Function at 0x401000
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5f8
mov eax, dword [0x5498f8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0
mov ebx, ecx
mov esi, edx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edi, eax
mov eax, dword [esi]
mov ecx, dword [eax]
mov edx, dword [eax + 0xc]
mov esi, 0xc000008f
cmp ecx, esi
jg 0x401160
je 0x401152
lea eax, [esi - 0x72]
cmp ecx, eax
jg 0x4010e3
je 0x4010d5
mov eax, reloc.WS2_32.dll_bind
cmp ecx, eax
je 0x4010c7
inc eax
cmp ecx, eax
je 0x4010b9
mov eax, reloc.WS2_32.dll_connect
cmp ecx, eax
je 0x4010ab
mov eax, 0xc0000005
cmp ecx, eax
je 0x40109d
inc eax
cmp ecx, eax
je 0x40108f
mov eax, 0xc0000008
cmp ecx, eax
jne 0x401206
push edx
push eax
push edi
push ebx
push 0x5312d0
jmp 0x401261
push edx
push eax
push edi
push ebx
push 0x531068
jmp 0x401261
push edx
push eax
push edi
push ebx
push 0x530cc0
jmp 0x401261
push edx
push eax
push edi
push ebx
push 0x531258
jmp 0x401261
push edx
push eax
push edi
push ebx
push 0x530d50
jmp 0x401261
push edx
push eax
push edi
push ebx
push 0x530d98
jmp 0x401261
push edx
push eax
push edi
push ebx
push 0x531018
jmp 0x401261
mov eax, 0xc0000025
cmp ecx, eax
je 0x401144
inc eax
cmp ecx, eax
je 0x401136
mov eax, 0xc000008c
cmp ecx, eax
je 0x401128
inc eax
cmp ecx, eax
je 0x40111a
mov eax, 0xc000008e
cmp ecx, eax
jne 0x401206
push edx
push eax
push edi
push ebx
push 0x530e38
jmp 0x401261
push edx
push eax
push edi
push ebx
push 0x530de8
jmp 0x401261
push edx
push eax
push edi
push ebx
push 0x530d10
jmp 0x401261
push edx
push eax
push edi
push ebx
push 0x531140
jmp 0x401261
push edx
push eax
push edi
push ebx
push 0x531190
jmp 0x401261
push edx
push esi
push edi
push ebx
push 0x530e88
jmp 0x401261
mov esi, 0xc0000095
cmp ecx, esi
jg 0x4011de
je 0x4011d0
lea eax, [esi - 5]
cmp ecx, eax
je 0x4011c2
inc eax
cmp ecx, eax
je 0x4011b4
lea eax, [esi - 3]
cmp ecx, eax
je 0x4011a6
inc eax
cmp ecx, eax
je 0x401198
lea eax, [esi - 1]
cmp ecx, eax
jne 0x401206
push edx
push eax
push edi
push ebx
push 0x5310b8
jmp 0x401261
push edx
push eax
push edi
push ebx
push 0x530fc8
jmp 0x401261
push edx
push eax
push edi
push ebx
push 0x530f78
jmp 0x401261
push edx
push eax
push edi
push ebx
push 0x530f28
jmp 0x401261
push edx
push eax
push edi
push ebx
push 0x530ed8
jmp 0x401261
push edx
push esi
push edi
push ebx
push 0x5310f8
jmp 0x401261
mov esi, 0xc0000096
cmp ecx, esi
je 0x401258
add esi, 0x67
cmp ecx, esi
je 0x40124d
cmp ecx, 0x20000001
je 0x401240
cmp ecx, 0x20000002
je 0x401233
cmp ecx, 0x20000003
je 0x401226
push edx
push ecx
push edi
lea eax, [ebp - 0x1f8]
push ebx
test ecx, 0x20000000
je 0x40121f
push 0x5313c8
jmp 0x401267
push 0x53140c
jmp 0x401267
push edx
push dword [eax + 0x14]
push edi
push ebx
push 0x531388
jmp 0x401261
push edx
push dword [eax + 0x14]
push edi
push ebx
push 0x53130c
jmp 0x401261
push edx
push dword [eax + 0x14]
push edi
push ebx
push 0x53134c
jmp 0x401261
push edx
push esi
push edi
push ebx
push 0x531294
jmp 0x401261
push edx
push esi
push edi
push ebx
push 0x531200
lea eax, [ebp - 0x1f8]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
test byte [ebp + 8], 2
je 0x4013f1
jmp 0x401287
mov ebx, 0x1f4
push ebx
lea eax, [ebp - 0x3ec]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x3ec]
push 0x5c
push eax
call fcn.004f84e0
xor esi, esi
pop ecx
pop ecx
cmp eax, esi
je 0x4012b5
mov byte [eax + 1], 0
push 0x531444
lea eax, [ebp - 0x3ec]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x5f0]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [ebp - 0x5e4]
push eax
movzx eax, word [ebp - 0x5e6]
push eax
movzx eax, word [ebp - 0x5e8]
push eax
movzx eax, word [ebp - 0x5ea]
push eax
movzx eax, word [ebp - 0x5ee]
push eax
movzx eax, word [ebp - 0x5f0]
push eax
push 0x531458
lea eax, [ebp - 0x5e0]
push ebx
push eax
call fcn.004f7a96
mov eax, dword [0x55bb38]
add esp, 0x24
cmp eax, esi
jne 0x40132c
call fcn.0040239f
mov dword [0x55bb38], eax
push 0xffffffffffffffff
push eax
call fcn.00402382
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileA]
pop ecx
pop ecx
push esi
push esi
push 3
push esi
push 7
mov ebx, 0xc0000000
push ebx
lea eax, [ebp - 0x3ec]
push eax
call edi
mov dword [ebp - 0x5f4], eax
cmp eax, 0xffffffff
jne 0x401379
push esi
push esi
push 1
push esi
push 7
push ebx
lea eax, [ebp - 0x3ec]
push eax
call edi
mov dword [ebp - 0x5f4], eax
cmp eax, 0xffffffff
je 0x4013e3
push 2
push esi
push esi
push dword [ebp - 0x5f4]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
push esi
lea eax, [ebp - 0x5f8]
push eax
lea eax, [ebp - 0x5e0]
push eax
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
push eax
lea eax, [ebp - 0x5e0]
push eax
push dword [ebp - 0x5f4]
call ebx
push esi
lea eax, [ebp - 0x5f8]
push eax
lea eax, [ebp - 0x1f8]
push eax
call edi
push eax
lea eax, [ebp - 0x1f8]
push eax
push dword [ebp - 0x5f4]
call ebx
push dword [ebp - 0x5f4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [0x55bb38]
call fcn.004023b9
pop ecx
jmp 0x4013f3
xor esi, esi
test byte [ebp + 8], 1
je 0x401409
push esi
push esi
lea eax, [ebp - 0x1f8]
push eax
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x401415
mov ecx, dword [ebp - 4]
pop edi
xor eax, eax
pop esi
xor ecx, ebp
inc eax
pop ebx
call fcn.004f7824
leave
ret