Function at 0x4115af
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2e4
mov eax, dword [0x438330]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov byte [ebp - 0x14], 0
mov byte [ebp - 0x13], 0
mov byte [ebp - 0x12], 0
mov byte [ebp - 0x11], 0
mov byte [ebp - 0x10], 0
mov byte [ebp - 0xf], 0
mov byte [ebp - 0xe], 0
mov byte [ebp - 0xd], 0
mov byte [ebp - 0x1c], 0
mov byte [ebp - 0x1b], 0
mov byte [ebp - 0x1a], 0
mov byte [ebp - 0x19], 0
mov byte [ebp - 0x18], 0
mov byte [ebp - 0x17], 0
mov byte [ebp - 0x16], 0
mov byte [ebp - 0x15], 0
mov byte [ebp - 0x3c], 0
xor eax, eax
mov dword [ebp - 0x3b], eax
mov dword [ebp - 0x37], eax
mov dword [ebp - 0x33], eax
mov dword [ebp - 0x2f], eax
mov dword [ebp - 0x2b], eax
mov dword [ebp - 0x27], eax
mov dword [ebp - 0x23], eax
mov word [ebp - 0x1f], ax
mov byte [ebp - 0x1d], al
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x48], 0
xor eax, eax
mov word [ebp - 0x4c], ax
mov dword [ebp - 0x240], 0
push 0x1ee
push 0
lea eax, [ebp - 0x23c]
push eax
call fcn.00418940
add esp, 0xc
mov byte [ebp - 0x2a0], 0
push 0x5f
push 0
lea eax, [ebp - 0x29f]
push eax
call fcn.00418940
add esp, 0xc
push str._iCreateKeyFile_:_Will_create_keyfile
push 3
call fcn.0040ebe0
add esp, 8
push 1
mov eax, dword [ebp + 8]
add eax, 0x10
push eax
call sub.DVCOPY32.dll_Ordinal_6
push 0x42ccbc
mov eax, dword [ebp + 8]
add eax, 0x10
push eax
call fcn.00417fc3
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4114ec
push str._iCreateKeyFile_:_Cant_create_keyfile__
push 2
call fcn.0040ebe0
add esp, 8
or eax, 0xffffffff
jmp 0x41193c
mov eax, dword [ebp + 8]
add eax, 0x26a
push eax
call sub.SBTIME32.dll_Ordinal_1_1
mov eax, dword [ebp + 8]
add eax, 0x26a
push eax
call fcn.00414a80
add esp, 4
push eax
push str._iCreateKeyFile_:_Takeover:__s
push 4
call fcn.0040ebe0
add esp, 0xc
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x266]
add ecx, 1
mov edx, dword [ebp + 8]
mov dword [edx + 0x266], ecx
mov eax, dword [ebp + 8]
mov dword [eax + 0x26e], 1
mov eax, dword [ebp + 8]
cmp dword [eax + 0x238], 1
jne 0x411561
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x26e]
or ecx, 0x10000
mov edx, dword [ebp + 8]
mov dword [edx + 0x26e], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x234]
mov dword [ebp - 0x2e4], ecx
mov edx, dword [ebp - 0x2e4]
sub edx, 1
mov dword [ebp - 0x2e4], edx
cmp dword [ebp - 0x2e4], 4
ja case.0x41158e.1
mov eax, dword [ebp - 0x2e4]
jmp dword [eax*4 + 0x411950]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x26e]
or ecx, 0x10000000
mov edx, dword [ebp + 8]
mov dword [edx + 0x26e], ecx
jmp case.0x41158e.1
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x26e]
or ecx, 0x30000000
mov edx, dword [ebp + 8]
mov dword [edx + 0x26e], ecx
jmp case.0x41158e.1
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x26e]
or ecx, 0x50000000
mov edx, dword [ebp + 8]
mov dword [edx + 0x26e], ecx
jmp case.0x41158e.1
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x26e]
or ecx, 0x40000000
mov edx, dword [ebp + 8]
mov dword [edx + 0x26e], ecx
mov eax, dword [ebp + 8]
cmp dword [eax + 0x234], 4
je 0x411613
mov eax, dword [ebp + 8]
cmp dword [eax + 0x234], 5
jne 0x411653
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.00419c39
add esp, 4
xor eax, eax
mov word [ebp - 0x4c], ax
jmp 0x411636
mov ax, word [ebp - 0x4c]
add ax, 1
mov word [ebp - 0x4c], ax
movzx eax, word [ebp - 0x4c]
cmp eax, 0x20
jge 0x41164e
call fcn.00419c18
movzx ecx, word [ebp - 0x4c]
mov byte [ebp + ecx - 0x3c], al
jmp 0x41162a
jmp 0x4116f2
push 8
mov eax, dword [ebp + 8]
add eax, 0x388
push eax
mov ecx, 1
imul edx, ecx, 0
lea eax, [ebp + edx - 0x3c]
push eax
call fcn.00418250
add esp, 0xc
mov eax, dword [ebp + 8]
cmp dword [eax + 0x234], 3
jne 0x4116a1
push 8
mov eax, dword [ebp + 8]
add eax, 0x390
push eax
mov ecx, 1
shl ecx, 3
lea edx, [ebp + ecx - 0x3c]
push edx
call fcn.00418250
add esp, 0xc
jmp 0x4116bc
push 8
lea eax, [ebp - 0x14]
push eax
mov ecx, 1
shl ecx, 3
lea edx, [ebp + ecx - 0x3c]
push edx
call fcn.00418250
add esp, 0xc
push 8
lea eax, [ebp - 0x14]
push eax
mov ecx, 1
shl ecx, 4
lea edx, [ebp + ecx - 0x3c]
push edx
call fcn.00418250
add esp, 0xc
push 8
lea eax, [ebp - 0x1c]
push eax
mov ecx, 1
imul edx, ecx, 0x18
lea eax, [ebp + edx - 0x3c]
push eax
call fcn.00418250
add esp, 0xc
push str._iCreateKeyFile_:_Key__hex_
push 5
call fcn.0040ebe0
add esp, 8
push 0x20
lea eax, [ebp - 0x3c]
push eax
push 5
call fcn.0040e880
push 0
push 0x20
lea eax, [ebp - 0x3c]
push eax
call sub.Crypto32.dll_Ordinal_5_1
mov ecx, dword [ebp + 8]
mov word [ecx + 0x260], ax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x234]
mov dword [ebp - 0x2e4], ecx
mov edx, dword [ebp - 0x2e4]
sub edx, 1
mov dword [ebp - 0x2e4], edx
cmp dword [ebp - 0x2e4], 4
ja case.0x411756.1
mov eax, dword [ebp - 0x2e4]
jmp dword [eax*4 + 0x411964]
mov eax, dword [ebp + 8]
add eax, 0x3a8
push eax
mov ecx, dword [ebp + 8]
add ecx, 0x380
push ecx
call sub.Crypto32.dll_Ordinal_3_1
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 8]
add eax, 0x272
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x48], 0
jmp 0x411798
mov eax, dword [ebp - 0x48]
add eax, 1
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 4
jae 0x4117c8
mov eax, dword [ebp + 8]
add eax, 0x3a8
push eax
mov ecx, dword [ebp - 0x44]
push ecx
mov edx, dword [ebp - 0x40]
push edx
call sub.Crypto32.dll_Ordinal_1_2
mov eax, dword [ebp - 0x40]
add eax, 8
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x44]
add eax, 8
mov dword [ebp - 0x44], eax
jmp 0x41178f
jmp case.0x411756.1
push 0x20
lea eax, [ebp - 0x3c]
push eax
mov ecx, dword [ebp + 8]
add ecx, 0x272
push ecx
call fcn.00418250
add esp, 0xc
mov eax, dword [ebp + 8]
add eax, 0x320
push eax
lea ecx, [ebp - 0x2a0]
push ecx
call sub.Crypto32.dll_Ordinal_6_2
add esp, 8
mov eax, dword [ebp + 8]
add eax, 0x272
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x48], 0
jmp 0x41181a
mov eax, dword [ebp - 0x48]
add eax, 1
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 2
jae 0x41183e
mov eax, dword [ebp - 0x40]
push eax
lea ecx, [ebp - 0x2a0]
push ecx
call sub.Crypto32.dll_Ordinal_7
add esp, 8
mov eax, dword [ebp - 0x40]
add eax, 0x10
mov dword [ebp - 0x40], eax
jmp 0x411811
lea eax, [ebp - 0x2a0]
push eax
call sub.Crypto32.dll_Ordinal_9_1
add esp, 4
jmp case.0x411756.1
push 0x20
lea eax, [ebp - 0x3c]
push eax
mov ecx, dword [ebp + 8]
add ecx, 0x272
push ecx
call fcn.00418250
add esp, 0xc
push 1
push 0x10
mov eax, dword [ebp + 8]
add eax, 0x320
push eax
push 0
lea ecx, [ebp - 0x240]
push ecx
call sub.Crypto32.dll_Ordinal_10_2
add esp, 0x14
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 8]
add eax, 0x272
mov dword [ebp - 0x44], eax
push 0x20
mov eax, dword [ebp - 0x44]
push eax
mov ecx, dword [ebp - 0x40]
push ecx
lea edx, [ebp - 0x240]
push edx
call sub.Crypto32.dll_Ordinal_11
add esp, 0x10
push str._iCreateKeyFile_:_Crypted_keydata__hex_:
push 5
call fcn.0040ebe0
add esp, 8
push 0x20
mov eax, dword [ebp + 8]
add eax, 0x272
push eax
push 5
call fcn.0040e880
mov eax, dword [ebp - 8]
push eax
push 1
push 0x3a
mov ecx, dword [ebp + 8]
add ecx, 0x258
push ecx
call fcn.00419b96
add esp, 0x10
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x26e]
and ecx, 0xffff
mov edx, dword [ebp + 8]
mov dword [edx + 0x26e], ecx
cmp dword [ebp - 0xc], 1
je 0x41192b
push str._iCreateKeyFile_:_Can
push 2
call fcn.0040ebe0
add esp, 8
mov eax, dword [ebp - 8]
push eax
call fcn.00417e88
add esp, 4
or eax, 0xffffffff
jmp 0x41193c
mov eax, dword [ebp - 8]
push eax
call fcn.00417e88
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00418922
mov esp, ebp
pop ebp
ret 4