Function at 0x4034c0
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [esp + 4]
push ebx
push ebp
push esi
push edi
xor edi, edi
xor ebp, ebp
dec eax
je 0x403810
dec eax
je 0x4036b4
dec eax
jne 0x4039d7
mov ebx, dword [esp + 0x18]
push edi
lea eax, [esp + 0x18]
push edi
push eax
push edi
push edi
push 4
push 4
push ebx
mov dword [esp + 0x34], edi
call sub.ADVAPI32.dll_GetNamedSecurityInfoW
mov ebp, eax
cmp ebp, edi
jne 0x40352e
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_IsValidAcl]
test eax, eax
jne 0x403609
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
cmp ebp, 0x538
jne 0x40360d
mov ebp, 5
mov al, byte [0x411042]
test al, al
jne 0x403544
mov al, byte [0x411041]
test al, al
je 0x4039d7
mov eax, dword [0x41e04c]
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, edi
je 0x4035cf
push str.DALS
push str.Key__43EA7BB31D4DD114FAF09271F90BD965_open_failed_r_n
call fcn.0040762a
add esp, 8
or ecx, 0xffffffff
xor eax, eax
push edi
mov edi, str.Key__43EA7BB31D4DD114FAF09271F90BD965_open_failed_r_n
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x41e048
push ecx
mov ecx, dword [0x41e04c]
push str.Key__43EA7BB31D4DD114FAF09271F90BD965_open_failed_r_n
push ecx
call esi
mov eax, dword [0x41e04c]
test eax, eax
je 0x4035cf
push ebx
push str._from_key__ls
push str.Key__43EA7BB31D4DD114FAF09271F90BD965_open_failed_r_n
call fcn.0040762a
mov edi, str.Key__43EA7BB31D4DD114FAF09271F90BD965_open_failed_r_n
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
mov edx, dword [0x41e04c]
push 0
not ecx
dec ecx
push 0x41e048
push ecx
push str.Key__43EA7BB31D4DD114FAF09271F90BD965_open_failed_r_n
push edx
call esi
mov eax, dword [0x41e04c]
cmp ebp, 2
je 0x4036a2
cmp ebp, 3
je 0x4036a2
cmp ebp, 5
jne 0x403682
test eax, eax
je 0x4039d7
push str.____FAILED__Error__ERROR_ACCESS_DENIED_r_n
push str.Key__43EA7BB31D4DD114FAF09271F90BD965_open_failed_r_n
call fcn.0040762a
add esp, 8
jmp 0x403971
xor ebp, ebp
jmp 0x403615
cmp ebp, edi
jne 0x40352e
mov al, byte [0x411042]
test al, al
je 0x4039d7
cmp dword [0x41e04c], edi
je 0x4039d7
push str.DALS
push str.Key__43EA7BB31D4DD114FAF09271F90BD965_open_failed_r_n
call fcn.0040762a
add esp, 8
or ecx, 0xffffffff
xor eax, eax
mov edx, dword [0x41e04c]
push edi
mov edi, str.Key__43EA7BB31D4DD114FAF09271F90BD965_open_failed_r_n
repne scasb al, byte es:[edi]
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
push 0x41e048
not ecx
dec ecx
push ecx
push str.Key__43EA7BB31D4DD114FAF09271F90BD965_open_failed_r_n
push edx
call esi
mov eax, dword [0x41e04c]
test eax, eax
je 0x4039d7
push ebx
push str._from_key__ls____OK_r_n
jmp 0x403964
test eax, eax
je 0x4039d7
push ebp
push str.____FAILED__Error___d_r_n
push str.Key__43EA7BB31D4DD114FAF09271F90BD965_open_failed_r_n
call fcn.0040762a
add esp, 0xc
jmp 0x4039b2
test eax, eax
je 0x4039d7
push str.____NOT_FOUND__OK__r_n
jmp 0x403918
mov ebx, dword [esp + 0x18]
push edi
push edi
lea eax, [esp + 0x1c]
push edi
push eax
push edi
push 2
push 4
push ebx
mov dword [esp + 0x34], edi
call sub.ADVAPI32.dll_GetNamedSecurityInfoW
mov ebp, eax
cmp ebp, edi
jne 0x4036f8
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_IsValidSid]
test eax, eax
jne 0x4037b9
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
cmp ebp, edi
je 0x4039d7
mov al, byte [0x411042]
test al, al
jne 0x40370e
mov al, byte [0x411041]
test al, al
je 0x4039d7
mov eax, dword [0x41e04c]
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, edi
je 0x403798
push str.GROUP
push str.Key__43EA7BB31D4DD114FAF09271F90BD965_open_failed_r_n
call fcn.0040762a
add esp, 8
or ecx, 0xffffffff
xor eax, eax
mov edx, dword [0x41e04c]
push edi
mov edi, str.Key__43EA7BB31D4DD114FAF09271F90BD965_open_failed_r_n
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x41e048
push ecx
push str.Key__43EA7BB31D4DD114FAF09271F90BD965_open_failed_r_n
push edx
call esi
mov eax, dword [0x41e04c]
test eax, eax
je 0x403798
push ebx
push str._from_key__ls
push str.Key__43EA7BB31D4DD114FAF09271F90BD965_open_failed_r_n
call fcn.0040762a
mov edi, str.Key__43EA7BB31D4DD114FAF09271F90BD965_open_failed_r_n
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
mov eax, dword [0x41e04c]
push 0
not ecx
dec ecx
push 0x41e048
push ecx
push str.Key__43EA7BB31D4DD114FAF09271F90BD965_open_failed_r_n
push eax
call esi
mov eax, dword [0x41e04c]
cmp ebp, 2
je 0x4037f1
cmp ebp, 3
je 0x4037f1
cmp ebp, 5
jne 0x4037d1
test eax, eax
je 0x4039d7
push str.____FAILED__Error__ERROR_ACCESS_DENIED_r_n
jmp 0x4039a5
mov eax, dword [esp + 0x14]
cmp eax, edi
jne 0x4037c8
push edi
call dword [sym.imp.ADVAPI32.dll_FreeSid]
xor ebp, ebp
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
ret
test eax, eax
je 0x4039d7
push ebp
push str.____FAILED__Error___d_r_n
push str.Key__43EA7BB31D4DD114FAF09271F90BD965_open_failed_r_n
call fcn.0040762a
add esp, 0xc
jmp 0x403925
test eax, eax
je 0x4039d7
push str.____NOT_FOUND__OK__r_n
push str.Key__43EA7BB31D4DD114FAF09271F90BD965_open_failed_r_n
call fcn.0040762a
add esp, 8
jmp 0x403971
mov ebx, dword [esp + 0x18]
push edi
push edi
push edi
lea ecx, [esp + 0x20]
push edi
push ecx
push 1
push 4
push ebx
mov dword [esp + 0x34], edi
call sub.ADVAPI32.dll_GetNamedSecurityInfoW
mov ebp, eax
cmp ebp, edi
jne 0x403854
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_IsValidSid]
test eax, eax
jne 0x403951
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
cmp ebp, edi
je 0x4039d7
mov al, byte [0x411042]
test al, al
jne 0x40386a
mov al, byte [0x411041]
test al, al
je 0x4039d7
mov eax, dword [0x41e04c]
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, edi
je 0x4038f4
push str.OWNER
push str.Key__43EA7BB31D4DD114FAF09271F90BD965_open_failed_r_n
call fcn.0040762a
add esp, 8
or ecx, 0xffffffff
xor eax, eax
push edi
mov edi, str.Key__43EA7BB31D4DD114FAF09271F90BD965_open_failed_r_n
repne scasb al, byte es:[edi]
mov eax, dword [0x41e04c]
push 0x41e048
not ecx
dec ecx
push ecx
push str.Key__43EA7BB31D4DD114FAF09271F90BD965_open_failed_r_n
push eax
call esi
mov eax, dword [0x41e04c]
test eax, eax
je 0x4038f4
push ebx
push str._from_key__ls
push str.Key__43EA7BB31D4DD114FAF09271F90BD965_open_failed_r_n
call fcn.0040762a
mov edi, str.Key__43EA7BB31D4DD114FAF09271F90BD965_open_failed_r_n
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
push 0
dec ecx
push 0x41e048
push ecx
mov ecx, dword [0x41e04c]
push str.Key__43EA7BB31D4DD114FAF09271F90BD965_open_failed_r_n
push ecx
call esi
mov eax, dword [0x41e04c]
cmp ebp, 2
je 0x40399c
cmp ebp, 3
je 0x40399c
cmp ebp, 5
jne 0x40395a
test eax, eax
je 0x4039d7
push str.____FAILED__Error__ERROR_ACCESS_DENIED_r_n
push str.Key__43EA7BB31D4DD114FAF09271F90BD965_open_failed_r_n
call fcn.0040762a
add esp, 8
mov edi, str.Key__43EA7BB31D4DD114FAF09271F90BD965_open_failed_r_n
or ecx, 0xffffffff
xor eax, eax
mov edx, dword [0x41e04c]
repne scasb al, byte es:[edi]
not ecx
push 0
dec ecx
push 0x41e048
push ecx
push str.Key__43EA7BB31D4DD114FAF09271F90BD965_open_failed_r_n
push edx
call esi
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
ret
mov eax, dword [esp + 0x14]
jmp 0x4037bd
test eax, eax
je 0x4039d7
push ebp
push str.____FAILED__Error___d_r_n
push str.Key__43EA7BB31D4DD114FAF09271F90BD965_open_failed_r_n
call fcn.0040762a
add esp, 0xc
mov edi, str.Key__43EA7BB31D4DD114FAF09271F90BD965_open_failed_r_n
or ecx, 0xffffffff
xor eax, eax
push 0
repne scasb al, byte es:[edi]
mov eax, dword [0x41e04c]
push 0x41e048
not ecx
dec ecx
push ecx
push str.Key__43EA7BB31D4DD114FAF09271F90BD965_open_failed_r_n
push eax
call esi
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
ret
test eax, eax
je 0x4039d7
push str.____NOT_FOUND__OK__r_n
push str.Key__43EA7BB31D4DD114FAF09271F90BD965_open_failed_r_n
call fcn.0040762a
add esp, 8
mov edi, str.Key__43EA7BB31D4DD114FAF09271F90BD965_open_failed_r_n
or ecx, 0xffffffff
xor eax, eax
push 0
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x41e048
push ecx
mov ecx, dword [0x41e04c]
push str.Key__43EA7BB31D4DD114FAF09271F90BD965_open_failed_r_n
push ecx
call esi
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
ret