Function at 0x4be95f
Capabilities:
Contain obfuscated stackstrings
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ed4c0
push 0x489ac0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xfffffd9c
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 4], 0
push 0x50fa04
call fcn.0048ded0
add esp, 4
test eax, eax
jne 0x4be9b3
jmp 0x4bec5a
push 0
push 0x80
push 4
push 0
push 3
push 0xc0000000
push 0x50fa04
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xffffffff
jne 0x4be9e7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
jmp 0x4bec5a
mov dword [ebp - 0x244], 0
push 2
push 0
push 0
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [ebp - 0x244], eax
cmp dword [ebp - 0x244], 0xffffffff
jne 0x4bea1e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
jmp 0x4bec5a
mov word [ebp - 0x23c], 0
xor ecx, ecx
mov dword [ebp - 0x23a], ecx
mov dword [ebp - 0x236], ecx
mov dword [ebp - 0x232], ecx
mov word [ebp - 0x22e], cx
lea edx, [ebp - 0x23c]
push edx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov byte [ebp - 0x228], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x227]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x26c], 0x5b
mov byte [ebp - 0x26b], 0x25
mov byte [ebp - 0x26a], 0x35
mov byte [ebp - 0x269], 0x64
mov byte [ebp - 0x268], 0x2f
mov byte [ebp - 0x267], 0x25
mov byte [ebp - 0x266], 0x32
mov byte [ebp - 0x265], 0x64
mov byte [ebp - 0x264], 0x2f
mov byte [ebp - 0x263], 0x25
mov byte [ebp - 0x262], 0x32
mov byte [ebp - 0x261], 0x64
mov byte [ebp - 0x260], 0x20
mov byte [ebp - 0x25f], 0x2d
mov byte [ebp - 0x25e], 0x20
mov byte [ebp - 0x25d], 0x25
mov byte [ebp - 0x25c], 0x32
mov byte [ebp - 0x25b], 0x64
mov byte [ebp - 0x25a], 0x3a
mov byte [ebp - 0x259], 0x25
mov byte [ebp - 0x258], 0x32
mov byte [ebp - 0x257], 0x64
mov byte [ebp - 0x256], 0x3a
mov byte [ebp - 0x255], 0x25
mov byte [ebp - 0x254], 0x32
mov byte [ebp - 0x253], 0x64
mov byte [ebp - 0x252], 0x3a
mov byte [ebp - 0x251], 0x25
mov byte [ebp - 0x250], 0x33
mov byte [ebp - 0x24f], 0x64
mov byte [ebp - 0x24e], 0x5d
mov byte [ebp - 0x24d], 0x20
mov byte [ebp - 0x24c], 0x25
mov byte [ebp - 0x24b], 0x73
mov byte [ebp - 0x24a], 0x20
mov byte [ebp - 0x249], 0xd
mov byte [ebp - 0x248], 0xa
mov byte [ebp - 0x247], 0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x22e]
and ecx, 0xffff
push ecx
mov edx, dword [ebp - 0x230]
and edx, 0xffff
push edx
mov eax, dword [ebp - 0x232]
and eax, 0xffff
push eax
mov ecx, dword [ebp - 0x234]
and ecx, 0xffff
push ecx
mov edx, dword [ebp - 0x236]
and edx, 0xffff
push edx
mov eax, dword [ebp - 0x23a]
and eax, 0xffff
push eax
mov ecx, dword [ebp - 0x23c]
and ecx, 0xffff
push ecx
lea edx, [ebp - 0x26c]
push edx
push 0x208
lea eax, [ebp - 0x228]
push eax
call fcn.004be590
add esp, 0x2c
mov dword [ebp - 0x22c], 0
mov dword [ebp - 0x270], 0
lea ecx, [ebp - 0x228]
push ecx
call fcn.0048ded0
add esp, 4
mov dword [ebp - 0x240], eax
push 0
lea edx, [ebp - 0x22c]
push edx
mov eax, dword [ebp - 0x240]
push eax
lea ecx, [ebp - 0x228]
push ecx
mov edx, dword [ebp - 0x20]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 0x270], eax
cmp dword [ebp - 0x270], 0
je 0x4bec51
mov eax, dword [ebp - 0x240]
cmp eax, dword [ebp - 0x22c]
je 0x4bec5a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0xffffffff
jmp 0x4bec89
cmp dword [ebp - 0x20], 0xffffffff
je 0x4beca0
mov edx, dword [ebp - 0x20]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret