Function at 0x402360
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x403e30
mov eax, dword fs:[0]
push eax
sub esp, 0x2a8
mov eax, dword [0x407004]
xor eax, esp
mov dword [esp + 0x2a0], eax
push ebx
push esi
push edi
mov eax, dword [0x407004]
xor eax, esp
push eax
lea eax, [esp + 0x2b8]
mov dword fs:[0], eax
lea ecx, [esp + 0x50]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_void_]
lea eax, [esp + 0x50]
push eax
mov dword [esp + 0x2c4], 0
call fcn.00402be0
add esp, 4
cmp eax, 0xffffffff
je 0x4027aa
mov esi, dword [esp + 0x54]
mov edi, 8
cmp dword [esp + 0x68], edi
jae 0x4023de
lea esi, [esp + 0x54]
push 0x1000
push 0
push str..KDT_.cpp_257_:_Windows_Version:_d._d._d
call sub.MSVCR80.dll_memset
add esp, 0xc
push str.Got_parent_process:__s
push 0x228
push 0x40533c
push str._s__d_:__s
push 0x1000
push str..KDT_.cpp_257_:_Windows_Version:_d._d._d
call dword [sym.imp.MSVCR80.dll_swprintf_s]
push esi
push str..KDT_.cpp_257_:_Windows_Version:_d._d._d
mov ecx, 4
mov ebx, 0x4093b0
call fcn.00403090
add esp, 0x20
lea ecx, [esp + 0x24]
push ecx
lea ecx, [esp + 0x54]
call dword [sym.imp.MSVCP80.dll_public:_class_std::_String_iterator_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t_____thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::begin_void_]
lea edx, [esp + 0x2c]
push edx
lea ecx, [esp + 0x54]
mov esi, eax
call dword [sym.imp.MSVCP80.dll_public:_class_std::_String_iterator_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t_____thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::end_void_]
mov ebx, eax
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x54]
call dword [sym.imp.MSVCP80.dll_public:_class_std::_String_iterator_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t_____thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::begin_void_]
mov ecx, dword [esi + 4]
mov edx, dword [esi]
push ecx
mov ecx, dword [ebx + 4]
push edx
mov edx, dword [ebx]
push ecx
mov ecx, dword [eax + 4]
push edx
mov edx, dword [eax]
mov eax, dword [sym.imp.MSVCR80.dll_tolower]
push ecx
push edx
push eax
lea ecx, [esp + 0x30]
push ecx
call fcn.00402830
mov edx, dword [sym.imp.MSVCP80.dll_unsigned_int_const_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::npos]
mov eax, dword [edx]
add esp, 0x20
push eax
push str..exe
lea ecx, [esp + 0x58]
call dword [sym.imp.MSVCP80.dll_public:_unsigned_int___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::rfind_wchar_t_const___unsigned_int_const]
mov ecx, dword [sym.imp.MSVCP80.dll_unsigned_int_const_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::npos]
cmp eax, dword [ecx]
lea ecx, [esp + 0x50]
je 0x4027f3
push eax
push 0
lea edx, [esp + 0x3c]
push edx
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t_____thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::substr_unsigned_int__unsigned_int_]
push eax
lea ecx, [esp + 0x54]
mov byte [esp + 0x2c4], 1
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const__]
lea ecx, [esp + 0x34]
mov byte [esp + 0x2c0], 0
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
mov eax, dword [sym.imp.MSVCP80.dll_unsigned_int_const_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::npos]
mov ecx, dword [eax]
push ecx
push 0x405750
lea ecx, [esp + 0x58]
call dword [sym.imp.MSVCP80.dll_public:_unsigned_int___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::find_last_of_wchar_t_const___unsigned_int_const]
mov edx, dword [sym.imp.MSVCP80.dll_unsigned_int_const_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::npos]
cmp eax, dword [edx]
jne 0x40251e
push 0x23d
push 0x405754
call fcn.00401000
add esp, 8
mov ecx, eax
jmp 0x4027ea
mov ecx, dword [sym.imp.MSVCP80.dll_unsigned_int_const_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::npos]
mov edx, dword [ecx]
push edx
add eax, 1
push eax
lea eax, [esp + 0x74]
push eax
lea ecx, [esp + 0x5c]
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t_____thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::substr_unsigned_int__unsigned_int_]
mov byte [esp + 0x2c0], 2
cmp dword [esp + 0x80], 0x20
je 0x40259a
cmp dword [esp + 0x84], edi
mov eax, dword [esp + 0x70]
jae 0x40255d
lea eax, [esp + 0x70]
push eax
push 0x244
push str.MD5_size_invalid:__s
call fcn.00401000
add esp, 8
push eax
mov ecx, 4
mov ebx, 0x4093b0
call fcn.00403090
add esp, 8
lea ecx, [esp + 0x6c]
mov byte [esp + 0x2c0], 0
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
jmp 0x4027ef
lea ecx, [esp + 0x88]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_void_]
lea esi, [esp + 0xa4]
mov byte [esp + 0x2c0], 3
call fcn.004014c0
mov ecx, esi
push ecx
lea ecx, [esp + 0x8c]
call dword [0x4050fc]
push str.reg.md5
lea ecx, [esp + 0x8c]
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_wchar_t_const__]
cmp dword [esp + 0xa0], edi
mov eax, dword [esp + 0x8c]
mov dword [esp + 0x10], 0
jae 0x4025fc
lea eax, [esp + 0x8c]
push 0x4057b4
push eax
lea edx, [esp + 0x18]
push edx
call dword [sym.imp.MSVCR80.dll__wfopen_s]
add esp, 0xc
test eax, eax
jne 0x402768
cmp dword [esp + 0x10], eax
je 0x402768
cmp dword [esp + 0x84], edi
mov eax, dword [esp + 0x70]
jae 0x402633
lea eax, [esp + 0x70]
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov esi, eax
lea edi, [esi + 1]
push edi
call fcn.00403370
add esp, 4
push edi
mov ebx, eax
push 0
push ebx
call sub.MSVCR80.dll_memset
mov eax, dword [esp + 0x7c]
add esp, 0xc
cmp dword [esp + 0x84], 8
jae 0x402676
lea eax, [esp + 0x70]
push 0
push 0
push esi
push ebx
or edi, 0xffffffff
push edi
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov eax, dword [esp + 0x10]
push eax
push esi
push 1
push ebx
call dword [sym.imp.MSVCR80.dll_fwrite]
add esp, 0x10
cmp eax, esi
je 0x4026ff
push 0x269
push str.Could_not_write_reg.md5
call fcn.00401000
add esp, 8
mov ecx, eax
call fcn.00402fc0
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.MSVCR80.dll_fclose]
add esp, 4
lea ecx, [esp + 0x88]
mov byte [esp + 0x2c0], 2
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
lea ecx, [esp + 0x6c]
mov byte [esp + 0x2c0], 0
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
mov dword [esp + 0x2c0], edi
lea ecx, [esp + 0x50]
jmp 0x4027fe
push 0x26f
push str.Write_reg.md5_succeed
call fcn.00401000
add esp, 8
mov ecx, eax
call fcn.00402fc0
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.MSVCR80.dll_fclose]
add esp, 4
lea ecx, [esp + 0x88]
mov byte [esp + 0x2c0], 2
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
lea ecx, [esp + 0x6c]
mov byte [esp + 0x2c0], 0
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
lea ecx, [esp + 0x50]
mov dword [esp + 0x2c0], edi
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
mov eax, 1
jmp 0x402806
push 0x25c
push str.Could_not_open_reg.md5
call fcn.00401000
add esp, 8
mov ecx, eax
call fcn.00402fc0
lea ecx, [esp + 0x88]
mov byte [esp + 0x2c0], 2
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
lea ecx, [esp + 0x6c]
mov byte [esp + 0x2c0], 0
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
jmp 0x4027ef
push 0x1000
push 0
push str..KDT_.cpp_257_:_Windows_Version:_d._d._d
call sub.MSVCR80.dll_memset
add esp, 0xc
push str.Did_not_get_parent_process
push 0x225
push 0x40533c
push str._s__d_:__s
push 0x1000
push str..KDT_.cpp_257_:_Windows_Version:_d._d._d
call dword [sym.imp.MSVCR80.dll_swprintf_s]
add esp, 0x18
mov ecx, str..KDT_.cpp_257_:_Windows_Version:_d._d._d
call fcn.00402fc0
lea ecx, [esp + 0x50]
mov dword [esp + 0x2c0], 0xffffffff
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
xor eax, eax
mov ecx, dword [esp + 0x2b8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x2a0]
xor ecx, esp
call fcn.0040342c
mov esp, ebp
pop ebp
ret