Function at 0x50cb46
Capabilities:
Write file on windows

Disassembly:
xchg esi, eax
add esi, dword [0x5c0df1]
call fcn.004064ce
xchg esi, eax
rol eax, 0xd
add edx, ebp
xchg edi, eax
xchg ecx, esi
ror esi, 0x1f
ror edx, 0x10
mov eax, 0x4108ca35
add dword [0x5c0d4d], edi
ror ecx, 0x1d
xor edx, 0x396c2ad1
xor dword [0x5c0c78], edi
sub ebx, 0x8baf2d06
xor edx, 0xa26e144e
sub dword [0x5c0db4], eax
rol esi, 7
xor ecx, esi
and dword [0x5c0c36], esi
xor esi, edi
xor ecx, 0x7388c7ac
or dword [0x5c0bed], esi
xor dword [0x5c0c45], ebx
xor ecx, 0x7388c7ac
xor esi, edi
xor ecx, esi
ror esi, 7
mov dword [0x5c0c66], esi
xor edx, 0xa26e144e
add ebx, 0x8baf2d06
xor dword [0x5c0c00], ecx
xor edx, 0x396c2ad1
rol ecx, 0x1d
mov dword [0x5c0cb8], esi
add eax, 0x989cbe13
rol eax, 2
and dword [0x5c0bed], edi
or edi, dword [0x5c0ea6]
mov dword [0x5c0c45], 0x793040f9
sub edi, esi
ror ebx, 0x10
xchg esi, edx
inc edi
neg esi
add dword [0x5c0c12], eax
ror esi, 8
xor ebx, eax
add esi, dword [0x5c0e80]
xchg edi, eax
call fcn.00525297
dec esi
add ebx, dword [0x5c0f37]
inc esi
call fcn.00524e6c
xchg edi, eax
xor ebx, eax
rol esi, 8
sub dword [0x5c0cb1], esi
neg esi
dec edi
xchg esi, edx
rol ebx, 0x10
add edi, esi
sub dword [0x5c0d28], 0xdb30d101
xor dword [0x5c0c19], ecx
ror eax, 2
sub eax, 0xd9a55848
inc ebx
xchg edx, esi
neg esi
add dword [0x5c0cda], esi
add edi, ebp
xor edx, eax
call fcn.00427c45
mov dword [0x5c0c65], ebx
xor ecx, edi
sub ebx, edx
xor esi, dword [0x5c0de4]
not eax
or dword [0x5c0d9c], esi
xor esi, dword [0x5c0e6a]
ror eax, 0x1e
sub esi, 0x25237e9e
add edi, 0x29459a60
call fcn.0045dd61
or dword [0x5c0c0e], 0xd859efae
xor dword [0x5c0d42], 0xc508291
call fcn.0048c8a4
sub edi, 0x29459a60
add esi, 0x25237e9e
rol eax, 0x1e
and dword [0x5c0c9f], ebx
not eax
add ebx, edx
xor ecx, edi
call fcn.0041b030
xor edx, eax
sub edi, ebp
neg esi
xchg edx, esi
dec ebx
push eax
ror ebx, 7
xor ebx, esi
or dword [0x5c0d68], 0x5e7fc2ad
xor ebx, edx
not edx
add edi, dword [0x5c0f31]
sub dword [0x5c0d8e], 0xcdcb7000
ror ecx, 0xc
sub edx, ecx
or dword [0x5c0cb2], edx
inc ebx
or dword [0x5c0ce6], 0x835f58b0
xor ecx, dword [0x5c0e7f]
call fcn.004419f2
or dword [0x5c0c1e], eax
dec edi
ror esi, 0x16
and dword [0x5c0cce], esi
or edi, dword [0x5c0e7b]
xor dword [0x5c0d21], 0x39b47a4b
call fcn.004028d9
xor dword [0x5c0c40], eax
mov dword [0x5c0c90], eax
or dword [0x5c0c49], eax
rol esi, 0x16
inc edi
mov dword [0x5c0d0f], edx
dec ebx
add edx, ecx
rol ecx, 0xc
not edx
xor ebx, edx
mov dword [0x5c0cf9], 0xf89285c0
xor ebx, esi
rol ebx, 7
push 0x26293b
sub ebx, 0x7a51abe5
call fcn.004cccd8
xor eax, ebx
sub edi, ecx
ror ecx, 0x14
call fcn.0052bd19
sub esi, dword [0x5c0ee8]
sub edx, dword [0x5c0e0e]
neg edi
mov dword [0x5c0d54], edx
xchg edx, esi
dec esi
not ecx
or eax, dword [0x5c0ef5]
sub ebx, 0xbad899be
xchg ebx, edx
xchg ebx, edx
add ebx, 0xbad899be
not ecx
inc esi
xchg edx, esi
neg edi
rol ecx, 0x14
add edi, ecx
xor eax, ebx
call fcn.004262af
add ebx, 0x7a51abe5
mov esi, 0xefbc1be2
inc edx
xor ebx, edi
call fcn.004159d4
sub esi, eax
dec edx
or ebx, dword [0x5c0eb7]
sub ecx, dword [0x5c0e8e]
call fcn.004bbd94
mov dword [0x5c0c92], ebx
xor dword [0x5c0cee], ebx
ror eax, 0x16
neg ecx
xor esi, dword [0x5c0e25]
neg ecx
rol eax, 0x16
xor dword [0x5c0cd9], edi
and dword [0x5c0d0a], esi
call fcn.004df198
inc edx
add esi, eax
xor ebx, edi
dec edx
add esi, 0x4f592a63
xor eax, edx
call fcn.00442d0e
mov dword [0x5c0daa], edi
add ebx, 0x229c818b
not edi
sub eax, dword [0x5c0f93]
or eax, dword [0x5c0e1a]
xor ebx, esp
and dword [0x5c0c8a], 0x30e62ef0
sub ecx, dword [0x5c0fa1]
xor ecx, ebp
or ecx, dword [0x5c0e17]
xor eax, 0x82e30c1a
add dword [0x5c0ce5], edi
inc edi
or dword [0x5c0c9d], eax
or dword [0x5c0c6c], ebx
dec edi
xor dword [0x5c0d1f], ebx
xor eax, 0x82e30c1a
xor ecx, ebp
xor ebx, esp
not edi
sub ebx, 0x229c818b
or dword [0x5c0cc1], eax
call fcn.004cee44
xor eax, edx
sub esi, 0x3f154645
inc ecx
call fcn.0051265a
xchg ecx, eax
sub dword [0x5c0d5f], eax
sub esi, dword [0x5c0e82]
sub esi, dword [0x5c0fbb]
or ecx, dword [0x5c0ee9]
call fcn.00524927
and dword [0x5c0d78], edx
add eax, dword [0x5c0e43]
ror edi, 1
not edx
mov dword [0x5c0d22], ebx
xor dword [0x5c0d39], esi
add ecx, esi
xchg edx, esi
xor edx, dword [0x5c0f1b]
xchg ecx, edx
xchg ecx, edx
xchg edx, esi
sub ecx, esi
xor dword [0x5c0c29], ebx
and dword [0x5c0bf9], esi
not edx
rol edi, 1
or dword [0x5c0c08], esi
call fcn.00423bf7
mov dword [0x5c0dc8], esi
xchg ecx, eax
call fcn.004bca95
dec ecx
push esi
dec edx
xor esi, 0x5dc285ae
ror ecx, 0x16
mov dword [0x5c0d03], 0x78e3c4aa
xor eax, 0x56c002b
xor ebx, dword [0x5c0e45]
neg esi
add eax, 0x36fdd933
xor edx, 0xcc9e55bf
neg edx
call fcn.0044cbf2
inc eax
sub eax, dword [0x5c0ee8]
add eax, 0x5c0ee8
xor dword [0x5c0c15], eax
add ebx, dword [0x5c0eee]
mov dword [0x5c0d5c], eax
mov dword [0x5c0ccf], eax
xor ebx, 0x3de93e6a
sub edx, 0x2e7a6228
call fcn.004f441c
call fcn.0051f823
add edx, 0x2e7a6228
xor ebx, 0x3de93e6a
or dword [0x5c0c3e], ebx
dec eax
call fcn.004a8026
neg edx
xor edx, 0xcc9e55bf
sub eax, 0x36fdd933
neg esi
xor eax, 0x56c002b
rol ecx, 0x16
xor esi, 0x5dc285ae
inc edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
sub esi, dword [0x5c0fb3]
ror edi, 0xe
inc edi
add dword [0x5c0c65], ebx
call fcn.004275f5
xor eax, 0x15432cda
inc edi
sub ebx, esi
or dword [0x5c0d55], esi
call fcn.004bae56
dec ecx
call fcn.004a3ff4
inc ecx
call fcn.004064ce
add ebx, esi
dec edi
xor eax, 0x15432cda
call fcn.004ff1ee
sub dword [0x5c0ccd], ecx
dec edi
rol edi, 0xe
lea esi, [0x2a9325e5]
ror eax, 0x1e
add esi, dword [0x5c0f23]
xchg esi, edx
call fcn.0049861f
not esi
inc ecx
call fcn.004520bd
xor esi, dword [0x5c0e1e]
xor ebx, dword [0x5c0f0b]
not esi
add dword [0x5c0c0b], esi
xor eax, dword [0x5c0f67]
and dword [0x5c0c14], ecx
call fcn.0041a780
call fcn.0051ddfc
call fcn.00440a11
mov dword [0x5c0ccd], ecx
and dword [0x5c0d7b], eax
not esi
dec ecx
not esi
call fcn.004c6711
xchg esi, edx
rol eax, 0x1e
sub esi, 0xd2c71298
or dword [0x5c0c7d], esi
or ecx, dword [0x5c0f01]
or edi, dword [0x5c0e27]
xchg ebx, edx
call fcn.0042052e
inc edx
sub esi, dword [0x5c0f13]
xor dword [0x5c0ccb], 0x2720b99b
add edx, dword [0x5c0ee7]
dec ecx
or edi, dword [0x5c0fbf]
rol esi, 3
xor dword [0x5c0c7e], esi
ror ecx, 0xd
add dword [0x5c0cb9], edi
call fcn.00444faf
xor esi, dword [0x5c0fad]
xchg ecx, eax
sub edx, esp
xor ecx, dword [0x5c0ef0]
add dword [0x5c0cf6], eax
sub dword [0x5c0d0a], edi
add edx, esp
xchg ecx, eax
call fcn.004c6711
mov dword [0x5c0c71], eax
rol ecx, 0xd
ror esi, 3
inc ecx
sub dword [0x5c0c83], 0x7c29ec67
dec edx
xchg ebx, edx
mov dword [0x5c0d0e], eax
xor esi, 0x57aa7d4d
call fcn.004764e4
dec eax
sub dword [0x5c0c4d], 0x3f80c3cd
xor ecx, 0xea659200
sub ebx, 0x6dedd73d
xor edi, 0x53388acb
xor ecx, dword [0x5c0fad]
add ecx, 0xf1a5672b
mov dword [0x5c0ccd], edi
not edx
add ecx, 0x525dcd7
call fcn.004a39c9
xor ecx, 0xa2e0ab4b
call fcn.0050e3d1
call fcn.00424dda
xor ecx, 0xa2e0ab4b
call fcn.004bbd94
sub ecx, 0x525dcd7
not edx
add dword [0x5c0d88], ecx
sub ecx, 0xf1a5672b
xor edi, 0x53388acb
add ebx, 0x6dedd73d
xor ecx, 0xea659200
inc eax
call fcn.00512671
mov edi, eax
xor edx, ebx
or eax, dword [0x5c0e16]
xor edx, 0x68ca004d
ror edx, 0x14
or dword [0x5c0c5c], 0x6654cc2c
dec esi
or edx, dword [0x5c0f00]
add edi, 0x216e185d
xchg edx, eax
xor esi, dword [0x5c0e29]
xchg edx, eax
sub edi, 0x216e185d
inc esi
rol edx, 0x14
xor edx, 0x68ca004d
xor edx, ebx
mov ecx, 0x26293b
xor esi, esp
inc eax
ror ebx, 4
add eax, 0xbe5b87ab
and dword [0x5c0c47], ecx
sub edi, esi
xchg edx, eax
dec edi
xor ebx, dword [0x5c0ee8]
xchg eax, edx
dec edi
xor ecx, edi
not eax
sub edx, ebx
not esi
call fcn.00484d89
xor ebx, eax
dec edi
ror esi, 0xe
mov dword [0x5c0dc7], ecx
rol esi, 0xe
inc edi
xor ebx, eax
call fcn.004247e9
not esi
add edx, ebx
not eax
xor ecx, edi
inc edi
xchg eax, edx
inc edi
xchg edx, eax
add edi, esi
xor dword [0x5c0ca6], edx
sub eax, 0xbe5b87ab
rol ebx, 4
dec eax
xor esi, esp
rep movsb byte es:[edi], byte [esi]
sub eax, ebp
sub dword [0x5c0d77], esi
not ecx
xor edx, eax
mov dword [0x5c0dbc], eax
xor esi, ecx
mov dword [0x5c0c0f], edx
call fcn.00513730
dec edi
xchg edi, esi
xor ebx, dword [0x5c0f43]
add esi, dword [0x5c0e94]
rol esi, 0x1a
xor edx, edi
or edx, dword [0x5c0f21]
not ebx
sub dword [0x5c0ce2], edi
sub dword [0x5c0cb3], eax
not ebx
xor edx, edi
ror esi, 0x1a
xchg edi, esi
inc edi
xor esi, ecx
mov dword [0x5c0da0], ebx
xor edx, eax
not ecx
mov dword [0x5c0dae], ecx
add eax, ebp
call fcn.0044a167
xor ecx, esi
neg edi
and dword [0x5c0dce], edi
add ebx, 0xcf67e04a
call fcn.0040c35c
and dword [0x5c0cea], esi
rol edx, 0x1a
sub edi, dword [0x5c0f6e]
rol ebx, 0x12
neg ebx
ror esi, 9
dec eax
ror ebx, 0x1b
rol ebx, 0x1b
inc eax
rol esi, 9
neg ebx
ror ebx, 0x12
ror edx, 0x1a
sub ebx, 0xcf67e04a
neg edi
xor ecx, esi
xor al, 8
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x50cf7c
mov esi, dword [ebp - 0x1ae0]
xor edi, edi
jmp 0x50d093