Function at 0x404400
Capabilities:
Contain obfuscated stackstrings
Resolve function by parsing pe exports
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0xf3c
cmp byte [eax + 0x74], 0
je 0x4047d0
lea eax, [ebp - 0x30]
mov dword [esp + 4], eax
lea eax, [ebx + 8]
mov dword [esp], eax
call fcn.00410300
cmp byte [0x41a558], 0
jne 0x404802
mov byte [ebp - 0x26], 0
mov eax, dword [0x41a130]
cmp eax, 1
je 0x404830
jae 0x404841
mov eax, dword [ebx + 0x44]
mov edx, dword [ebx + 0x40]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], edx
cmp byte [0x41a136], 0
lea esi, [ebp - 0xef0]
mov edi, esi
je 0x4044f3
cmp byte [ebx + 0x74], 0
mov eax, 0x414496
je 0x4044a0
mov edx, dword [ebx + 0x14]
mov ecx, dword [ebx + 0x10]
mov esi, edx
or esi, ecx
je 0x4044a0
lea eax, [ebp - 0x575]
mov dword [esp + 8], eax
mov dword [esp], ecx
mov dword [esp + 4], edx
call fcn.0040bb30
lea esi, [esi]
mov dword [esp + 0xc], eax
mov eax, dword [0x41a55c]
lea esi, [ebp - 0xef0]
mov dword [esp + 4], str._s
mov dword [esp], esi
mov dword [esp + 8], eax
call sub.cygwin1.dll_sprintf
mov edx, esi
mov ecx, dword [edx]
add edx, 4
lea eax, [ecx - 0x1010101]
not ecx
and eax, ecx
and eax, 0x80808080
je 0x4044c5
mov ecx, eax
shr ecx, 0x10
test eax, 0x8080
cmove eax, ecx
lea edi, [edx + 2]
cmovne edi, edx
add al, al
sbb edi, 3
cmp byte [0x41a091], 0
je 0x404567
cmp byte [ebx + 0x74], 0
mov edx, 0x414496
jne 0x404b87
mov ecx, dword [0x41a560]
mov dword [esp], edx
mov dword [ebp - 0xf08], edx
mov dword [esp + 4], 0
mov dword [ebp - 0xf0c], ecx
call fcn.0040a380
mov ecx, dword [ebp - 0xf0c]
mov edx, dword [ebp - 0xf08]
sub ecx, eax
mov eax, edi
test ecx, ecx
jle 0x404551
xor eax, eax
mov byte [edi + eax], 0x20
add eax, 1
cmp eax, ecx
jne 0x404543
lea eax, [edi + eax]
movzx ecx, byte [edx]
add edx, 1
lea edi, [eax + 1]
test cl, cl
mov byte [eax], cl
jne 0x404857
mov byte [eax], 0x20
cmp byte [ebx + 0x74], 0
mov eax, 0x414496
jne 0x404965
mov dword [esp + 0x10], eax
mov eax, dword [0x41a564]
mov dword [esp], edi
mov dword [esp + 4], str._s__s
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x30]
mov dword [esp + 8], eax
call sub.cygwin1.dll_sprintf
mov dword [esp], edi
call sub.cygwin1.dll_strlen
add edi, eax
cmp byte [0x41a095], 0
jne 0x404931
cmp byte [0x4140c0], 0
jne 0x4045d0
cmp byte [0x4140d0], 0
jne 0x4045d0
cmp byte [0x41a160], 0
je 0x4049d0
call sub.cygwin1.dll___getreent
sub edi, esi
mov eax, dword [eax + 8]
mov dword [esp], esi
mov dword [esp + 4], eax
call sub.cygwin1.dll_fputs
add dword [0x41a118], edi
cmp byte [0x4140c0], 0
jne 0x404b48
cmp byte [0x4140d0], 0
je 0x40461f
cmp byte [ebx + 0x74], 0
mov eax, 0x414496
mov ecx, dword [0x41a56c]
mov edx, dword [ebx + 0x24]
jne 0x404988
call fcn.00402470
cmp byte [0x41a160], 0
jne 0x404b12
cmp byte [0x41a090], 0
mov edi, esi
jne 0x404b33
cmp byte [ebx + 0x74], 0
mov edx, 0x414496
je 0x4046ae
mov eax, dword [ebx + 0x18]
and eax, 0xf000
cmp eax, 0x6000
je 0x4049e2
cmp eax, 0x2000
je 0x4049e2
mov eax, dword [0x4140c8]
mov edx, dword [0x4140cc]
mov dword [esp + 0x10], 1
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], eax
mov eax, dword [0x41a150]
mov dword [esp + 0x1c], edx
mov edx, dword [ebx + 0x34]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x18c]
mov dword [esp + 8], eax
mov eax, dword [ebx + 0x30]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.0040ae30
mov edx, eax
mov ecx, dword [0x41a580]
mov dword [esp], edx
mov dword [ebp - 0xf08], edx
mov dword [esp + 4], 0
mov dword [ebp - 0xf0c], ecx
call fcn.0040a380
mov ecx, dword [ebp - 0xf0c]
mov edx, dword [ebp - 0xf08]
sub ecx, eax
test ecx, ecx
jle 0x4046f1
xor eax, eax
mov byte [edi + eax], 0x20
add eax, 1
cmp eax, ecx
jne 0x4046e4
add edi, eax
movzx eax, byte [edx]
add edx, 1
lea ecx, [edi + 1]
test al, al
mov byte [edi], al
jne 0x404850
mov dword [ebp - 0xefc], ecx
mov byte [edi], 0x20
lea eax, [ebp - 0x24]
mov edi, 0x414496
mov dword [esp], eax
call sub.cygwin1.dll_localtime
mov edx, dword [ebp - 0xefc]
mov byte [edx], 1
cmp byte [ebx + 0x74], 0
jne 0x404860
mov eax, dword [0x4140e0]
test eax, eax
js 0x404c5b
mov edx, dword [ebp - 0xefc]
mov dword [esp + 0xc], edi
mov dword [esp + 8], eax
mov dword [esp + 4], str._s
mov dword [esp], edx
call sub.cygwin1.dll_sprintf
mov ecx, dword [ebp - 0xefc]
mov dword [esp], ecx
call sub.cygwin1.dll_strlen
mov edi, dword [ebp - 0xefc]
add edi, eax
call sub.cygwin1.dll___getreent
sub edi, esi
mov eax, dword [eax + 8]
mov dword [esp], esi
mov esi, edi
mov dword [esp + 4], eax
call sub.cygwin1.dll_fputs
mov ecx, 0x41a0a0
xor edx, edx
mov eax, ebx
add dword [0x41a118], edi
mov dword [esp], edi
call fcn.00403bc0
mov ecx, dword [ebx + 0x68]
cmp ecx, 6
mov edi, eax
je 0x404aa1
mov edx, dword [0x41a04c]
test edx, edx
je 0x4047c4
mov edx, dword [ebx + 0x18]
movzx eax, byte [ebx + 0x74]
call fcn.00401500
add esp, 0xf3c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [eax + 0x68]
cmp byte [0x41a558], 0
mov dword [ebp - 0x2f], 0x3f3f3f3f
mov dword [ebp - 0x2b], 0x3f3f3f3f
movzx eax, byte [eax + str._pcdb_lswd]
mov word [ebp - 0x27], 0x3f3f
mov byte [ebp - 0x25], 0
mov byte [ebp - 0x30], al
je 0x404437
mov eax, dword [ebx + 0x78]
cmp eax, 1
je 0x4049c0
cmp eax, 2
jne 0x40443b
mov eax, dword [0x41a130]
mov byte [ebp - 0x26], 0x2b
cmp eax, 1
jne 0x404449
lea esi, [esi]
mov eax, dword [ebx + 0x4c]
mov edx, dword [ebx + 0x48]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], edx
jmp 0x40445b
cmp eax, 2
je 0x404920
call sub.cygwin1.dll_abort
nop
mov edi, ecx
jmp 0x4046f1
mov eax, edi
jmp 0x404551
test eax, eax
je 0x404bf4
mov ecx, dword [0x41a030]
mov edx, dword [0x41a02c]
mov edi, dword [ebp - 0x24]
mov dword [ebp - 0xf04], ecx
mov ecx, dword [ebp - 0x20]
cmp edx, edi
mov dword [ebp - 0xf00], ecx
jl 0x404c20
jg 0x40489c
cmp dword [ebp - 0xf04], ecx
js 0x404c20
lea ecx, [edx - 0xf0c2ac]
cmp ecx, edi
jge 0x404b60
cmp edx, edi
mov dword [ebp - 0xf1c], 1
jg 0x4048e0
mov dword [ebp - 0xf1c], 0
jl 0x4048e0
mov edx, dword [ebp - 0xf00]
sub edx, dword [ebp - 0xf04]
shr edx, 0x1f
mov dword [ebp - 0xf1c], edx
lea esi, [esi]
mov ecx, dword [ebp - 0xf1c]
mov edx, dword [ecx*4 + 0x4140d4]
mov ecx, dword [ebp - 0xf00]
mov dword [esp], ecx
mov ecx, eax
mov eax, dword [ebp - 0xefc]
call fcn.00404330
test eax, eax
je 0x404bd6
add eax, dword [ebp - 0xefc]
mov byte [eax], 0x20
lea edi, [eax + 1]
mov byte [eax + 1], 0
jmp 0x404771
mov eax, dword [ebx + 0x3c]
mov edx, dword [ebx + 0x38]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], edx
jmp 0x40445b
call sub.cygwin1.dll___getreent
mov eax, dword [eax + 8]
mov dword [esp + 8], 2
mov dword [esp + 4], 1
mov dword [esp], 0x414521
mov dword [esp + 0xc], eax
call sub.cygwin1.dll_fwrite
add dword [0x41a118], 2
jmp 0x4045b1
lea eax, [ebp - 0x575]
mov dword [esp + 8], eax
movzx eax, word [ebx + 0x1c]
mov dword [esp + 4], 0
mov dword [esp], eax
call fcn.0040bb30
jmp 0x404576
xor eax, eax
cmp byte [0x41a135], 0
jne 0x40461a
mov dword [esp], edx
mov dword [ebp - 0xf08], edx
mov dword [ebp - 0xf0c], ecx
call fcn.0040a540
mov ecx, dword [ebp - 0xf0c]
mov edx, dword [ebp - 0xf08]
jmp 0x40461a
mov byte [ebp - 0x26], 0x2e
jmp 0x40443b
cmp byte [0x41a090], 0
je 0x40463b
jmp 0x4045d0
lea eax, [ebp - 0x18c]
mov edx, 0xfffffffe
mov dword [esp + 8], eax
movzx eax, word [ebx + 0x28]
sub edx, dword [0x41a578]
sub edx, dword [0x41a57c]
add edx, dword [0x41a580]
mov ecx, eax
sar ecx, 0x1f
mov dword [ebp - 0xf08], edx
mov dword [esp + 4], ecx
mov dword [esp], eax
call fcn.0040bb30
mov dword [ebp - 0xf00], eax
mov eax, dword [0x41a57c]
mov dword [ebp - 0xefc], eax
lea eax, [ebp - 0x575]
mov dword [esp + 8], eax
movzx eax, word [ebx + 0x2a]
mov ecx, eax
sar ecx, 0x1f
mov dword [esp + 4], ecx
mov dword [esp], eax
call fcn.0040bb30
mov ecx, dword [ebp - 0xf00]
mov edx, dword [ebp - 0xf08]
mov dword [esp + 4], str._s___s
mov dword [esp], edi
mov dword [esp + 0x14], ecx
mov ecx, dword [ebp - 0xefc]
mov dword [esp + 0xc], eax
xor eax, eax
test edx, edx
cmovns eax, edx
add eax, dword [0x41a578]
mov dword [esp + 0x10], ecx
mov dword [esp + 8], eax
call sub.cygwin1.dll_sprintf
mov eax, dword [0x41a580]
lea eax, [edi + eax + 1]
mov dword [ebp - 0xefc], eax
jmp 0x40470d
mov eax, dword [ebx + 4]
test eax, eax
je 0x4047c4
call sub.cygwin1.dll___getreent
mov eax, dword [eax + 8]
mov dword [esp + 8], 4
mov dword [esp + 4], 1
mov dword [esp], str.___
mov dword [esp + 0xc], eax
call sub.cygwin1.dll_fwrite
lea eax, [esi + edi + 4]
xor ecx, ecx
mov dword [esp], eax
mov edx, 1
mov eax, ebx
add dword [0x41a118], 4
call fcn.00403bc0
mov ecx, dword [0x41a04c]
test ecx, ecx
je 0x4047c4
mov edx, dword [ebx + 0x6c]
xor ecx, ecx
mov eax, 1
call fcn.00401500
jmp 0x4047c4
movzx ecx, byte [ebx + 0x74]
mov edi, esi
mov eax, dword [ebx + 0x20]
mov edx, dword [0x41a570]
call fcn.004025a0
cmp byte [0x41a090], 0
je 0x40463b
mov eax, dword [ebx + 0x70]
xor edx, edx
mov ecx, dword [0x41a574]
call fcn.00402470
jmp 0x40463b
movzx ecx, byte [ebx + 0x74]
mov eax, dword [ebx + 0x20]
mov edx, dword [0x41a568]
call fcn.004025a0
jmp 0x4045f9
mov dword [ebp - 0xf1c], 0
jg 0x4048e0
mov ecx, dword [ebp - 0xf00]
cmp dword [ebp - 0xf04], ecx
jns 0x4048e0
jmp 0x4048aa
mov eax, dword [0x41a158]
mov edx, dword [0x41a15c]
mov dword [esp + 0x10], 0x400
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], eax
mov eax, dword [0x41a14c]
mov dword [esp + 0x1c], edx
mov edx, dword [ebx + 0x5c]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x18c]
mov dword [esp + 8], eax
mov eax, dword [ebx + 0x58]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.0040ae30
mov edx, eax
jmp 0x40450b
mov edx, dword [ebp - 0xefc]
cmp byte [edx], 0
je 0x40490b
cmp byte [ebx + 0x74], 0
mov edi, 0x414496
je 0x404730
lea eax, [ebp - 0x18c]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x24]
mov ecx, eax
sar ecx, 0x1f
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.00410320
mov edi, eax
jmp 0x404730
mov dword [ebp - 0xf08], eax
mov dword [esp], 0x41a02c
call fcn.004103f0
mov ecx, dword [0x41a030]
mov edx, dword [0x41a02c]
mov edi, dword [ebp - 0x24]
mov eax, dword [ebp - 0xf08]
mov dword [ebp - 0xf04], ecx
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0xf00], ecx
jmp 0x40489c
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0
mov dword [esp], eax
call sub.cygwin1.dll_localtime
test eax, eax
je 0x404c8f
mov edx, dword [str._b__e___Y]
mov ecx, eax
lea eax, [ebp - 0x575]
mov dword [esp], 0
call fcn.00404330
test eax, eax
jne 0x404cad
mov eax, dword [0x4140e0]
test eax, eax
jns 0x40473d
mov dword [0x4140e0], 0
xor eax, eax
jmp 0x40473d
mov dword [esp + 4], eax
lea eax, [ebp - 0x575]
mov dword [esp + 8], 0
mov dword [esp], eax
call fcn.0040a190
mov dword [0x4140e0], eax
jmp 0x404c94