Function at 0x4039e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40e500
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
mov ecx, dword [0x41e058]
mov al, byte [0x41e050]
push ebx
push esi
xor esi, esi
push edi
inc ecx
mov dword [ebp - 0x10], esp
test al, al
mov dword [0x41e058], ecx
jne 0x403a2c
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 8]
mov dword [ebp - 4], esi
dec eax
je 0x403f2d
dec eax
je 0x403d8e
dec eax
jne 0x40427d
cmp dword [0x41e04c], esi
je 0x403a8d
mov eax, dword [ebp + 0xc]
push eax
push str.___Correct_DACL__rights_from_key___ls
push 0x41de54
call fcn.0040762a
mov edi, 0x41de54
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
push esi
dec ecx
push 0x41e048
push ecx
mov ecx, dword [0x41e04c]
push 0x41de54
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp + 0x10]
xor edi, edi
push edi
lea edx, [ebp + 8]
push edi
push edx
push edi
push edi
push 4
push 4
push eax
mov dword [ebp + 8], edi
call sub.ADVAPI32.dll_GetNamedSecurityInfoW
mov esi, eax
cmp esi, edi
jne 0x403d35
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_IsValidAcl]
test eax, eax
je 0x403d35
mov eax, dword [ebp + 8]
xor edx, edx
mov dx, word [eax + 2]
push edx
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
cmp ebx, edi
je 0x403bd5
mov edx, dword [ebp + 8]
xor ecx, ecx
push 2
mov cx, word [edx + 2]
push ecx
push ebx
call dword [sym.imp.ADVAPI32.dll_InitializeAcl]
test eax, eax
je 0x403bd5
mov eax, dword [ebp + 8]
cmp di, word [eax + 4]
jae 0x403b67
mov edx, edi
lea ecx, [ebp - 0x18]
and edx, 0xffff
push ecx
push edx
push eax
mov dword [ebp - 0x18], 0
call dword [sym.imp.ADVAPI32.dll_GetAce]
test eax, eax
je 0x403bd5
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x403bd5
mov cl, byte [eax + 1]
test cl, 0x10
jne 0x403b49
or cl, 0x10
mov byte [eax + 1], cl
mov eax, dword [ebp - 0x18]
xor ecx, ecx
mov cx, word [eax + 2]
push ecx
push eax
push 0xffffffffffffffff
push 2
push ebx
call dword [sym.imp.ADVAPI32.dll_AddAce]
test eax, eax
je 0x403bd5
test esi, esi
jl 0x403bd5
inc edi
jmp 0x403b01
test esi, esi
jne 0x403bd5
push ebx
call dword [sym.imp.ADVAPI32.dll_IsValidAcl]
test eax, eax
je 0x403bd5
mov edx, dword [ebp + 0xc]
push esi
push ebx
push esi
push esi
push 4
push 4
push edx
call sub.ADVAPI32.dll_SetNamedSecurityInfoW
mov esi, eax
test esi, esi
je 0x403c73
mov eax, dword [0x41e04c]
test eax, eax
je 0x403bd5
push esi
push str.___Failed__error___d_r_n
push 0x41de54
call fcn.0040762a
mov edi, 0x41de54
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
mov eax, dword [0x41e04c]
push 0
not ecx
dec ecx
push 0x41e048
push ecx
push 0x41de54
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov esi, 0x80004005
test ebx, ebx
je 0x403bee
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test esi, esi
jge 0x40427d
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
push 0
push edx
push 0
push 0
push 4
push 4
push eax
call sub.ADVAPI32.dll_SetNamedSecurityInfoW
mov esi, eax
test esi, esi
je 0x403ccd
mov eax, dword [0x41e04c]
test eax, eax
je 0x40427d
push esi
push str.___Failed_2___error___d_r_n
push 0x41de54
call fcn.0040762a
mov edi, 0x41de54
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
push 0
dec ecx
push 0x41e048
push ecx
mov ecx, dword [0x41e04c]
push 0x41de54
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x41e05c]
mov eax, dword [0x41e04c]
inc ecx
test eax, eax
mov dword [0x41e05c], ecx
je 0x403bda
push str.___OK_r_n
push 0x41de54
call fcn.0040762a
mov edi, 0x41de54
or ecx, 0xffffffff
xor eax, eax
add esp, 8
repne scasb al, byte es:[edi]
not ecx
push 0
dec ecx
push 0x41e048
push ecx
mov ecx, dword [0x41e04c]
push 0x41de54
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x403bda
mov ecx, dword [0x41e05c]
mov eax, dword [0x41e04c]
inc ecx
test eax, eax
mov dword [0x41e05c], ecx
je 0x40427d
push str.___OK_r_n
push 0x41de54
call fcn.0040762a
mov edi, 0x41de54
or ecx, 0xffffffff
xor eax, eax
add esp, 8
repne scasb al, byte es:[edi]
mov edx, dword [0x41e04c]
push 0
not ecx
dec ecx
push 0x41e048
push ecx
push 0x41de54
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [0x41e04c], edi
je 0x40427d
push esi
push str.___Failed__read_source_value__Error___d_r_n
push 0x41de54
call fcn.0040762a
add esp, 0xc
or ecx, 0xffffffff
xor eax, eax
push edi
mov edi, 0x41de54
repne scasb al, byte es:[edi]
mov eax, dword [0x41e04c]
push 0x41e048
not ecx
dec ecx
push ecx
push 0x41de54
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [0x41e04c], esi
je 0x403dd8
mov ecx, dword [ebp + 0xc]
push ecx
push str.___Correct_GROUP_rights_from_key___ls
push 0x41de54
call fcn.0040762a
mov edi, 0x41de54
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
mov edx, dword [0x41e04c]
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
not ecx
push esi
dec ecx
push 0x41e048
push ecx
push 0x41de54
push edx
call ebx
jmp 0x403dde
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp + 0x10]
push 0
push 0
lea eax, [ebp + 8]
push 0
push eax
push 0
push 2
push 4
push ecx
mov dword [ebp + 8], 0
call sub.ADVAPI32.dll_GetNamedSecurityInfoW
mov esi, eax
test esi, esi
jne 0x403ed5
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_IsValidSid]
test eax, eax
je 0x403ed5
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
push esi
push esi
push eax
push esi
push 2
push 4
push ecx
call sub.ADVAPI32.dll_SetNamedSecurityInfoW
mov esi, eax
test esi, esi
je 0x403e81
mov eax, dword [0x41e04c]
test eax, eax
je 0x403ecd
push esi
push str.___Failed__error___d_r_n
push 0x41de54
call fcn.0040762a
mov edi, 0x41de54
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
mov edx, dword [0x41e04c]
push 0
not ecx
dec ecx
push 0x41e048
push ecx
push 0x41de54
push edx
call ebx
mov eax, dword [ebp + 8]
jmp 0x404201
mov ecx, dword [0x41e05c]
mov eax, dword [0x41e04c]
inc ecx
test eax, eax
mov dword [0x41e05c], ecx
je 0x403ecd
push str.___OK_r_n
push 0x41de54
call fcn.0040762a
mov edi, 0x41de54
or ecx, 0xffffffff
xor eax, eax
add esp, 8
repne scasb al, byte es:[edi]
mov eax, dword [0x41e04c]
push 0
not ecx
dec ecx
push 0x41e048
push ecx
push 0x41de54
push eax
call ebx
mov eax, dword [ebp + 8]
jmp 0x404201
mov eax, dword [0x41e04c]
test eax, eax
je 0x40427d
push esi
push str.___Failed__read_source_value__Error___d_r_n
push 0x41de54
call fcn.0040762a
mov edi, 0x41de54
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
push 0
dec ecx
push 0x41e048
push ecx
mov ecx, dword [0x41e04c]
push 0x41de54
push ecx
call ebx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [0x41e04c], esi
je 0x403f76
mov edx, dword [ebp + 0xc]
push edx
push str.___Correct_OWNER_rights_from_key___ls
push 0x41de54
call fcn.0040762a
mov edi, 0x41de54
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
mov eax, dword [0x41e04c]
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
not ecx
push esi
dec ecx
push 0x41e048
push ecx
push 0x41de54
push eax
call ebx
jmp 0x403f7c
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [ebp + 0x10]
push 0
push 0
push 0
lea ecx, [ebp - 0x14]
push 0
push ecx
push 1
push 4
push edx
mov dword [ebp - 0x14], 0
call sub.ADVAPI32.dll_GetNamedSecurityInfoW
mov esi, eax
test esi, esi
jne 0x404220
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_IsValidSid]
test eax, eax
je 0x404220
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp + 0xc]
push esi
push esi
push esi
push ecx
push 1
push 4
push edx
call sub.ADVAPI32.dll_SetNamedSecurityInfoW
mov esi, eax
cmp esi, 5
mov dword [ebp - 0x1c], esi
jne 0x404112
mov eax, dword [0x41e04c]
mov dword [ebp + 0x10], 0
test eax, eax
je 0x404020
push str._get_access
push 0x41de54
call fcn.0040762a
mov edi, 0x41de54
or ecx, 0xffffffff
xor eax, eax
add esp, 8
repne scasb al, byte es:[edi]
mov eax, dword [0x41e04c]
push 0
not ecx
dec ecx
push 0x41e048
push ecx
push 0x41de54
push eax
call ebx
lea ecx, [ebp + 0x10]
push ecx
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x404161
mov edx, dword [ebp + 0x10]
push 1
push str.SeTakeOwnershipPrivilege
push edx
call fcn.00404760
add esp, 0xc
test eax, eax
mov eax, dword [0x41e04c]
je 0x4040c2
test eax, eax
je 0x404091
push str.ok_
push 0x41de54
call fcn.0040762a
mov edi, 0x41de54
or ecx, 0xffffffff
xor eax, eax
add esp, 8
repne scasb al, byte es:[edi]
mov eax, dword [0x41e04c]
push 0
not ecx
dec ecx
push 0x41e048
push ecx
push 0x41de54
push eax
call ebx
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp + 0xc]
push 0
push 0
push 0
push ecx
push 1
push 4
push edx
call sub.ADVAPI32.dll_SetNamedSecurityInfoW
mov esi, eax
mov eax, dword [ebp + 0x10]
push 0
push str.SeTakeOwnershipPrivilege
push eax
mov dword [ebp - 0x1c], esi
call fcn.00404760
add esp, 0xc
jmp 0x404104
test eax, eax
je 0x404104
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.failed__You_must_be_logged_on_as_Administrator__error___d_
push 0x41de54
call fcn.0040762a
mov edi, 0x41de54
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
push 0
dec ecx
push 0x41e048
push ecx
mov ecx, dword [0x41e04c]
push 0x41de54
push ecx
call ebx
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x404112
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x4041b1
mov eax, dword [0x41e04c]
test eax, eax
je 0x4041fe
push esi
push str.___Failed__error___d_r_n
push 0x41de54
call fcn.0040762a
mov edi, 0x41de54
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
mov eax, dword [0x41e04c]
push 0
not ecx
dec ecx
push 0x41e048
push ecx
push 0x41de54
push eax
jmp 0x4041fc
mov eax, dword [0x41e04c]
test eax, eax
je 0x4041fe
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.failed__error___d_
push 0x41de54
call fcn.0040762a
mov edi, 0x41de54
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
mov edx, dword [0x41e04c]
push 0
not ecx
dec ecx
push 0x41e048
push ecx
push 0x41de54
push edx
call ebx
jmp 0x40411a
mov ecx, dword [0x41e05c]
mov eax, dword [0x41e04c]
inc ecx
test eax, eax
mov dword [0x41e05c], ecx
je 0x4041fe
push str.___OK_r_n
push 0x41de54
call fcn.0040762a
mov edi, 0x41de54
or ecx, 0xffffffff
xor eax, eax
add esp, 8
repne scasb al, byte es:[edi]
not ecx
push 0
dec ecx
push 0x41e048
push ecx
mov ecx, dword [0x41e04c]
push 0x41de54
push ecx
call ebx
mov eax, dword [ebp - 0x14]
test eax, eax
jne 0x40427d
push 0
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [0x41e04c]
test eax, eax
je 0x40427d
push esi
push str.___Failed__read_source_value__Error___d_r_n
push 0x41de54
call fcn.0040762a
mov edi, 0x41de54
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
mov edx, dword [0x41e04c]
push 0
not ecx
dec ecx
push 0x41e048
push ecx
push 0x41de54
push edx
call ebx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret