Function at 0x416b58
Capabilities:
Contain obfuscated stackstrings
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x68], ebx
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x417206
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0xc], eax
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.004142b4
push 0x43bf7c
call sub.kernel32.dll_EnterCriticalSection_1
push 0x41b790
call dword [0x41b74c]
mov eax, dword [ebp - 4]
call fcn.00413af4
push 0xffffffffffffffff
or ecx, 0xffffffff
or edx, 0xffffffff
mov eax, dword [ebp - 4]
call fcn.0041431c
push 0x43bf7c
call sub.kernel32.dll_LeaveCriticalSection_1
mov eax, dword [0x43bf78]
dec eax
je 0x416bdf
dec eax
je 0x416bee
jmp 0x416bfa
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.0041630c
jmp 0x416c1e
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.0041630c
jmp 0x416c1e
mov eax, dword [0x43bea8]
dec eax
sub eax, 2
jae 0x416c14
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.0041630c
jmp 0x416c1e
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.0041630c
mov dword [ebp - 0x18], 0x10
cmp word [0x42b9b0], 0
je 0x416c3c
movzx eax, word [0x42b9b0]
add eax, 2
add dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
add eax, 0x1c
mov dword [ebp - 0x1c], eax
mov ecx, dword [0x43bf74]
xor esi, esi
cmp ecx, 0x80000000
jae 0x416c7d
mov eax, dword [0x43bf00]
and eax, 0xff
test eax, eax
jne 0x416c7d
mov eax, ecx
mov ebx, 0x64
xor edx, edx
div ebx
add ecx, edx
mov eax, ecx
mov ecx, 0x64
xor edx, edx
div ecx
mov esi, eax
push 0
push 0x10000
mov eax, dword [0x42bb00]
add eax, dword [0x42bb04]
shr eax, 6
xor edx, edx
call fcn.004041cc
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], edx
mov ebx, dword [0x43bf4c]
mov dword [ebp - 0x4c], ebx
xor eax, eax
mov dword [ebp - 0x48], eax
fild qword [ebp - 0x4c]
fdiv dword [0x41721c]
fild dword [0x43bf50]
fmulp st(1)
call fcn.0040266c
add eax, ebx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 0x38]
mov edx, dword [ebp - 0x34]
call fcn.004041f0
mov ecx, eax
mov eax, ecx
mov ebx, 0x64
xor edx, edx
div ebx
add ecx, edx
mov eax, ecx
mov ecx, 0x64
xor edx, edx
div ecx
mov dword [ebp - 0x2c], eax
mov eax, dword [0x42b9a8]
mov ecx, 0xa
xor edx, edx
div ecx
movzx edx, word [0x42b9ac]
mov ecx, edx
xor edx, edx
div ecx
mov dword [ebp - 0x10], eax
movzx eax, word [0x42b9ac]
imul dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x2c]
add eax, esi
add eax, 0xa
imul dword [ebp - 0x14]
add eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
cmp dword [ebp + 8], 0
jne 0x416d9b
push 0x124
mov eax, dword [0x42ba98]
push dword [eax*4 + 0x41a9e0]
lea edx, [ebp - 0x54]
mov eax, dword [ebp - 0x24]
call fcn.00416a74
push dword [ebp - 0x54]
mov eax, dword [0x42ba98]
push dword [eax*4 + 0x41a9e8]
lea eax, [ebp - 0x50]
mov edx, 3
call fcn.00403b14
mov eax, dword [ebp - 0x50]
call fcn.00403c3c
push eax
mov eax, dword [0x41a0a4]
call fcn.00403c3c
mov ecx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
pop edx
call fcn.00408d98
cmp eax, 6
jne 0x4171de
or ebx, 0xffffffff
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00410cf0
test eax, eax
je 0x416dd3
mov eax, dword [ebp - 8]
push eax
call sub.imagehlp.dll_MakeSureDirectoryPathExists
push 0
push 0x8000080
push 2
push 0
push 1
push 0x40000000
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_CreateFileA_1
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x416dea
mov edx, 0xfc
mov eax, dword [ebp - 4]
call fcn.0041334c
jmp 0x4171de
mov edi, dword [0x42ba98]
push dword [edi*4 + 0x41af14]
push dword [edi*4 + 0x41af64]
push dword [edi*4 + 0x41af1c]
push dword [edi*4 + 0x41af0c]
push dword [0x41a0a4]
lea eax, [ebp - 0x58]
mov edx, 5
call fcn.00403b14
mov eax, dword [ebp - 0x58]
call fcn.00403c3c
mov edx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
call fcn.00408e00
push 0x43bf7c
call sub.kernel32.dll_EnterCriticalSection_1
xor eax, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x40], 0x46464952
push 0
lea eax, [ebp - 0x24]
push eax
push 8
lea eax, [ebp - 0x40]
push eax
push ebx
call sub.kernel32.dll_WriteFile_1
mov dword [ebp - 0x40], 0x45564157
push 0
lea eax, [ebp - 0x24]
push eax
push 4
lea eax, [ebp - 0x40]
push eax
push ebx
call sub.kernel32.dll_WriteFile_1
mov dword [ebp - 0x40], 0x20746d66
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x3c], eax
push 0
lea eax, [ebp - 0x24]
push eax
push 8
lea eax, [ebp - 0x40]
push eax
push ebx
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [ebp - 0x24]
push eax
mov eax, dword [ebp - 0x18]
push eax
push 0x42b9a0
push ebx
call sub.kernel32.dll_WriteFile_1
mov dword [ebp - 0x40], 0x61746164
push 0
lea eax, [ebp - 0x24]
push eax
push 8
lea eax, [ebp - 0x40]
push eax
push ebx
call sub.kernel32.dll_WriteFile_1
mov eax, dword [ebp - 0x14]
call fcn.004024ec
mov edi, eax
cmp dword [0x43bea8], 1
jne 0x416ee6
push 0x80
mov eax, dword [ebp - 0x14]
push eax
push edi
call sub.kernel32.dll_RtlFillMemory
jmp 0x416ef0
mov eax, dword [ebp - 0x14]
push eax
push edi
call sub.kernel32.dll_RtlZeroMemory
test esi, esi
je 0x416f19
dec esi
test esi, esi
jl 0x416f19
inc esi
mov dword [ebp - 0x44], esi
push 0
lea eax, [ebp - 0x24]
push eax
mov eax, dword [ebp - 0x14]
push eax
push edi
push ebx
call sub.kernel32.dll_WriteFile_1
mov eax, dword [ebp - 0x14]
add dword [ebp - 0x1c], eax
dec dword [ebp - 0x44]
jne 0x416efd
mov dword [ebp - 0x28], 0xffffffff
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
cmp dword [0x43bf74], 0
jl 0x416f44
mov eax, dword [0x43bf00]
and eax, 0xff
test eax, eax
jne 0x416f44
xor eax, eax
mov dword [ebp - 0x24], eax
jmp 0x416f4b
mov dword [ebp - 0x24], 1
mov eax, dword [ebp - 0x2c]
dec eax
test eax, eax
jl 0x41709f
inc eax
mov dword [ebp - 0x44], eax
xor esi, esi
mov eax, dword [0x41b72c]
xor edx, edx
mov dword [eax], edx
mov eax, dword [0x41b730]
xor edx, edx
mov dword [eax], edx
push 1
mov eax, dword [ebp - 0x10]
push eax
push edi
call dword [0x41b738]
cmp dword [ebp - 0x24], 0
jne 0x416fa9
mov eax, dword [0x41b72c]
fld dword [eax]
fcomp dword [0x417220]
fnstsw ax
sahf
jae 0x416fa6
mov eax, dword [0x41b730]
fld dword [eax]
fcomp dword [0x417220]
fnstsw ax
sahf
jb 0x416fa9
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0
je 0x416ff0
push 0
lea eax, [ebp - 0x24]
push eax
mov eax, dword [ebp - 0x14]
push eax
push edi
push ebx
call sub.kernel32.dll_WriteFile_1
mov eax, dword [ebp - 0x14]
add dword [ebp - 0x1c], eax
mov eax, dword [0x41b72c]
fld dword [eax]
fcomp dword [0x417220]
fnstsw ax
sahf
jae 0x416fea
mov eax, dword [0x41b730]
fld dword [eax]
fcomp dword [0x417220]
fnstsw ax
sahf
jb 0x416ff0
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
lea eax, [esi + 1]
mov dword [ebp - 0x5c], eax
fild dword [ebp - 0x5c]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x4c], eax
xor eax, eax
mov dword [ebp - 0x48], eax
fild qword [ebp - 0x4c]
fdivp st(1)
fmul dword [0x417224]
call fcn.00402678
mov ecx, eax
add ecx, ecx
lea ecx, [ecx + ecx*4]
cmp ecx, dword [ebp - 0x28]
je 0x417095
mov dword [ebp - 0x28], ecx
mov eax, dword [0x42ba98]
push dword [eax*4 + 0x41af14]
mov eax, dword [0x42ba98]
push dword [eax*4 + 0x41af64]
lea edx, [ebp - 0x64]
mov eax, dword [ebp - 0x28]
call fcn.0040712c
push dword [ebp - 0x64]
mov eax, dword [0x42ba98]
push dword [eax*4 + 0x41af6c]
mov eax, dword [0x42ba98]
push dword [eax*4 + 0x41af1c]
mov eax, dword [0x42ba98]
push dword [eax*4 + 0x41af0c]
push dword [0x41a0a4]
lea eax, [ebp - 0x60]
mov edx, 7
call fcn.00403b14
mov eax, dword [ebp - 0x60]
call fcn.00403c3c
mov edx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
call fcn.00408e00
inc esi
dec dword [ebp - 0x44]
jne 0x416f5d
cmp dword [0x43bea8], 1
jne 0x4170b9
push 0x80
mov eax, dword [ebp - 0x14]
push eax
push edi
call sub.kernel32.dll_RtlFillMemory
jmp 0x4170c3
mov eax, dword [ebp - 0x14]
push eax
push edi
call sub.kernel32.dll_RtlZeroMemory
mov esi, 0xa
push 0
lea eax, [ebp - 0x24]
push eax
mov eax, dword [ebp - 0x14]
push eax
push edi
push ebx
call sub.kernel32.dll_WriteFile_1
mov eax, dword [ebp - 0x14]
add dword [ebp - 0x20], eax
dec esi
jne 0x4170c8
mov edx, dword [ebp - 0x14]
mov eax, edi
call fcn.0040250c
xor eax, eax
mov dword [ebp - 0x14], eax
push 0
lea eax, [ebp - 0x14]
push eax
push 4
push ebx
call sub.kernel32.dll_SetFilePointer_1
mov eax, dword [ebp - 0x20]
sub eax, 8
mov dword [ebp - 0x1c], eax
push 0
lea eax, [ebp - 0x24]
push eax
push 4
lea eax, [ebp - 0x1c]
push eax
push ebx
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x18]
add eax, 0x18
push eax
push ebx
call sub.kernel32.dll_SetFilePointer_1
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 0x18]
sub eax, 0x1c
mov dword [ebp - 0x1c], eax
push 0
lea eax, [ebp - 0x24]
push eax
push 4
lea eax, [ebp - 0x1c]
push eax
push ebx
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x20]
push eax
push ebx
call sub.kernel32.dll_SetFilePointer_1
push ebx
call sub.kernel32.dll_SetEndOfFile_1
push ebx
call sub.kernel32.dll_CloseHandle_1
push 0x43bf7c
call sub.kernel32.dll_LeaveCriticalSection_1
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.00415dec
cmp dword [ebp + 8], 0
jne 0x4171d7
push 0x40
mov eax, dword [0x42ba98]
push dword [eax*4 + 0x41a9f0]
lea edx, [ebp - 0x6c]
mov eax, dword [ebp - 0x20]
call fcn.00416a74
push dword [ebp - 0x6c]
mov eax, dword [0x42ba98]
push dword [eax*4 + 0x41a9f8]
lea eax, [ebp - 0x68]
mov edx, 3
call fcn.00403b14
mov eax, dword [ebp - 0x68]
call fcn.00403c3c
push eax
mov eax, dword [0x41a0a4]
call fcn.00403c3c
mov ecx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
pop edx
call fcn.00408d98
mov dword [ebp - 0xc], 0xffffffff
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41720d
lea eax, [ebp - 0x6c]
mov edx, 4
call fcn.004038f4
lea eax, [ebp - 0x58]
mov edx, 3
call fcn.004038f4
ret