Function at 0x47ec80
Capabilities:
Contain obfuscated stackstrings
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7ac
mov eax, dword [0x5c0290]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, ecx
cmp esi, 3
je 0x47f5b4
cmp esi, 2
je 0x47ecc9
cmp esi, 1
je 0x47ecc9
mov eax, 0x10000
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0053d3a0
mov esp, ebp
pop ebp
ret 0x10
cmp dword [edi + 4], 0xffffffff
je 0x47ecd9
push dword [edi]
call fcn.0047bfb0
add esp, 4
mov eax, dword [edi]
mov ecx, dword [ebp + 8]
mov dword [edi + 4], 0xffffffff
cmp ecx, dword [eax + 4]
jge 0x47ecb1
cmp ecx, dword [eax + 0x10]
jge 0x47ecfb
push eax
call fcn.0047bf60
mov ecx, dword [ebp + 8]
add esp, 4
mov eax, dword [edi]
cmp dword [eax + 0x10], ecx
jge 0x47ed5d
mov esi, dword [edi]
test esi, esi
je 0x47ed53
cmp dword [esi + 0x18], 0
je 0x47ed53
mov edx, dword [esi + 0x10]
inc edx
cmp edx, dword [esi + 4]
je 0x47ed53
mov ecx, dword [esi + 0x50]
mov eax, dword [esi + 0x48]
add ecx, dword [esi + 0x4c]
add eax, 0x2e
push 0
push 0
push 0
push 0
add eax, ecx
mov dword [esi + 0x10], edx
add dword [esi + 0x14], eax
lea eax, [esi + 0x78]
push 0
push 0
push eax
lea eax, [esi + 0x28]
push eax
push esi
call fcn.0047c300
mov ecx, dword [ebp + 8]
add esp, 0x24
neg eax
sbb eax, eax
inc eax
mov dword [esi + 0x18], eax
mov eax, dword [edi]
cmp dword [eax + 0x10], ecx
jl 0x47ed02
mov esi, dword [ebp + 0x14]
lea eax, [ebp - 0x648]
push eax
push ecx
mov ecx, edi
call fcn.0047d200
mov eax, dword [ebp - 0x43c]
shr eax, 4
test al, 1
je 0x47eddc
cmp esi, 1
je 0x47edc7
movzx eax, word [ebx]
cmp eax, 0x2f
je 0x47edbc
cmp eax, 0x5c
je 0x47edbc
test ax, ax
je 0x47ed97
cmp word [ebx + 2], 0x3a
je 0x47edbc
lea eax, [edi + 0x244]
push ebx
push eax
call fcn.0047f760
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0053d3a0
mov esp, ebp
pop ebp
ret 0x10
push ebx
push 0
call fcn.0047f760
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0053d3a0
mov esp, ebp
pop ebp
ret 0x10
xor eax, eax
mov word [ebp - 0x414], ax
cmp esi, 1
je 0x47f4b7
movzx eax, word [ebx]
mov esi, ebx
mov dword [ebp - 0x418], ebx
mov ecx, ebx
test ax, ax
je 0x47ee21
cmp ax, 0x2f
je 0x47ee0c
cmp ax, 0x5c
jne 0x47ee0f
lea esi, [ecx + 2]
movzx eax, word [ecx + 2]
add ecx, 2
test ax, ax
jne 0x47ee00
mov dword [ebp - 0x418], esi
push 0x104
push ebx
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.0053e297
add esp, 0x10
cmp esi, ebx
jne 0x47ee4a
xor eax, eax
mov word [ebp - 0x20c], ax
jmp 0x47ee94
mov eax, esi
sub eax, ebx
and eax, 0xfffffffe
cmp eax, 0x208
jae 0x47f690
xor ecx, ecx
mov word [ebp + eax - 0x20c], cx
mov ax, word [ebp - 0x20c]
cmp ax, 0x2f
je 0x47f0cd
cmp ax, 0x5c
je 0x47f0cd
test ax, ax
je 0x47ee94
cmp word [ebp - 0x20a], 0x3a
je 0x47f0cd
push dword [ebp - 0x418]
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x700], 0x785a4359
push eax
lea esi, [edi + 0x244]
mov dword [ebp - 0x6fc], 0x79674749
push esi
push 0
sub esp, 0xc
mov dword [ebp - 0x6f8], 0x2f41785a
mov ecx, esp
mov dword [ebp - 0x6f4], 0x46386949
lea eax, [ebp - 0x649]
mov dword [ebp - 0x6f0], 0x4e6f784e
lea edx, [ebp - 0x64e]
mov dword [ebp - 0x6ec], 0x7677694e
push eax
push edx
lea ebx, [ebp - 0x700]
mov dword [ebp - 0x6e8], 0x364d6742
push ebx
mov dword [ebp - 0x6e4], 0x6845774e
mov dword [ebp - 0x6e0], 0x6a6c5766
mov dword [ebp - 0x6dc], 0x51733363
mov dword [ebp - 0x6d8], 0x75517744
mov dword [ebp - 0x6d4], 0x37734142
mov dword [ebp - 0x6d0], 0x31387a41
mov dword [ebp - 0x6cc], 0x49455349
mov dword [ebp - 0x6c8], 0x4e557866
mov dword [ebp - 0x6c4], 0x76347843
mov dword [ebp - 0x6c0], 0x3851414c
mov dword [ebp - 0x6bc], 0x4f515348
mov dword [ebp - 0x6b8], 0x7167474d
mov dword [ebp - 0x6b4], 0x37594349
mov dword [ebp - 0x6b0], 0x74646a47
mov dword [ebp - 0x6ac], 0x71514850
mov dword [ebp - 0x6a8], 0x71636d4c
mov dword [ebp - 0x6a4], 0x73345149
mov dword [ebp - 0x6a0], 0x78637847
mov dword [ebp - 0x69c], 0x54734849
mov dword [ebp - 0x698], 0x35706743
mov dword [ebp - 0x694], 0x4441774f
mov dword [ebp - 0x690], 0x41344349
mov dword [ebp - 0x68c], 0x75515349
mov dword [ebp - 0x688], 0x6751534b
mov dword [ebp - 0x684], 0x4a51774f
mov dword [ebp - 0x680], 0x4c597763
mov dword [ebp - 0x67c], 0x704d4459
mov dword [ebp - 0x678], 0x5a735866
mov dword [ebp - 0x674], 0x42554145
mov dword [ebp - 0x670], 0x5063684a
mov dword [ebp - 0x66c], 0x43456a4c
mov dword [ebp - 0x668], 0x6b685441
mov dword [ebp - 0x664], 0x6b63774c
mov dword [ebp - 0x660], 0x355a6a49
mov dword [ebp - 0x65c], 0x586b5142
mov dword [ebp - 0x658], 0x61557842
mov dword [ebp - 0x654], 0x41414141
mov word [ebp - 0x650], 0x7765
call fcn.004676d0
lea eax, [ebp - 0x7ac]
push eax
call fcn.0046f3e0
add esp, 0x10
mov ecx, eax
call fcn.0046bf80
push eax
lea eax, [ebp - 0x414]
push 0x104
push eax
call fcn.0046e770
add esp, 0x18
lea ecx, [ebp - 0x7ac]
call fcn.00467b80
lea eax, [ebp - 0x20c]
push eax
push esi
jmp 0x47f48d
mov dword [ebp - 0x7a0], 0x785a4359
mov dword [ebp - 0x79c], 0x76304449
mov dword [ebp - 0x798], 0x54735242
mov dword [ebp - 0x794], 0x65387859
mov dword [ebp - 0x790], 0x676f5448
mov dword [ebp - 0x78c], 0x4e6b6e46
mov dword [ebp - 0x788], 0x6f305842
mov dword [ebp - 0x784], 0x45556843
mov dword [ebp - 0x780], 0x2f355448
mov dword [ebp - 0x77c], 0x42307845
mov dword [ebp - 0x778], 0x77677842
mov dword [ebp - 0x774], 0x30776848
mov dword [ebp - 0x770], 0x44735750
mov dword [ebp - 0x76c], 0x6a63684b
mov dword [ebp - 0x768], 0x66385242
mov dword [ebp - 0x764], 0x47516942
mov dword [ebp - 0x760], 0x764d7841
mov dword [ebp - 0x75c], 0x59636943
mov dword [ebp - 0x758], 0x636f5747
mov dword [ebp - 0x754], 0x534d434c
mov dword [ebp - 0x750], 0x7377534e
mov dword [ebp - 0x74c], 0x6b6b6e4e
mov dword [ebp - 0x748], 0x6467684c
mov dword [ebp - 0x744], 0x74456848
mov dword [ebp - 0x740], 0x5a63484a
mov dword [ebp - 0x73c], 0x7538414a
mov dword [ebp - 0x738], 0x546f6946
mov dword [ebp - 0x734], 0x62417947
mov dword [ebp - 0x730], 0x43345245
mov dword [ebp - 0x72c], 0x4173694f
mov dword [ebp - 0x728], 0x4d737a63
mov dword [ebp - 0x724], 0x4f51674b
mov dword [ebp - 0x720], 0x70515347
mov dword [ebp - 0x71c], 0x72594448
mov dword [ebp - 0x718], 0x68596e66
mov dword [ebp - 0x714], 0x45676943
mov dword [ebp - 0x710], 0x31646a46
mov dword [ebp - 0x70c], 0x6d52674e
mov dword [ebp - 0x708], 0x6b77524a
mov dword [ebp - 0x704], 0x7a6c5844
mov dword [ebp - 0x700], 0x68455245
mov dword [ebp - 0x6fc], 0x6d416d4f
mov dword [ebp - 0x6f8], 0x47517865
mov dword [ebp - 0x6f4], 0x69386a4e
mov dword [ebp - 0x6f0], 0x76455348
mov dword [ebp - 0x6ec], 0x3264534d
mov dword [ebp - 0x6e8], 0x70414163
mov dword [ebp - 0x6e4], 0x37356a47
mov dword [ebp - 0x6e0], 0x6b687942
mov dword [ebp - 0x6dc], 0x78345448
mov dword [ebp - 0x6d8], 0x35517742
mov dword [ebp - 0x6d4], 0x75306859
mov dword [ebp - 0x6d0], 0x384a4345
mov dword [ebp - 0x6cc], 0x4f347a44
mov dword [ebp - 0x6c8], 0x4251674b
mov dword [ebp - 0x6c4], 0x3168484a
mov dword [ebp - 0x6c0], 0x34597745
mov dword [ebp - 0x6bc], 0x34416d42
mov dword [ebp - 0x6b8], 0x65774144
mov dword [ebp - 0x6b4], 0x42635145
mov dword [ebp - 0x6b0], 0x33777744
mov dword [ebp - 0x6ac], 0x54636761
mov dword [ebp - 0x6a8], 0x354e4744
mov dword [ebp - 0x6a4], 0x7942794d
mov dword [ebp - 0x6a0], 0x6963444e
mov dword [ebp - 0x69c], 0x39785163
mov dword [ebp - 0x698], 0x41414349
mov dword [ebp - 0x694], 0x54497948
mov dword [ebp - 0x690], 0x69416d41
mov dword [ebp - 0x68c], 0x51635346
mov dword [ebp - 0x688], 0x79555163
mov dword [ebp - 0x684], 0x6d777a4f
mov dword [ebp - 0x680], 0x6a553266
mov dword [ebp - 0x67c], 0x48414347
mov dword [ebp - 0x678], 0x2b457966
mov dword [ebp - 0x674], 0x58494263
mov dword [ebp - 0x670], 0x44414849
mov dword [ebp - 0x66c], 0x7a34674f
mov dword [ebp - 0x668], 0x6f41534d
mov dword [ebp - 0x664], 0x4d385446
mov dword [ebp - 0x660], 0x6946534b
push esi
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x65c], 0x306c774b
push eax
push 0
sub esp, 0xc
mov dword [ebp - 0x658], 0x366c434f
mov ecx, esp
mov dword [ebp - 0x654], 0x4141674a
lea eax, [ebp - 0x649]
mov word [ebp - 0x650], 0x5041
lea edx, [ebp - 0x64d]
mov byte [ebp - 0x64e], 0x59
push eax
push edx
lea ebx, [ebp - 0x7a0]
push ebx
call fcn.004676d0
lea eax, [ebp - 0x7ac]
push eax
call fcn.0046f3e0
add esp, 0x10
mov ecx, eax
call fcn.0046bf80
push eax
lea eax, [ebp - 0x414]
push 0x104
push eax
call fcn.0046e770
add esp, 0x14
lea ecx, [ebp - 0x7ac]
call fcn.00467b80
lea eax, [ebp - 0x20c]
push eax
push 0
call fcn.0047f760
add esp, 8
lea eax, [ebp - 0x414]
push 0
push dword [ebp - 0x43c]
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x47f4d4
mov eax, 0x200
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0053d3a0
mov esp, ebp
pop ebp
ret 0x10
push dword [edi + 0x23c]
push dword [edi]
call fcn.0047ccc0
add esp, 8
cmp dword [edi + 0x240], 0
jne 0x47f500
push 0x4000
call fcn.0053ac46
add esp, 4
mov dword [edi + 0x240], eax
lea eax, [ebp - 0x649]
push eax
push 0x4000
push dword [edi + 0x240]
push dword [edi]
call fcn.0047ce50
mov esi, eax
add esp, 0x10
cmp esi, 0xffffff96
je 0x47f55f
test esi, esi
js 0x47f551
jle 0x47f544
push 0
lea eax, [ebp - 0x418]
push eax
push esi
push dword [edi + 0x240]
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x47f558
cmp byte [ebp - 0x649], 0
jne 0x47f566
test esi, esi
jne 0x47f500
mov esi, 0x5000000
jmp 0x47f568
mov esi, 0x400
jmp 0x47f568
mov esi, 0x1000
jmp 0x47f568
xor esi, esi
push dword [edi]
call fcn.0047bfb0
add esp, 4
test esi, esi
jne 0x47f592
lea eax, [ebp - 0x428]
push eax
lea eax, [ebp - 0x438]
push eax
lea eax, [ebp - 0x430]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileTime]
cmp dword [ebp + 0x14], 1
je 0x47f59f
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0053d3a0
mov esp, ebp
pop ebp
ret 0x10
mov eax, dword [edi + 4]
mov esi, dword [ebp + 8]
cmp esi, eax
je 0x47f618
cmp eax, 0xffffffff
je 0x47f5cd
push dword [edi]
call fcn.0047bfb0
add esp, 4
mov eax, dword [edi]
mov dword [edi + 4], 0xffffffff
cmp esi, dword [eax + 4]
jge 0x47ecb1
cmp esi, dword [eax + 0x10]
jge 0x47f5ed
push eax
call fcn.0047bf60
add esp, 4
mov eax, dword [edi]
cmp dword [eax + 0x10], esi
jge 0x47f605
push dword [edi]
call fcn.0047c860
mov eax, dword [edi]
add esp, 4
cmp dword [eax + 0x10], esi
jl 0x47f5f4
push dword [edi + 0x23c]
push dword [edi]
call fcn.0047ccc0
add esp, 8
mov dword [edi + 4], esi
lea eax, [ebp - 0x649]
push eax
push dword [ebp + 0x10]
push ebx
push dword [edi]
call fcn.0047ce50
mov esi, eax
add esp, 0x10
test esi, esi
jg 0x47f644
push dword [edi]
call fcn.0047bfb0
add esp, 4
mov dword [edi + 4], 0xffffffff
cmp byte [ebp - 0x649], 0
jne 0x47edc7
test esi, esi
jle 0x47f66d
mov eax, 0x600
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0053d3a0
mov esp, ebp
pop ebp
ret 0x10
cmp esi, 0xffffff96
mov ecx, 0x1000
mov eax, 0x5000000
cmove eax, ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0053d3a0
mov esp, ebp
pop ebp
ret 0x10
call fcn.0053c4d0
int3