Function at 0x402dd1
Capabilities:
Contain obfuscated stackstrings
Read file on windows
Set current directory
Write file on windows

Disassembly:
push 0x65
push dword [0x40101e]
call dword [sym.imp.USER32.DLL_GetDlgItem]
push 0
push eax
call dword [sym.imp.USER32.DLL_EnableWindow]
push 0x67
push dword [0x40101e]
call dword [sym.imp.USER32.DLL_GetDlgItem]
push 0
push eax
call dword [sym.imp.USER32.DLL_EnableWindow]
push 0x66
push dword [0x40101e]
call dword [sym.imp.USER32.DLL_GetDlgItem]
push 0
push eax
call dword [sym.imp.USER32.DLL_EnableWindow]
push 0x68
push dword [0x40101e]
call dword [sym.imp.USER32.DLL_GetDlgItem]
push 0
push eax
call dword [sym.imp.USER32.DLL_EnableWindow]
push dword [0x401743]
push 0
push 0x406
push dword [0x401066]
call dword [sym.imp.USER32.DLL_SendMessageA]
push 0
push 0
push 0x402
push dword [0x401066]
call dword [sym.imp.USER32.DLL_SendMessageA]
push 0
push 1
push 0x404
push dword [0x401066]
call dword [sym.imp.USER32.DLL_SendMessageA]
mov dword [0x401633], 0x4c
push dword [0x40101e]
pop dword [0x401637]
lea edx, str.Scratches_RES_file
mov dword [0x40163f], edx
mov dword [0x401653], 0x104
mov dword [0x40164f], 0x401747
push 0x401633
call dword [sym.imp.COMDLG32.DLL_GetSaveFileNameA]
cmp eax, 0
jbe 0x402e08
push 0x401747
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
lea edx, [eax + 0x401743]
call 0x402dd1
jb 0x402e34
jae 0x402dd1
push edx
call dword [sym.imp.KERNEL32.DLL_lstrcmpA]
test eax, eax
je 0x402df1
call 0x402de6
jb 0x402e49
jae 0x402de6
push 0x401747
call dword [sym.imp.KERNEL32.DLL_lstrcatA]
push 0
push 0
push 0
push 0x402e4e
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
jmp 0x402e4d
push 0x66
push dword [0x40101e]
call dword [sym.imp.USER32.DLL_GetDlgItem]
push 1
push eax
call dword [sym.imp.USER32.DLL_EnableWindow]
push 0x68
push dword [0x40101e]
call dword [sym.imp.USER32.DLL_GetDlgItem]
push 1
push eax
call dword [sym.imp.USER32.DLL_EnableWindow]
push 0x65
inc eax
add byte [edx + 0x65], ch
push dword [0x40101e]
call dword [sym.imp.USER32.DLL_GetDlgItem]
push 1
push eax
call dword [sym.imp.USER32.DLL_EnableWindow]
pop edx
inc edx
inc eax
add bl, al
push ebp
mov ebp, esp
sub esp, 0x888
mov dword [ebp - 0x888], 0
mov dword [ebp - 0x884], 0
mov dword [ebp - 0x80], 0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x18], 0x6e6e6143
mov dword [ebp - 0x14], 0x6320746f
mov dword [ebp - 0x10], 0x74616572
mov dword [ebp - 0xc], 0x45522065
mov dword [ebp - 8], 0x69662053
mov word [ebp - 4], 0x656c
mov byte [ebp - 2], 0x2e
mov byte [ebp - 1], 0
push dword [0x401743]
push 0
push 0x406
push dword [0x401066]
call dword [sym.imp.USER32.DLL_SendMessageA]
push 0
push 0
push 0x402
push dword [0x401066]
call dword [sym.imp.USER32.DLL_SendMessageA]
push 0
push 1
push 0x404
push dword [0x401066]
call dword [sym.imp.USER32.DLL_SendMessageA]
push 0
push pe_nt_image_headers32
push 2
push 0
push 0
push 0xc0000000
push 0x401747
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov dword [ebp - 0x884], eax
cmp dword [ebp - 0x884], 0
je 0x403175
ret
push 0x40194f
call dword [sym.imp.KERNEL32.DLL_SetCurrentDirectoryA]
push 0x401747
call 0x402f54
push edx
inc ebp
push ebx
and byte [esi + 0x69], ah
insb byte es:[edi], dx
cmp ah, byte gs:[eax]
and eax, 0x958d0073
xor bh, 0xff
call dword [edx - 1]
adc eax, sym.imp.USER32.DLL_wsprintfA
add esp, 0xc
lea eax, [ebp - 0x880]
mov dword [0x4016b7], eax
push 0x40169f
push 0
push 0x1100
push dword [0x401062]
call dword [sym.imp.USER32.DLL_SendMessageA]
push 0
push 0x40106e
push 0x14
call 0x402faa
push ebx
inc ebx
jb 0x402ffe
popal
insd dword es:[edi], dx
and byte [edx + 0x65], dh
jae 0x40300f
jne 0x403014
arpl word [ebp + 0x20], sp
imul bp, word [ebp], 0xb5ff
jl 0x402fa5
invalid
add bh, al
inc ebp
in al, 0
add byte [eax], al
add byte [ecx], dh
sar byte [eax + 0x60], cl
xor edx, edx
mov eax, 0x60
mul dword [ebp - 0x1c]
mov edx, dword [0x401076]
in al, 0x8b
adc eax, 0x401076
inc eax
add byte [ecx], al
ret 0x458d
add edx, eax
lea eax, [ebp - 0x7c]
push 0x60
push eax
push edx
call fcn.00403d7e
push 0
push 0x40106e
push 0x5c
lea edx, [ebp - 0x7c]
push edx
push dword [ebp - 0x884]
call dword [sym.imp.KERNEL32.DLL_WriteFile]
inc dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
cmp ecx, dword [0x401743]
jne 0x403006
mov dword [ebp - 0x1c], 0
xor edx, edx
mov eax, 0x60
mul dword [ebp - 0x1c]
mov edx, dword [0x401076]
add edx, eax
lea eax, [ebp - 0x7c]
push 0x60
push eax
push edx
call fcn.00403d7e
push 0x40194f
lea edx, [ebp - 0x880]
push edx
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
call 0x403089
pop esp
add byte [ebp - 0x87f6b], cl
call dword [edx - 1]
adc eax, sym.imp.KERNEL32.DLL_lstrcatA
lea edx, [ebp - 0x7c]
push edx
lea edx, [ebp - 0x880]
push edx
call dword [sym.imp.KERNEL32.DLL_lstrcatA]
push 0
push pe_nt_image_headers32
push 3
push 0
push 0
push 0x80000000
lea edx, [ebp - 0x880]
push edx
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov dword [ebp - 0x888], eax
cmp dword [ebp - 0x888], 0
je 0x403131
push dword [ebp - 0x24]
push 0x40
call dword [sym.imp.KERNEL32.DLL_GlobalAlloc]
mov dword [ebp - 0x80], eax
push 0
push 0x40106e
push dword [ebp - 0x24]
push dword [ebp - 0x80]
push dword [ebp - 0x888]
call dword [sym.imp.KERNEL32.DLL_ReadFile]
push 0
push 0x40106e
push dword [ebp - 0x24]
push dword [ebp - 0x80]
push dword [ebp - 0x884]
call dword [sym.imp.KERNEL32.DLL_WriteFile]
mov eax, dword [0x40106e]
push dword [ebp - 0x80]
call dword [sym.imp.KERNEL32.DLL_GlobalFree]
push dword [ebp - 0x888]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
jmp 0x403131
push 0
push 0
push 0x405
push dword [0x401066]
call dword [sym.imp.USER32.DLL_SendMessageA]
inc dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
cmp ecx, dword [0x401743]
jne 0x403052
push dword [ebp - 0x884]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
call 0x40316d
inc ebx
cmp bl, byte [eax + eax - 1]
adc eax, sym.imp.KERNEL32.DLL_SetCurrentDirectoryA
jmp 0x403195
lea eax, [ebp - 0x18]
mov dword [0x4016b7], eax
push 0x40169f
push 0
push 0x1100
push dword [0x401062]
call dword [sym.imp.USER32.DLL_SendMessageA]
push 0x66
push dword [0x40101e]
call dword [sym.imp.USER32.DLL_GetDlgItem]
push 1
push eax
call dword [sym.imp.USER32.DLL_EnableWindow]
push 0x68
push dword [0x40101e]
call dword [sym.imp.USER32.DLL_GetDlgItem]
push 1
push eax
call dword [sym.imp.USER32.DLL_EnableWindow]
push 0x65
push dword [0x40101e]
call dword [sym.imp.USER32.DLL_GetDlgItem]
push 1
push eax
call dword [sym.imp.USER32.DLL_EnableWindow]
push 0
push 0
push 0x402
push dword [0x401066]
call dword [sym.imp.USER32.DLL_SendMessageA]
leave
ret