Function at 0x407590
Capabilities:
Delete file
Encode data using xor
Write file on windows

Disassembly:
sub esp, 0x110
mov eax, dword [0x417018]
xor eax, esp
mov dword [esp + 0x10c], eax
mov eax, dword [0x43373c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x433340
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x4075ff
mov eax, dword [0x433a34]
add eax, 1
cmp eax, 3
mov dword [0x433a34], eax
jl 0x407609
push 0x40030
push 0x41446c
push 0x4151b0
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
mov ecx, dword [esp + 0x10c]
xor ecx, esp
call fcn.0040999a
add esp, 0x110
ret
mov dword [0x433a34], 0
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push 0x433340
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [0x43373c], eax
je 0x4075e8
push esi
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
push 0
lea ecx, [esp + 0xc]
push ecx
push 4
push 0x414458
push eax
call esi
mov eax, dword [0x43373c]
push 0
lea edx, [esp + 0xc]
push edx
push 4
push 0x433220
push eax
call esi
mov edx, dword [0x43373c]
push 0
lea ecx, [esp + 0xc]
push ecx
push 4
push 0x433114
push edx
call esi
mov ecx, dword [0x43373c]
push 0
lea eax, [esp + 0xc]
push eax
push 4
push 0x417cd0
push ecx
call esi
mov eax, dword [0x43373c]
push 0
lea edx, [esp + 0xc]
push edx
push 4
push 0x417cd4
push eax
call esi
mov edx, dword [0x43373c]
push 0
lea ecx, [esp + 0xc]
push ecx
push 4
push 0x433544
push edx
call esi
mov ecx, dword [0x43373c]
push 0
lea eax, [esp + 0xc]
push eax
push 4
push 0x433330
push ecx
call esi
mov eax, dword [0x43373c]
push 0
lea edx, [esp + 0xc]
push edx
push 4
push 0x4337a0
push eax
call esi
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
push 0x433010
call edi
push 0
lea ecx, [esp + 0xc]
push ecx
push 4
lea edx, [esp + 0x18]
mov dword [esp + 0x18], eax
mov eax, dword [0x43373c]
push edx
push eax
call esi
push 0
lea ecx, [esp + 0xc]
mov edx, dword [esp + 0x10]
mov eax, dword [0x43373c]
push ecx
push edx
push 0x433010
push eax
call esi
mov edx, dword [0x43373c]
push 0
lea ecx, [esp + 0xc]
push ecx
push 4
push 0x4339d0
push edx
call esi
mov ecx, dword [0x43373c]
push 0
lea eax, [esp + 0xc]
push eax
push 4
push 0x4337a8
push ecx
call esi
mov eax, dword [0x43373c]
push 0
lea edx, [esp + 0xc]
push edx
push 4
push 0x433540
push eax
call esi
cmp dword [0x433540], 0
je 0x4077d2
push 0x433118
call edi
push 0
lea ecx, [esp + 0xc]
push ecx
push 4
lea edx, [esp + 0x18]
mov dword [esp + 0x18], eax
mov eax, dword [0x43373c]
push edx
push eax
call esi
push 0x433118
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ecx, dword [esp + 0xc]
xor eax, eax
test ecx, ecx
jle 0x4077bc
nop
xor byte [esp + eax + 0x10], 0x45
add eax, 1
cmp eax, ecx
jl 0x4077b0
push 0
lea edx, [esp + 0xc]
push edx
push ecx
mov ecx, dword [0x43373c]
lea eax, [esp + 0x1c]
push eax
push ecx
call esi
mov eax, dword [0x43373c]
push 0
lea edx, [esp + 0xc]
push edx
push 4
push 0x43333c
push eax
call esi
mov edx, dword [0x43373c]
push 0
lea ecx, [esp + 0xc]
push ecx
push 4
push 0x433224
push edx
call esi
mov ecx, dword [0x43373c]
push 0
lea eax, [esp + 0xc]
push eax
push 4
push 0x417cdc
push ecx
call esi
mov eax, dword [0x43373c]
push 0
lea edx, [esp + 0xc]
push edx
push 4
push 0x417ce0
push eax
call esi
mov edx, dword [0x43373c]
push 0
lea ecx, [esp + 0xc]
push ecx
push 4
push 0x417ce4
push edx
call esi
mov ecx, dword [0x43373c]
push 0
lea eax, [esp + 0xc]
push eax
push 4
push 0x417ce8
push ecx
call esi
mov eax, dword [0x43373c]
push 0
lea edx, [esp + 0xc]
push edx
push 4
push 0x417cec
push eax
call esi
mov edx, dword [0x43373c]
push 0
lea ecx, [esp + 0xc]
push ecx
push 4
push 0x4339f4
push edx
call esi
mov ecx, dword [0x43373c]
push 0
lea eax, [esp + 0xc]
push eax
push 4
push 0x4339f8
push ecx
call esi
push 0x417d34
call edi
push 0
lea edx, [esp + 0xc]
push edx
mov dword [esp + 0x14], eax
push 4
lea eax, [esp + 0x18]
push eax
mov ecx, dword [0x43373c]
push ecx
call esi
mov eax, dword [esp + 0xc]
mov ecx, dword [0x43373c]
push 0
lea edx, [esp + 0xc]
push edx
push eax
push 0x417d34
push ecx
call esi
push 0x417d24
call edi
mov ecx, dword [0x43373c]
push 0
lea edx, [esp + 0xc]
push edx
mov dword [esp + 0x14], eax
push 4
lea eax, [esp + 0x18]
push eax
push ecx
call esi
mov eax, dword [esp + 0xc]
mov ecx, dword [0x43373c]
push 0
lea edx, [esp + 0xc]
push edx
push eax
push 0x417d24
push ecx
call esi
push 0x417d68
call edi
mov ecx, dword [0x43373c]
push 0
lea edx, [esp + 0xc]
push edx
mov dword [esp + 0x14], eax
push 4
lea eax, [esp + 0x18]
push eax
push ecx
call esi
mov eax, dword [esp + 0xc]
mov ecx, dword [0x43373c]
push 0
lea edx, [esp + 0xc]
push edx
push eax
push 0x417d68
push ecx
call esi
push str.000000
call edi
mov ecx, dword [0x43373c]
push 0
lea edx, [esp + 0xc]
push edx
mov dword [esp + 0x14], eax
push 4
lea eax, [esp + 0x18]
push eax
push ecx
call esi
mov eax, dword [esp + 0xc]
mov ecx, dword [0x43373c]
push 0
lea edx, [esp + 0xc]
push edx
push eax
push str.000000
push ecx
call esi
mov eax, dword [0x43373c]
push 0
lea edx, [esp + 0xc]
push edx
push 4
push 0x433730
push eax
call esi
mov edx, dword [0x43373c]
push 0
lea ecx, [esp + 0xc]
push ecx
push 4
push 0x433734
push edx
call esi
mov ecx, dword [0x43373c]
push 0
lea eax, [esp + 0xc]
push eax
push 4
push 0x433a04
push ecx
call esi
mov eax, dword [0x43373c]
push 0
lea edx, [esp + 0xc]
push edx
push 4
push 0x433a0c
push eax
call esi
mov edx, dword [0x43373c]
push 0
lea ecx, [esp + 0xc]
push ecx
push 4
push 0x433a14
push edx
call esi
mov ecx, dword [0x43373c]
push 0
lea eax, [esp + 0xc]
push eax
push 4
push 0x43321c
push ecx
call esi
mov eax, dword [0x43373c]
push 0
lea edx, [esp + 0xc]
push edx
push 4
push 0x43379c
push eax
call esi
mov edx, dword [0x43373c]
push 0
lea ecx, [esp + 0xc]
push ecx
push 4
push 0x4337a4
push edx
call esi
mov ecx, dword [0x43373c]
push 0
lea eax, [esp + 0xc]
push eax
push 4
push 0x432de8
push ecx
call esi
mov eax, dword [0x43373c]
push 0
lea edx, [esp + 0xc]
push edx
push 4
push 0x43332c
push eax
call esi
mov edx, dword [0x43373c]
push 0
lea ecx, [esp + 0xc]
push ecx
push 4
push 0x433338
push edx
call esi
push 0x417da8
call edi
mov edx, dword [0x43373c]
push 0
mov dword [esp + 0x10], eax
lea eax, [esp + 0xc]
push eax
push 4
lea ecx, [esp + 0x18]
push ecx
push edx
call esi
mov ecx, dword [esp + 0xc]
mov edx, dword [0x43373c]
push 0
lea eax, [esp + 0xc]
push eax
push ecx
push 0x417da8
push edx
call esi
mov ecx, dword [0x43373c]
push 0
lea eax, [esp + 0xc]
push eax
push 4
push 0x417da4
push ecx
call esi
mov eax, dword [0x43373c]
push 0
lea edx, [esp + 0xc]
push edx
push 4
push 0x433a2c
push eax
call esi
mov edx, dword [0x43373c]
push 0
lea ecx, [esp + 0xc]
push ecx
push 4
push 0x433a38
push edx
call esi
mov ecx, dword [0x43373c]
push 0
lea eax, [esp + 0xc]
push eax
push 4
push 0x433a3c
push ecx
call esi
mov eax, dword [0x43373c]
push 0
lea edx, [esp + 0xc]
push edx
push 4
push 0x417fbc
push eax
call esi
mov ecx, dword [0x43373c]
push ecx
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov ecx, dword [esp + 0x114]
pop edi
pop esi
xor ecx, esp
mov eax, 1
call fcn.0040999a
add esp, 0x110
ret