Function at 0x412b40
Capabilities:
Encrypt or decrypt via wincrypt
Read file on windows
Write file on windows

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49d69d
mov eax, dword fs:[0]
push eax
push ecx
push ebx
sub esp, 0x170
mov eax, dword [0x4dc100]
xor eax, ebp
mov dword [ebp - 0x1c], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 0xc0], esi
mov edi, dword [ebx + 8]
push edi
mov dword [ebp - 0xd4], esi
mov dword [ebp - 0xc8], edi
call fcn.00411fc0
test al, al
jne 0x412bae
push edi
mov ecx, esi
call fcn.004120c0
mov edx, dword [esi + 0x28]
lea eax, [edi + 0x10]
lea ecx, [esi + 0x18]
mov dword [ebp - 0xdc], eax
mov esi, dword [eax]
mov eax, accept
sub eax, edx
cmp eax, esi
jb 0x413cfd
cmp dword [ecx + 0x14], 0xf
jbe 0x412bd6
mov ecx, dword [ecx]
cmp dword [edi + 0x14], 0xf
mov eax, edi
jbe 0x412be0
mov eax, dword [edi]
push esi
push eax
push edx
push ecx
push ecx
push dword [ebp - 0xd4]
lea ecx, [ebp - 0x10c]
call fcn.0040a900
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x10c]
mov esi, dword [ebp - 0xf8]
mov eax, esi
mov edx, dword [ebp - 0xfc]
sub eax, edx
cmp eax, 1
jb 0x412c40
cmp esi, 0xf
lea eax, [edx + 1]
mov dword [ebp - 0xfc], eax
cmova ecx, dword [ebp - 0x10c]
mov al, byte [0x4d1398]
mov byte [ecx + edx], al
lea eax, [ebp - 0x10c]
mov byte [ecx + edx + 1], 0
jmp 0x412c54
push 1
push 0x4d1398
push dword [ebp - 0xd4]
push 1
call fcn.004094f0
mov dword [ebp - 0x88], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x98], xmm0
mov dword [ebp - 0x84], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x98], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x88], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0xf8]
cmp ecx, 0xf
jbe 0x412cd8
mov edx, dword [ebp - 0x10c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x412cce
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x413d02
push ecx
push edx
call fcn.00474928
add esp, 8
push edi
xor eax, eax
mov dword [ebp - 0xfc], 0
push 8
push 0x4d186c
lea edx, [ebp - 0x98]
mov dword [ebp - 0xf8], 0xf
lea ecx, [ebp - 0x168]
mov byte [ebp - 0x10c], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0xd8], eax
call fcn.00415330
add esp, 0xc
cmp dword [eax + 0x14], 0xf
jbe 0x412d26
mov eax, dword [eax]
push 0
push 0x80
push 4
push 0
push 1
push 3
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ecx, dword [ebp - 0x154]
mov esi, eax
mov dword [ebp - 0xc4], esi
cmp ecx, 0xf
jbe 0x412d7e
mov edx, dword [ebp - 0x168]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x412d74
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x413d07
push ecx
push edx
call fcn.00474928
add esp, 8
push edi
push 8
push 0x4d1878
lea edx, [ebp - 0x98]
mov dword [ebp - 0x158], 0
lea ecx, [ebp - 0x180]
mov dword [ebp - 0x154], 0xf
mov byte [ebp - 0x168], 0
call fcn.00415330
add esp, 0xc
cmp dword [eax + 0x14], 0xf
jbe 0x412dbd
mov eax, dword [eax]
push 0
push 0x80
push 4
push 0
push 1
push 3
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ecx, dword [ebp - 0x16c]
mov dword [ebp - 0xcc], eax
cmp ecx, 0xf
jbe 0x412e19
mov edx, dword [ebp - 0x180]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x412e09
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x413d0c
push ecx
push edx
call fcn.00474928
mov eax, dword [ebp - 0xcc]
add esp, 8
mov dword [ebp - 0x170], 0
mov dword [ebp - 0x16c], 0xf
mov byte [ebp - 0x180], 0
cmp esi, 0xffffffff
je 0x413ccc
cmp eax, 0xffffffff
je 0x413ccc
xorps xmm0, xmm0
movlpd qword [ebp - 0x2c], xmm0
push 0x2c
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0
call fcn.004748f3
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [ebp - 0x2c], eax
push 0
lea eax, [ebp - 0x20]
mov byte [ebp - 4], 3
push eax
push 4
lea eax, [ebp - 0x4c]
mov dword [ebp - 0x4c], 0x30d40
push eax
push esi
mov dword [ebp - 0x20], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, 1
jne 0x413240
cmp dword [ebp - 0x4c], 0x186a0
jae 0x412ebd
push 0
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x412ec8
mov ecx, dword [ebp - 0xc0]
call fcn.00411d70
mov eax, dword [ebp - 0xc0]
push 0
cmp dword [eax + 4], 0
lea eax, [ebp - 0x20]
push eax
push 4
lea eax, [ebp - 0x24]
push eax
push esi
je 0x412f0c
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, 1
jne 0x412f1a
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x24]
push eax
mov eax, dword [ebp - 0xc0]
push 0
push 1
push dword [eax + 0xc]
push dword [eax + 8]
call dword [sym.imp.ADVAPI32.dll_CryptDecrypt]
jmp 0x412f1a
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x413c58
mov eax, dword [ebp - 0x24]
test eax, eax
jne 0x412f56
push eax
push eax
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [ebp - 0x20]
push eax
push 4
lea eax, [ebp - 0x4c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea eax, [ebp - 0x20]
push eax
push 4
lea eax, [ebp - 0x24]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x413240
xor edi, edi
mov dword [ebp - 0xd8], eax
mov dword [ebp - 0x30], edi
test eax, eax
je 0x41323a
nop dword [eax]
mov ecx, dword [ebp - 0xc0]
lea eax, [ebp - 0x20]
push 0
push eax
xor eax, eax
mov dword [ebp - 0xbc], 0
cmp dword [ecx + 4], eax
sete al
lea eax, [eax*2 + 2]
push eax
lea eax, [ebp - 0xbc]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x41323a
mov esi, dword [ebp - 0xbc]
xorps xmm0, xmm0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0
movups xmmword [ebp - 0x48], xmm0
cmp esi, 0x7fffffff
ja 0x413cfd
cmp esi, 0xf
ja 0x412ff8
push esi
lea eax, [ebp - 0x48]
mov dword [ebp - 0x38], esi
push 0
push eax
mov dword [ebp - 0x34], 0xf
call fcn.00476480
mov byte [ebp + esi - 0x48], 0
jmp 0x41308e
mov edi, esi
or edi, 0xf
cmp edi, 0x7fffffff
jbe 0x413019
mov eax, accept
mov dword [ebp - 0xd0], accept
add eax, 0x23
jmp 0x413042
cmp edi, 0x16
mov eax, 0x16
cmovb edi, eax
mov dword [ebp - 0xd0], edi
add edi, 1
je 0x413069
cmp edi, 0x1000
jb 0x41305e
lea eax, [edi + 0x23]
cmp eax, edi
jbe 0x413d11
push eax
call fcn.004748f3
add esp, 4
test eax, eax
je 0x413d16
lea edi, [eax + 0x23]
and edi, 0xffffffe0
mov dword [edi - 4], eax
jmp 0x413069
push edi
call fcn.004748f3
add esp, 4
mov edi, eax
mov eax, dword [ebp - 0xd0]
push esi
push 0
push edi
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x34], eax
call fcn.00476480
mov byte [edi + esi], 0
mov esi, dword [ebp - 0xbc]
mov edi, dword [ebp - 0x30]
add esp, 0xc
push 0
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x20]
cmp dword [ebp - 0x34], 0xf
lea eax, [ebp - 0x48]
push ecx
cmova eax, dword [ebp - 0x48]
push esi
mov esi, dword [ebp - 0xc4]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x413202
push 1
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea edx, [ebp - 0x48]
mov esi, eax
lea ecx, [ebp - 0xf4]
call fcn.00415400
xorps xmm0, xmm0
mov dword [ebp - 0x118], esi
movups xmmword [ebp - 0x130], xmm0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x130], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x120], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
lea eax, [ebp - 0x130]
mov byte [ebp - 4], 6
push eax
lea eax, [ebp - 0x114]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00416640
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x11c]
cmp ecx, 0xf
jbe 0x41316a
mov edx, dword [ebp - 0x130]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x413160
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x413d02
push ecx
push edx
call fcn.00474928
add esp, 8
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0xe0]
cmp ecx, 0xf
jbe 0x4131a8
mov edx, dword [ebp - 0xf4]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x41319e
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x413d02
push ecx
push edx
call fcn.00474928
add esp, 8
mov esi, dword [ebp - 0xc4]
push 1
push 0
push 8
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x34]
cmp ecx, 0xf
jbe 0x4131f3
mov edx, dword [ebp - 0x48]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4131e9
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x413d16
push ecx
push edx
call fcn.00474928
add esp, 8
inc edi
mov dword [ebp - 0x30], edi
cmp edi, dword [ebp - 0x24]
jb 0x412f70
jmp 0x41323a
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x34]
cmp ecx, 0xf
jbe 0x41323a
mov edx, dword [ebp - 0x48]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x413230
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x413d16
push ecx
push edx
call fcn.00474928
add esp, 8
mov edi, dword [ebp - 0xc8]
mov eax, dword [ebp - 0xdc]
mov ecx, accept
mov eax, dword [eax]
sub ecx, eax
cmp ecx, 1
jb 0x413d1b
cmp dword [edi + 0x14], 0xf
jbe 0x413260
mov edi, dword [edi]
push 1
push 0x4d1398
push eax
push edi
push ecx
push dword [ebp - 0xd4]
lea ecx, [ebp - 0xf4]
call fcn.0040a900
mov byte [ebp - 4], 7
lea edx, [ebp - 0xf4]
mov byte [ebp - 0x30], 0
lea ecx, [ebp - 0x64]
push dword [ebp - 0x30]
call fcn.00416790
mov dword [ebp - 0x74], 0
mov dword [ebp - 0x70], 0
lea edx, [ebp - 0x64]
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x74]
call fcn.00415090
add esp, 4
test eax, eax
jne 0x413d20
mov byte [ebp - 4], 0xb
mov ecx, dword [ebp - 0x50]
cmp ecx, 7
jbe 0x4132fa
mov edx, dword [ebp - 0x64]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4132f0
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x413d30
push ecx
push edx
call fcn.00474928
add esp, 8
xor eax, eax
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x50], 7
mov word [ebp - 0x64], ax
mov byte [ebp - 4], 0xc
mov ecx, dword [ebp - 0xe0]
cmp ecx, 0xf
jbe 0x41334c
mov edx, dword [ebp - 0xf4]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x413342
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x413d30
push ecx
push edx
call fcn.00474928
add esp, 8
mov ecx, dword [ebp - 0x70]
xorps xmm0, xmm0
movlpd qword [ebp - 0x80], xmm0
test ecx, ecx
je 0x41335f
lock inc dword [ecx + 4]
mov edi, dword [ebp - 0x74]
mov esi, ecx
mov dword [ebp - 0xbc], edi
mov dword [ebp - 0x80], edi
mov dword [ebp - 0x7c], esi
test ecx, ecx
je 0x413378
lock inc dword [ecx + 4]
xor eax, eax
movlpd qword [ebp - 0x6c], xmm0
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x68], eax
test ecx, ecx
je 0x4133ae
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
jne 0x4133ab
mov eax, dword [ecx]
call dword [eax]
or ecx, 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0x70]
lock xadd dword [ecx + 8], eax
jne 0x4133ab
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x6c]
mov byte [ebp - 4], 0xe
cmp edi, eax
je 0x413b59
mov ecx, edi
call fcn.00410f70
test al, al
jne 0x413b3d
lea eax, [edi + 0x20]
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0xf4]
mov dword [ebp - 0xd0], eax
push ecx
mov ecx, eax
call fcn.00410f00
push ecx
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 0x10
push ecx
mov ecx, eax
call fcn.0040dac0
mov byte [ebp - 4], 0xf
mov ecx, dword [ebp - 0xe0]
cmp ecx, 7
jbe 0x413438
mov edx, dword [ebp - 0xf4]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x41342e
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x413d35
push ecx
push edx
call fcn.00474928
add esp, 8
mov edi, dword [ebp - 0x50]
lea eax, [ebp - 0x64]
mov esi, dword [ebp - 0x64]
lea ecx, [ebp - 0x138]
cmp edi, 0xf
push str..hdr
cmova eax, esi
mov dword [ebp - 0x138], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x134], eax
call fcn.004141a0
test al, al
jne 0x413ad5
cmp edi, 0xf
lea eax, [ebp - 0x64]
push str..src
cmova eax, esi
lea ecx, [ebp - 0x114]
mov dword [ebp - 0x114], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x110], eax
call fcn.004141a0
test al, al
jne 0x413ad5
cmp edi, 0xf
jbe 0x4134cc
inc edi
mov eax, esi
cmp edi, 0x1000
jb 0x4134c2
mov esi, dword [eax - 4]
add edi, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x413d58
push edi
push esi
call fcn.00474928
add esp, 8
mov esi, dword [ebp - 0xd0]
lea eax, [ebp - 0x12c]
push ecx
push eax
mov ecx, esi
mov dword [ebp - 4], 0xe
call fcn.0040dac0
push ecx
lea eax, [ebp - 0x150]
mov byte [ebp - 4], 0x12
push eax
mov ecx, esi
call fcn.0040dac0
mov eax, dword [ebp - 0xdc]
lea ecx, [ebp - 0x12c]
mov byte [ebp - 4], 0x13
push dword [ebp - 0x140]
mov eax, dword [eax]
inc eax
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.0040da00
mov byte [ebp - 4], 0x15
mov ecx, dword [ebp - 0x13c]
cmp ecx, 0xf
jbe 0x41355c
mov edx, dword [ebp - 0x150]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x413552
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x413d3a
push ecx
push edx
call fcn.00474928
add esp, 8
mov dword [ebp - 0x140], 0
mov dword [ebp - 0x13c], 0xf
mov byte [ebp - 0x150], 0
mov byte [ebp - 4], 0x16
mov ecx, dword [ebp - 0x118]
cmp ecx, 0xf
jbe 0x4135b5
mov edx, dword [ebp - 0x12c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4135ab
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x413d3a
push ecx
push edx
call fcn.00474928
add esp, 8
push ecx
lea eax, [ebp - 0x64]
mov dword [ebp - 0x11c], 0
push eax
mov ecx, esi
mov dword [ebp - 0x118], 0xf
mov byte [ebp - 0x12c], 0
call fcn.0040dac0
cmp dword [ebp - 0x50], 0xf
lea eax, [ebp - 0x64]
push 0
cmova eax, dword [ebp - 0x64]
push 0x80
push 3
push 0
push 1
push 3
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ecx, dword [ebp - 0x50]
mov esi, eax
mov dword [ebp - 0xc8], esi
cmp ecx, 0xf
jbe 0x413639
mov edx, dword [ebp - 0x64]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x41362f
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x413d3f
push ecx
push edx
call fcn.00474928
add esp, 8
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x50], 0xf
mov byte [ebp - 0x64], 0
cmp esi, 0xffffffff
jne 0x413691
mov byte [ebp - 4], 0xe
mov ecx, dword [ebp - 0x34]
cmp ecx, 0xf
jbe 0x413b3d
mov edx, dword [ebp - 0x48]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x413682
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x413d53
push ecx
push edx
call fcn.00474928
add esp, 8
jmp 0x413b3d
lea edx, [ebp - 0x48]
lea ecx, [ebp - 0xf4]
call fcn.00415400
mov esi, eax
lea ecx, [ebp - 0x2c]
push esi
lea eax, [ebp - 0x100]
push eax
call fcn.004167d0
mov edi, dword [ebp - 0xf8]
cmp byte [edi + 0xd], 0
jne 0x4136e8
cmp dword [edi + 0x24], 0xf
lea eax, [edi + 0x10]
mov ecx, dword [eax + 0x10]
jbe 0x4136cb
mov eax, dword [eax]
cmp dword [esi + 0x14], 0xf
mov edx, dword [esi + 0x10]
jbe 0x4136d6
mov esi, dword [esi]
push ecx
push eax
mov ecx, esi
call fcn.00409160
add esp, 8
test eax, eax
je 0x4136eb
jns 0x4136eb
mov edi, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0xe0]
cmp ecx, 0xf
jbe 0x413725
mov edx, dword [ebp - 0xf4]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x41371b
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x413d44
push ecx
push edx
call fcn.00474928
add esp, 8
push 2
push 0
push 0
push dword [ebp - 0xcc]
mov dword [ebp - 0xe4], 0
mov dword [ebp - 0xe0], 0xf
mov byte [ebp - 0xf4], 0
cmp edi, dword [ebp - 0x2c]
je 0x413838
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ecx, dword [ebp - 0xbc]
mov dword [ebp - 0x9c], eax
call fcn.00411050
mov esi, dword [ebp - 0xc4]
push 0
push 0
push dword [edi + 0x28]
mov dword [ebp - 0xa0], eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
lea eax, [ebp - 0x20]
push 0
push eax
push 4
lea eax, [ebp - 0x9c]
push eax
push esi
call edi
test eax, eax
jne 0x4137e3
mov byte [ebp - 4], 0xe
mov ecx, dword [ebp - 0x34]
cmp ecx, 0xf
jbe 0x413b3d
mov edx, dword [ebp - 0x48]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4137d4
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x413d49
push ecx
push edx
call fcn.00474928
add esp, 8
jmp 0x413b3d
push 0
lea eax, [ebp - 0x20]
push eax
push 4
lea eax, [ebp - 0xa0]
push eax
push esi
call edi
test eax, eax
jne 0x4139dc
mov byte [ebp - 4], 0xe
mov ecx, dword [ebp - 0x34]
cmp ecx, 0xf
jbe 0x413b3d
mov edx, dword [ebp - 0x48]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x413682
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x413d49
jmp 0x413682
mov eax, dword [ebp - 0x38]
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [ebp - 0x30], eax
call edi
mov ecx, dword [ebp - 0xbc]
mov dword [ebp - 0xa4], eax
call fcn.00411050
mov esi, dword [ebp - 0xc4]
push 2
push 0
push 0
push esi
mov dword [ebp - 0x78], eax
call edi
mov ecx, dword [ebp - 0xc0]
lea eax, [ebp - 0x20]
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
push eax
xor eax, eax
cmp dword [ecx + 4], eax
sete al
lea eax, [eax*2 + 2]
push eax
lea eax, [ebp - 0x30]
push eax
push esi
call edi
test eax, eax
jne 0x4138d7
mov byte [ebp - 4], 0xe
mov ecx, dword [ebp - 0x34]
cmp ecx, 0xf
jbe 0x413b3d
mov edx, dword [ebp - 0x48]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4138c8
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x413d4e
push ecx
push edx
call fcn.00474928
add esp, 8
jmp 0x413b3d
cmp dword [ebp - 0x34], 0xf
lea ecx, [ebp - 0x20]
push 0
push ecx
push dword [ebp - 0x30]
lea eax, [ebp - 0x48]
cmova eax, dword [ebp - 0x48]
push eax
push esi
call edi
test eax, eax
jne 0x413934
mov byte [ebp - 4], 0xe
mov ecx, dword [ebp - 0x34]
cmp ecx, 0xf
jbe 0x413b3d
mov edx, dword [ebp - 0x48]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x413925
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x413d4e
push ecx
push edx
call fcn.00474928
add esp, 8
jmp 0x413b3d
push 0
lea eax, [ebp - 0x20]
push eax
push 4
lea eax, [ebp - 0xa4]
push eax
push esi
call edi
test eax, eax
jne 0x41398b
mov byte [ebp - 4], 0xe
mov ecx, dword [ebp - 0x34]
cmp ecx, 0xf
jbe 0x413b3d
mov edx, dword [ebp - 0x48]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x41397c
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x413d4e
push ecx
push edx
call fcn.00474928
add esp, 8
jmp 0x413b3d
push 0
lea eax, [ebp - 0x20]
push eax
push 4
lea eax, [ebp - 0x78]
push eax
push esi
call edi
test eax, eax
jne 0x4139d9
mov byte [ebp - 4], 0xe
mov ecx, dword [ebp - 0x34]
cmp ecx, 0xf
jbe 0x413b3d
mov edx, dword [ebp - 0x48]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x413682
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x413d4e
jmp 0x413682
inc dword [ebp - 0x24]
mov edi, dword [ebp - 0xc8]
push 2
push 0
push 0
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
push 0
push 0
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push esi
call fcn.00474936
add esp, 4
mov edi, eax
lea eax, [ebp - 0x20]
push 0
push eax
push esi
push edi
push dword [ebp - 0xc8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x413a5c
mov byte [ebp - 4], 0xe
mov ecx, dword [ebp - 0x34]
cmp ecx, 0xf
jbe 0x413b3d
mov edx, dword [ebp - 0x48]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x413682
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x413d53
jmp 0x413682
push 0
lea eax, [ebp - 0x20]
push eax
push esi
push edi
push dword [ebp - 0xcc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x413a85
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 0xe
call fcn.00402630
jmp 0x413b3d
push edi
call fcn.004748ee
add esp, 4
push dword [ebp - 0xc8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0xd0]
lea eax, [ebp - 0xf4]
push eax
call fcn.00410ee0
mov ecx, eax
call fcn.00402620
push eax
call fcn.0047ddcd
add esp, 4
lea ecx, [ebp - 0xf4]
call fcn.00402630
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 0xe
call fcn.00402630
jmp 0x413b3d
cmp edi, 0xf
jbe 0x413b36
inc edi
mov eax, esi
cmp edi, 0x1000
jb 0x413af9
mov esi, dword [eax - 4]
add edi, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x413d58
push edi
push esi
call fcn.00474928
add esp, 8
jmp 0x413b36
mov dword [ebp - 4], 0xe
lea ecx, [ebp - 0x80]
call fcn.004114a0
mov edi, dword [ebp - 0x80]
mov esi, dword [ebp - 0x7c]
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0xbc], edi
jmp 0x4133b2
or edi, 0xffffffff
test esi, esi
je 0x413b7f
mov eax, edi
lock xadd dword [esi + 4], eax
jne 0x413b7f
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
mov eax, edi
lock xadd dword [esi + 8], eax
jne 0x413b7f
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov esi, dword [ebp - 0x70]
test esi, esi
je 0x413ba4
mov eax, edi
lock xadd dword [esi + 4], eax
jne 0x413ba4
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lock xadd dword [esi + 8], edi
dec edi
jne 0x413ba4
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov eax, dword [ebp - 0xd8]
mov esi, dword [ebp - 0xc4]
cmp dword [ebp - 0x24], eax
je 0x413c47
mov eax, dword [ebp - 0xc0]
push 0
push 0
push 0
cmp dword [eax + 4], 0
mov dword [eax + 0x14], 1
push esi
je 0x413c2a
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
lea eax, [ebp - 0x20]
push 0
push eax
push 4
lea eax, [ebp - 0x4c]
push eax
push esi
call edi
push 0
push 0
push 4
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x24]
push eax
mov eax, dword [ebp - 0xc0]
push 0
push 1
push dword [eax + 0xc]
push dword [eax + 8]
call dword [sym.imp.ADVAPI32.dll_CryptDecrypt]
push 0
lea eax, [ebp - 0x20]
push eax
push 4
lea eax, [ebp - 0x24]
push eax
push esi
call edi
jmp 0x413c47
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [ebp - 0x20]
push eax
push 4
lea eax, [ebp - 0x24]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x413c58
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0xcc]
call esi
mov eax, dword [ebp - 0x2c]
push dword [eax + 4]
lea eax, [ebp - 0x2c]
push eax
mov ecx, eax
call fcn.00416870
push 0x2c
push dword [ebp - 0x2c]
call fcn.00474928
mov ecx, dword [ebp - 0x84]
add esp, 8
cmp ecx, 0xf
jbe 0x413cac
mov edx, dword [ebp - 0x98]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x413ca2
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x413cf8
push ecx
push edx
call fcn.00474928
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.004748e0
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 8
mov ecx, dword [ebp - 0x84]
cmp ecx, 0xf
jbe 0x413cac
mov edx, dword [ebp - 0x98]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x413ca2
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x413ca2
call fcn.0047ce51
call fcn.004015c0
call fcn.0047ce51
call fcn.0047ce51
call fcn.0047ce51
call fcn.00401520
call fcn.0047ce51
call fcn.004015c0
lea ecx, [ebp - 0x64]
mov edx, eax
push ecx
mov ecx, str.recursive_directory_iterator::recursive_directory_iterator
call fcn.0040c850
call fcn.0047ce51
call fcn.0047ce51
call fcn.0047ce51
call fcn.0047ce51
call fcn.0047ce51
call fcn.0047ce51
call fcn.0047ce51
call fcn.0047ce51
call fcn.0047ce51
int3