Function at 0x401a30
Capabilities:
Get file attributes
Terminate process
Write file on windows

Disassembly:
push ebp
mov eax, 0x43cc
mov ebp, esp
push edi
push esi
push ebx
call fcn.00418d04
mov edi, dword [0x423030]
xor edx, edx
xor eax, eax
mov dword [ebp - 0x439c], edx
mov dword [ebp - 0x43a0], eax
test edi, edi
je 0x401c7d
mov dword [esp], 0x423d7c
lea ebx, [ebp - 0x4398]
mov dword [esp + 4], ebx
call sub.msys_1.0.dll_stat
test eax, eax
js 0x401d54
mov dword [esp], 0x423d7c
mov edi, 0x41bc0e
mov dword [esp + 4], edi
call sub.msys_1.0.dll_fopen
mov dword [ebp - 0x43a4], eax
test eax, eax
je 0x401d54
mov byte [ebp - 0x4358], 0
lea ebx, [ebp - 0x418]
mov dword [esp + 4], ebx
mov ecx, dword [ebp - 0x43a4]
mov edx, 0x400
mov dword [esp + 8], edx
mov dword [esp], ecx
call fcn.00401940
cmp eax, 0xffffffff
je 0x401b43
cmp byte [ebp + eax - 0x419], 0x5c
cld
mov ecx, 4
mov edi, str.____
mov esi, ebx
sete al
movzx edx, al
add dword [ebp - 0x439c], edx
repe cmpsb byte [esi], byte es:[edi]
je 0x401b0a
mov dword [esp], ebx
mov edi, 0x41bc15
mov dword [esp + 4], edi
call sub.msys_1.0.dll_strstr
test eax, eax
je 0x401d1f
mov dword [esp], ebx
mov esi, str._____BEGIN_SSH2_ENCRYPTED_PRIVATE_KEY_____
mov dword [esp + 4], esi
call sub.msys_1.0.dll_strstr
test eax, eax
je 0x401b2a
mov ecx, 1
mov dword [ebp - 0x43a0], ecx
mov dword [esp], ebx
mov edx, str._END
mov dword [esp + 4], edx
call sub.msys_1.0.dll_strstr
test eax, eax
je 0x401aac
lea ecx, [ebp - 0x4358]
lea esi, [esi]
mov ebx, dword [ecx]
add ecx, 4
lea edx, [ebx - 0x1010101]
not ebx
and edx, ebx
mov eax, edx
and eax, 0x80808080
je 0x401b50
and edx, 0x8080
jne 0x401b76
shr eax, 0x10
add ecx, 2
add al, al
mov edx, ecx
lea edi, [ebp - 0x4358]
sbb edx, 3
sub edx, edi
mov eax, edx
and eax, 3
cmp eax, 3
je 0x401cac
mov esi, 0x1fa0
lea edx, [ebp - 0x4358]
mov dword [esp + 8], esi
lea esi, [ebp - 0x23b8]
mov dword [esp + 4], esi
mov dword [esp], edx
call fcn.004115b0
test eax, eax
js 0x401d65
mov edx, dword [ebp - 0x43a0]
test edx, edx
je 0x401c6c
mov dword [esp + 4], eax
mov dword [esp], esi
call fcn.00401510
test eax, eax
mov esi, eax
je 0x401d90
mov ecx, dword [ebp - 0x43a0]
test ecx, ecx
je 0x401c96
cmp dword [eax], 2
je 0x401ce4
xor edx, edx
xor ecx, ecx
xor edi, edi
mov dword [esp + 0x14], ecx
xor eax, eax
xor ebx, ebx
mov dword [esp + 0x18], edx
mov ecx, dword [0x423d34]
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], eax
mov dword [esp + 8], ebx
mov edx, dword [esi + 8]
mov dword [esp + 4], edx
mov edi, dword [ecx + 8]
mov dword [esp], edi
call sub.msys_crypto_1.0.0.dll_PEM_write_RSAPrivateKey
test eax, eax
jne 0x401dbb
mov edx, dword [0x423d34]
mov edi, 0x11
mov esi, 1
mov ecx, dword [edx + 0xc]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp + 0xc], ecx
mov dword [esp], str.key_write_failed_n
call sub.msys_1.0.dll_fwrite
mov dword [esp], 1
call sub.msys_1.0.dll_exit
mov dword [esp + 4], eax
mov dword [esp], esi
call fcn.00408680
jmp 0x401bd6
mov ecx, dword [ebp + 8]
mov esi, str.Enter_file_in_which_the_key_is
mov dword [esp + 4], esi
mov dword [esp], ecx
call fcn.00401040
jmp 0x401a5e
mov eax, dword [0x423d34]
mov ebx, dword [eax + 8]
mov dword [esp], esi
mov dword [esp + 4], ebx
call fcn.00407830
jmp 0x401c2d
cmp byte [ebp + edx - 0x4359], 0x3d
jne 0x401b93
cmp byte [ebp + edx - 0x435a], 0x3d
jne 0x401b93
cmp byte [ebp + edx - 0x435b], 0x3d
jne 0x401b93
xor ecx, ecx
mov byte [ebp + edx - 0x435b], cl
jmp 0x401b93
xor eax, eax
xor ebx, ebx
xor edx, edx
mov dword [esp + 0x14], ebx
xor ecx, ecx
xor edi, edi
mov dword [esp + 0x18], eax
mov ebx, dword [0x423d34]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], ecx
mov dword [esp + 8], edi
mov eax, dword [esi + 0xc]
mov dword [esp + 4], eax
mov edx, dword [ebx + 8]
mov dword [esp], edx
call sub.msys_crypto_1.0.0.dll_PEM_write_DSAPrivateKey
jmp 0x401c2d
mov eax, dword [ebp - 0x439c]
test eax, eax
je 0x401d34
dec dword [ebp - 0x439c]
jmp 0x401aac
mov dword [esp + 4], ebx
mov esi, 0x1fa0
lea edi, [ebp - 0x4358]
mov dword [esp + 8], esi
mov dword [esp], edi
call fcn.004165c0
jmp 0x401aac
mov dword [esp], 0x423d7c
call sub.msys_1.0.dll_perror
jmp 0x401c60
mov ecx, dword [0x423d34]
mov eax, 0x11
mov ebx, 1
mov edi, dword [ecx + 0xc]
mov dword [esp + 8], eax
mov dword [esp + 4], ebx
mov dword [esp + 0xc], edi
mov dword [esp], str.uudecode_failed._n
jmp 0x401c5b
mov edi, dword [0x423d34]
mov ebx, 0x14
mov esi, 1
mov eax, dword [edi + 0xc]
mov dword [esp + 8], ebx
mov dword [esp + 4], esi
mov dword [esp + 0xc], eax
mov dword [esp], str.decode_blob_failed._n
jmp 0x401c5b
mov dword [esp], esi
call fcn.004067f0
mov ebx, dword [ebp - 0x43a0]
test ebx, ebx
je 0x401de7
mov edi, dword [ebp - 0x43a4]
mov dword [esp], edi
call sub.msys_1.0.dll_fclose
mov dword [esp], 0
call sub.msys_1.0.dll_exit
mov esi, dword [0x423d34]
mov eax, dword [esi + 8]
mov dword [esp], 0xa
mov dword [esp + 4], eax
call sub.msys_1.0.dll_fputc
jmp 0x401dcd