Function at 0x412c40
Capabilities:
Contain obfuscated stackstrings
Write file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x20c
mov al, byte [0x54c322]
mov byte [esp + 0x10c], al
lea eax, [esp + 0x10d]
push esi
push 0xff
push 0
push eax
call sub.msvcrt.dll_memset
mov al, byte [0x54c322]
mov byte [esp + 0x1c], al
lea eax, [esp + 0x1d]
add esp, 0xc
push 0xff
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
push 0
push 0x54c71b
lea esi, [esp + 0x118]
push esi
call fcn.004bca30
pop ecx
pop ebx
push 2
mov ebx, esi
lea ebp, [esp + 0x18]
push ebp
call fcn.004bc3f0
pop eax
pop edx
push ebp
push esi
call sub.msvcrt.dll_strcat
mov eax, dword [ebx]
add ebx, 4
lea edx, [eax - 0x1010101]
xor eax, 0xffffffff
and edx, eax
and edx, 0x80808080
je 0x412cb8
test edx, 0x8080
je 0x41317b
mov edi, dword [0x5b40d8]
add dl, dl
mov eax, edi
mov edx, 0x66666667
sbb ebx, 3
mov ecx, edi
imul edx
sar ecx, 0x1f
sub ebx, esi
sar edx, 2
sub edx, ecx
lea ecx, [edx + 0x30]
lea edx, [edx + edx*4]
add edx, edx
mov byte [esp + ebx + 0x11a], cl
sub edi, edx
lea eax, [edi + 0x30]
mov byte [esp + ebx + 0x11b], al
pop edi
pop eax
push 0x54c733
push esi
call sub.msvcrt.dll_fopen
mov dword [esp + 0x18], eax
add esp, 0x10
xor eax, eax
mov esi, dword [esp + 8]
test esi, esi
je 0x413170
mov ebx, dword [esp + 8]
mov dword [esp + 0xc], 0x64696f76
mov dword [esp + 0x10], 0x69616d20
mov dword [esp + 0x14], 0x2029286e
mov word [esp + 0x18], 0xa7b
mov byte [esp + 0x1a], 0
mov ecx, ebp
push ebx
push 1
mov eax, dword [ecx]
add ecx, 4
lea edx, [eax - 0x1010101]
xor eax, 0xffffffff
and edx, eax
and edx, 0x80808080
je 0x412d66
test edx, 0x8080
je 0x413186
add dl, dl
sbb ecx, 3
sub ecx, ebp
push ecx
push ebp
call sub.msvcrt.dll_fwrite
mov ecx, dword [0x545de0]
add esp, 0x10
test ecx, ecx
js 0x412f50
xor edi, edi
jmp 0x412dbd
inc edi
cmp dword [0x545de0], edi
jl 0x412f50
lea esi, [edi*4]
mov eax, dword [0x5b4a20]
mov eax, dword [eax + esi]
mov edx, dword [eax + 0x24]
test edx, edx
jne 0x412db0
cmp byte [eax + 0xc], 0
je 0x412db0
mov eax, dword [eax + 8]
test eax, eax
je 0x412db0
cmp eax, 5
je 0x412db0
mov eax, dword [esp + 8]
mov dword [esp + 0xc], 0x74657309
mov dword [esp + 0x10], 0x626f6c67
mov dword [esp + 0x14], 0x61766c61
mov dword [esp + 0x18], 0x222872
mov ecx, ebp
push eax
push 1
mov eax, dword [ecx]
add ecx, 4
lea edx, [eax - 0x1010101]
xor eax, 0xffffffff
and edx, eax
and edx, 0x80808080
je 0x412e0e
test edx, 0x8080
je 0x413191
add dl, dl
sbb ecx, 3
sub ecx, ebp
push ecx
push ebp
call sub.msvcrt.dll_fwrite
mov eax, dword [0x5b4a20]
mov ebx, dword [eax + esi]
mov eax, dword [esp + 0x18]
add ebx, 0xc
push eax
push 1
push eax
push ebx
call sub.msvcrt.dll_strlen
pop edx
pop ecx
push eax
push ebx
call sub.msvcrt.dll_fwrite
mov word [esp + 0x2c], 0x2c22
mov byte [esp + 0x2e], 0
add esp, 0x20
mov ecx, ebp
mov eax, dword [esp + 8]
push eax
push 1
mov eax, dword [ecx]
add ecx, 4
lea edx, [eax - 0x1010101]
xor eax, 0xffffffff
and edx, eax
and edx, 0x80808080
je 0x412e7a
test edx, 0x8080
jne 0x412ea0
shr edx, 0x10
add ecx, 2
add dl, dl
sbb ecx, 3
sub ecx, ebp
push ecx
push ebp
call sub.msvcrt.dll_fwrite
mov eax, dword [0x5b4a20]
mov edx, ebp
mov eax, dword [eax + esi]
call fcn.00412b00
mov eax, dword [esp + 0x18]
push eax
mov ecx, ebp
push 1
mov eax, dword [ecx]
add ecx, 4
lea edx, [eax - 0x1010101]
xor eax, 0xffffffff
and edx, eax
and edx, 0x80808080
je 0x412ec6
test edx, 0x8080
jne 0x412eec
shr edx, 0x10
add ecx, 2
add dl, dl
sbb ecx, 3
sub ecx, ebp
push ecx
push ebp
call sub.msvcrt.dll_fwrite
mov dword [esp + 0x2c], 0xa3b29
add esp, 0x20
mov ecx, ebp
mov eax, dword [esp + 8]
push eax
push 1
mov eax, dword [ecx]
add ecx, 4
lea edx, [eax - 0x1010101]
xor eax, 0xffffffff
and edx, eax
and edx, 0x80808080
je 0x412f0e
test edx, 0x8080
jne 0x412f34
shr edx, 0x10
add ecx, 2
add dl, dl
sbb ecx, 3
sub ecx, ebp
push ecx
push ebp
call sub.msvcrt.dll_fwrite
add esp, 0x10
jmp 0x412db0
mov eax, dword [0x5b4a2c]
test eax, eax
jle 0x413114
xor ebx, ebx
xor esi, esi
mov eax, dword [0x5b4a28]
mov eax, dword [eax + esi + 8]
cmp eax, 5
je 0x413104
test eax, eax
je 0x413104
mov eax, dword [esp + 8]
mov dword [esp + 0xc], 0x74657309
mov dword [esp + 0x10], 0x65646e69
mov dword [esp + 0x14], 0x76646578
mov dword [esp + 0x18], 0x287261
mov ecx, ebp
push eax
push 1
mov eax, dword [ecx]
add ecx, 4
lea edx, [eax - 0x1010101]
xor eax, 0xffffffff
and edx, eax
and edx, 0x80808080
je 0x412fa4
test edx, 0x8080
jne 0x412fca
shr edx, 0x10
add ecx, 2
add dl, dl
sbb ecx, 3
sub ecx, ebp
push ecx
push ebp
call sub.msvcrt.dll_fwrite
add esp, 0xc
push ebx
push 0x54c73e
push ebp
call sub.msvcrt.dll_sprintf
mov edi, dword [esp + 0x18]
mov ecx, ebp
push edi
push 1
mov eax, dword [ecx]
add ecx, 4
lea edx, [eax - 0x1010101]
xor eax, 0xffffffff
and edx, eax
and edx, 0x80808080
je 0x412ff0
test edx, 0x8080
jne 0x413016
shr edx, 0x10
add ecx, 2
add dl, dl
sbb ecx, 3
sub ecx, ebp
push ecx
push ebp
call sub.msvcrt.dll_fwrite
mov word [esp + 0x2c], 0x2c
add esp, 0x20
mov ecx, dword [esp + 8]
push ecx
mov ecx, ebp
push 1
mov eax, dword [ecx]
add ecx, 4
lea edx, [eax - 0x1010101]
xor eax, 0xffffffff
and edx, eax
and edx, 0x80808080
je 0x413037
test edx, 0x8080
jne 0x41305d
shr edx, 0x10
add ecx, 2
add dl, dl
sbb ecx, 3
sub ecx, ebp
push ecx
push ebp
call sub.msvcrt.dll_fwrite
mov edx, dword [0x5b4a28]
mov eax, esi
add eax, edx
mov edx, ebp
call fcn.00412b00
mov eax, dword [esp + 0x18]
push eax
mov ecx, ebp
push 1
mov eax, dword [ecx]
add ecx, 4
lea edx, [eax - 0x1010101]
xor eax, 0xffffffff
and edx, eax
and edx, 0x80808080
je 0x413085
test edx, 0x8080
jne 0x4130ab
shr edx, 0x10
add ecx, 2
add dl, dl
sbb ecx, 3
sub ecx, ebp
push ecx
push ebp
call sub.msvcrt.dll_fwrite
mov dword [esp + 0x2c], 0xa3b29
add esp, 0x20
mov ecx, ebp
mov eax, dword [esp + 8]
push eax
push 1
mov eax, dword [ecx]
add ecx, 4
lea edx, [eax - 0x1010101]
xor eax, 0xffffffff
and edx, eax
and edx, 0x80808080
je 0x4130cd
test edx, 0x8080
jne 0x4130f3
shr edx, 0x10
add ecx, 2
add dl, dl
sbb ecx, 3
sub ecx, ebp
push ecx
push ebp
call sub.msvcrt.dll_fwrite
add esp, 0x10
inc ebx
add esi, 0xc
cmp dword [0x5b4a2c], ebx
jg 0x412f61
mov edi, dword [esp + 8]
mov word [esp + 0xc], 0xa7d
mov byte [esp + 0xe], 0
mov ecx, ebp
push edi
push 1
mov eax, dword [ecx]
add ecx, 4
lea edx, [eax - 0x1010101]
xor eax, 0xffffffff
and edx, eax
and edx, 0x80808080
je 0x413129
test edx, 0x8080
jne 0x41314f
shr edx, 0x10
add ecx, 2
add dl, dl
sbb ecx, 3
sub ecx, ebp
push ecx
push ebp
call sub.msvcrt.dll_fwrite
pop esi
mov ebx, dword [esp + 0x14]
push ebx
call sub.msvcrt.dll_fclose
mov eax, 1
add esp, 0x10
add esp, 0x20c
pop ebx
pop esi
pop edi
pop ebp
ret
shr edx, 0x10
add ebx, 2
jmp 0x412cdc
shr edx, 0x10
add ecx, 2
jmp 0x412d8a
shr edx, 0x10
add ecx, 2
jmp 0x412e32