jne 0x401227
cmp word [ebp - 0xc], 0x13
jne 0x4010b2
mov ecx, dword [ebp - 0xc]
xor ecx, 0x362
movzx esi, word [ebp - 0xc]
mov eax, 0x96
xor edx, edx
div esi
or ecx, eax
mov dword [ebp - 0xc], ecx
movzx ecx, word [ebp - 0xc]
mov eax, 0x270
xor edx, edx
div ecx
add edx, dword [ebp - 8]
xor edx, 0x1cb
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
xor eax, 0x210
mov dword [ebp - 8], eax
movzx eax, word [ebp - 8]
xor edx, edx
mov ecx, 0x2f2
div ecx
mov dword [ebp - 8], edx
mov al, byte [ebp - 0xc]
pop esi
leave
ret
cmp word [ebp - 0xc], 0x53
jae 0x4010ce
mov al, byte [ebp - 0xc]
push 0xffffffffffffffe4
pop ecx
sub ecx, eax
mov al, byte [ebp - 8]
sub ecx, eax
and ecx, 0x30
mov byte [ebp - 1], cl
jmp 0x401078
cmp word [ebp - 0xc], 0x3f
jae 0x4010f4
movzx eax, word [ebp - 8]
xor edx, edx
mov ecx, 0xba
div ecx
movzx ecx, word [ebp - 0xc]
xor edx, edx
div ecx
add eax, 0x334
mov dword [ebp - 0xc], eax
jmp 0x401078
cmp word [ebp - 0xc], 0x64
ja 0x401128
push esi
movzx eax, word [ebp - 8]
push eax
movzx eax, word [ebp - 8]
push eax
movzx eax, word [ebp - 8]
imul eax, eax, 0x128
movzx ecx, word [ebp - 8]
sub eax, ecx
add eax, 0x252
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LockFile]
jmp 0x401078
cmp word [ebp - 0xc], cx
jne 0x401078
cmp ax, 0x46
jbe 0x401154
movzx eax, word [ebp - 0xc]
push eax
push esi
movzx eax, word [ebp - 8]
push eax
push esi
movzx eax, word [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFileEx]
jmp 0x401078
test ax, ax
jne 0x4011ca
movzx ecx, word [ebp - 8]
mov eax, 0x3c9
xor edx, edx
div ecx
add eax, dword [ebp - 8]
and eax, 0x3db
add eax, 0xc875
push eax
movzx eax, word [ebp - 8]
mov ecx, 0xbd33
sub ecx, eax
push ecx
movzx ecx, word [ebp - 8]
mov eax, 0x193
xor edx, edx
div ecx
add eax, 0x68dc
push eax
movzx eax, word [ebp - 8]
imul eax, eax, 0x364
sub eax, 0xb970
push eax
movzx eax, word [ebp - 0xc]
xor edx, edx
mov ecx, 0x1f3
div ecx
movzx eax, word [ebp - 8]
sub edx, eax
add edx, 0x2d43
push edx
call fcn.00401265
add esp, 0x14
jmp 0x401078
cmp ax, 0x25
jbe 0x4011e7
mov eax, 0x235
xor edx, edx
div esi
and ax, 0x138
xor eax, esi
mov dword [ebp - 8], eax
jmp 0x401078
cmp ax, 0x47
jb 0x4011f6
mov ax, word [ebp - 0xc]
jmp 0x401078
cmp ax, 0x14
jbe 0x401078
xor esi, 0x374
movzx eax, word [ebp - 0xc]
or esi, eax
push esi
mov al, byte [ebp - 8]
and eax, 0xc3
movzx ecx, word [ebp - 8]
or eax, ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetStdHandle]
jmp 0x401078
cmp word [ebp - 0xc], 0x5f
jae 0x401240
mov al, byte [ebp - 0xc]
imul eax, esi
mov ecx, 0x333
sub ecx, eax
jmp 0x4010c9
cmp word [ebp - 0xc], 0x30
jne 0x401252
mov eax, dword [ebp - 0xc]
imul eax, eax, 0x231
jmp 0x4011dd
cmp word [ebp - 0xc], 0x23
jae 0x401078
mov al, byte [ebp - 8]
jmp 0x4010af