Function at 0x4442d1
Capabilities:
Write file on windows

Disassembly:
jnp 0x405f3e
push esp
inc ebx
push esp
push esp
pop edx
inc ebx
push esp
push ebx
dec edx
push esi
push 0x78
jns 0x405f34
inc eax
pop ebx
pop ebp
pop ebx
push ebx
dec ebx
dec esp
inc edi
pop ebp
pop ebx
dec edi
jnp 0x405f57
dec edi
push ebx
inc ecx
imul edx, dword [ebx + 0x5e], 0x43
pop edx
push esp
dec ebx
jnp 0x405f86
push esp
dec ebx
inc ecx
push ebx
insb byte es:[edi], dx
dec ebx
pop di
dec edi
insb byte es:[edi], dx
inc ebp
insd dword es:[edi], dx
inc edx
dec esp
insd dword es:[edi], dx
outsd dx, dword [esi]
inc edx
push 0x5b605c4c
insb byte es:[edi], dx
dec eax
bound ecx, qword [ecx + 0x58]
bound ebp, qword [ebp + 0x6b]
imul edi, dword [ebx + 0x78], 0x7b
push 0x58
push esi
pop ecx
outsb dx, byte [esi]
pop edi
push bp
inc ecx
push ebp
inc sp
inc ebp
jns 0x405f9b
dec eax
pushal
pop esp
dec ecx
imul ebp, dword [ecx + 0x6d], 0x43
push ebp
bound ebx, qword [eax + 0x78]
push ebp
push esi
outsd dx, dword [esi]
push ebp
imul esp, dword [edx + edx*2 + 0x40], 0x7b676656
push edi
jnp 0x405fb0
inc ebp
imul eax, dword [ebx + 0x67], 0x4f
pop esp
dec edx
pushal
inc esp
push ebp
dec edx
insd dword es:[edi], dx
bound eax, qword [ebp + 0x6d]
arpl word gs:[ebp + 0x5d], cx
push 0x7b52514e
imul edx, dword [ebp + 0x6f], 0x4e646064
imul esp, dword [eax + 0x50], 0x6e
push 0x494f494a
dec esi
push 0x6766797b
dec eax
dec ax
pop esi
imul esp, dword [edx + eax*2 + 0x41], 0x5864585f
push ecx
inc ebx
inc ebx
push ebp
pop edi
push edx
dec esi
jns 0x405fec
jns 0x405fec
inc eax
dec ebp
push 0x79
jnp 0x406011
pop esp
push esi
dec ecx
dec esi
push 0x526b6545
dec edi
push 0x67555045
inc edx
push eax
push ebp
inc edx
push esp
pop ebx
pushal
insd dword es:[edi], dx
pop esi
pop cx
pop esi
outsd dx, dword [esi]
push esp
jns 0x40601f
pop ebx
dec edx
pop eax
dec edi
pop esi
pop eax
dec esp
imul edi, dword [ecx + 0x59], 0x534b5744
inc eax
dec ebx
inc ecx
dec edi
pop eax
inc esi
dec edi
inc ebp
push 0x63
dec eax
arpl word [edx + 0x57], cx
push bx
dec edi
imul ebp, dword [ebp + 0x44], 0x6f6d5b47
insd dword es:[edi], dx
jnp 0x406038
insb byte es:[edi], dx
outsd dx, dword [esi]
outsd dx, dword [esi]
popal
push ecx
js 0x40605e
imul edi, dword [eax + 0x41], 0x46794152
pop ebp
pop edi
inc esp
inc ebx
dec edi
jnp 0x40604e
imul ecx, dword [ecx + 0x68], 0x6a5a4e48
pop esp
push ecx
inc ebx
push ebx
dec esi
push esi
arpl word [ebp + 0x44], sp
dec eax
inc edx
pop edx
bound ebp, qword [ecx + 0x49]
push ecx
push edx
pop esi
inc ebp
dec ebp
push edi
dec esp
insd dword es:[edi], dx
pop esp
push esp
arpl word [ecx + 0x46], ax
inc eax
push esp
inc ecx
outsb dx, byte [esi]
arpl word [esi + 0x57], ax
push 0x4e
pushal
jnp 0x406086
pop ebx
pop eax
dec eax
inc esi
js 0x40607d
outsd dx, dword [esi]
inc edi
pop edi
inc ecx
dec ebx
pop ebx
inc ecx
push ebp
push edi
inc edx
push ecx
pop edx
pop eax
dec eax
push eax
inc edx
inc esi
pop esp
insd dword es:[edi], dx
dec ecx
pop ebp
push edx
jns 0x4060a7
pop esp
dec ecx
arpl word fs:[esi + 0x6a], bp
inc ebx
imul esp, dword [ebx + 0x53], 0x65
arpl word [ebx + 0x65], dx
dec ebx
inc edi
pop edx
insb byte es:[edi], dx
popal
inc esi
imul eax, dword [edx + 0x57], 0x48
jns 0x4060e5
push esp
dec ebx
inc esp
outsb dx, byte [esi]
pop ecx
jnp 0x4060cb
bound esp, qword [edx + 0x5a]
push edx
outsb dx, byte [esi]
jnp 0x4060d7
inc ebx
pop edx
pop eax
push edx
pop edx
push 0x6d6f7964
popal
inc ebx
bound edx, qword [edx + 0x5c]
inc ebp
inc ebx
insb byte es:[edi], dx
pop ebx
pop ecx
pop esp
push edx
pop esp
imul ebp, dword [esi + 0x57], 0x6341465a
inc esp
push 0x61796052
push esp
dec edi
pop edx
push esp
push 0xe9535749
mov ch, 0xb7
or byte [eax], al
push eax
inc edx
push esi
arpl word [eax + 0x43], dx
jmp 0x491a68
jmp 0x491861
popal
push edx
outsd dx, dword [esi]
pop eax
inc eax
push edi
dec ecx
inc ebx
jnp 0x406120
push edx
bound edx, qword [eax + 0x6c]
push eax
insb byte es:[edi], dx
dec esp
imul ebx, dword [esi + 0x5e], 0x536d6e5d
pop esi
pop esi
pop ebp
outsb dx, byte [esi]
insd dword es:[edi], dx
push ebx
jnp 0x406134
pop esp
pop ebp
inc ebp
outsd dx, dword [esi]
inc edi
pushal
dec edi
dec ebx
js 0x406130
js 0x406158
jnp 0x4060db
test eax, 0x580008bb
insb byte es:[di], dx
dec edi
insb byte es:[edi], dx
dec edi
arpl word [edx + 0x7b], bx
push ebp
dec ebp
imul edx, dword [ebp + 0x6e], 0x5f6d5057
imul ebp, dword [edi + 0x5e], 0x6c63424b
pop edi
dec ebx
dec edx
push edx
insb byte es:[edi], dx
inc esi
push eax
dec edi
dec sp
pop edi
inc esp
inc edi
pop ebp
insb byte es:[edi], dx
dec edx
pop esi
jnp 0x406184
pop ecx
pushaw
bound ecx, qword [eax + 0x56]
inc edx
push ebx
pop edx
pop esi
inc esp
jns 0x4061ae
dec edi
imul edx, dword [ebx - 0x17], 0x8c01e
inc esp
outsb dx, byte [esi]
outsb dx, byte [esi]
inc eax
inc ecx
inc esp
push edi
dec edi
dec ebp
inc esi
push ebx
dec esp
arpl word [ebx + edi*2 + 0x6b], cx
jns 0x4061aa
inc bx
dec esi
push esp
push 0x61
imul esp, dword [edi + 0x51], 0xffffffe9
jp 0x406119
ror byte [eax], 0
or byte [eax], al
insb byte es:[edi], dx
dec ecx
bound ebp, qword [edx + 0x5a]
inc esi
push esp
dec eax
push esi
inc ecx
bound ebx, qword [ebp + 0x41]
jmp 0x492347
pop esp
push esi
dec esp
pop ebx
imul eax, dword [esi + 0x69], 0x6b4f6761
pop eax
push eax
arpl word [eax + 0x5d], ax
imul ebx, dword [esi + 0x4e], 0x61
arpl word [eax + 0x4a], bp
push edx
push 0x55596d5b
dec ebp
pop esp
insd dword es:[edi], dx
bound edx, qword [esp + ecx*8 - 0x34]
enter 8, 0x6d
dec edx
push eax
push ebp
outsb dx, byte [esi]
popal
pop eax
pop eax
push ecx
inc edi
push ebp
imul esp, dword [ebp + 0x59], 0x794e604e
inc ebx
dec ecx
push ebp
push esi
inc esp
push ebx
js 0x40622f
inc ebx
jnp 0x40623d
push 0x48
outsd dx, dword [si]
jnp 0x40624d
inc ecx
imul edx, dword [edi + 0x41], 0x5a
dec eax
inc esi
pop ax
dec eax
js 0x406248
push ebp
dec ecx
outsd dx, dword [esi]
jnp 0x40623f
push ebx
push edx
inc esi
dec esi
dec esp
pop esp
popal
push esp
inc edx
push edi
push ecx
dec eax
dec esi
pop ecx
dec edi
pop eax
inc ebp
jmp 0x492e6b
pop ecx
bound ebp, qword [edi + 0x60]
dec esi
inc ebx
dec ecx
pop ebp
pop esi
mov ecx, dword [esp + 4]
test dword [ecx + 4], 6
mov eax, 1
inc ecx
add al, 6
push es
add byte [eax], al
add byte [eax + 1], bh
je 0x40627d
mov eax, dword [esp + 8]
mov ecx, dword [eax + 8]
xor ecx, eax
or byte [ebx - 0x37ccf7b8], cl
call fcn.0040123a
push ebp
mov ebp, dword [eax + 0x18]
push dword [eax + 0xc]
push dword [eax + 0x10]
push dword [eax + 0x14]
call fcn.004061a8
add esp, 0xc
pop ebp
mov eax, dword [esp + 8]
mov edx, dword [esp + 0x10]
mov dword [edx], eax
mov eax, 3
ret
mov ah, 0x71
push ecx
cmpsd dword [esi], dword es:[edi]
movsb byte es:[edi], byte [esi]
and byte [ebx - 0x4db4f7df], ah
retf
and al, 4
push edi
lea edi, [esp + 6]
call 0x4442d6
mov dword [esp], ebx
lea ebx, [edx - 0x3afb1]
push word [esp + 8]
popf
mov ecx, ebx
pop ebx
mov edi, dword [esp]
lea esp, [esp + 4]
lea esp, [esp + 2]
cmp esi, 0xa4f797f
je 0x405ee3
lea edx, [eax + eax]
cmp ebx, 0xdfe8c6d
jne 0x444330
inc edi
imul ebp, dword [edx + 0x42], 0x59
inc eax
pop ebx
pop edx
pop eax
push esi
push edx
arpl word [ecx + ebx*2 + 0x49], sp
pop ebx
pop ebp
push esi
imul esp, dword [eax + 0x4d], 0x4e
popal
pop ecx
push esi
dec ebp
insd dword es:[edi], dx
dec eax
pop ebp
pop ebp
sub edx, ecx
cmp dword [esp + 0x5c], 0x53aff56d
je 0x4442c6
lea edx, [esp + edx + 0x1a]
cmp ebp, 0xa7e371ab
jne 0x444390
pushal
inc ebx
push 0x55
push 0x68
outsd dx, dword [esi]
dec ecx
inc eax
push 0x58
push edi
pop eax
inc ebp
dec esi
push ecx
dec esi
dec esi
pushal
pop eax
pop edx
insd dword es:[edi], dx
pop ebx
push edx
imul ecx, dword [edx + 0x5b], 0x6b537840
dec ebp
bound ebx, qword [edi + 0x49]
push ecx
pop ebx
arpl word [ecx + 0x56], cx
inc edx
dec ebp
dec dx
pushal
inc esp
inc edx
push ecx
insd dword es:[edi], dx
push esp
dec edi
arpl word [eax + ebx*2 + 0x4c], bx
pop edx
outsd dx, dword [esi]
dec edi
inc esi
push edx
push edi
dec ebp
push 0x7b6d4253
pop esi
dec eax
pop ecx
movzx eax, word [ecx]
cmp ebp, 0xfe534e91
je 0x41bb06
mov word [edx + ecx], ax
cmp edx, 0xb2d64203
cmove ebp, ebx
add ecx, 2
test ax, ax
push 0xffffff7c
pushfd
lea esp, [esp - 4]
mov dword [esp], edi
call fcn.00444417