Function at 0x415d31
Capabilities:
Clear file content
Contain obfuscated stackstrings
Encode data using xor
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10140
call fcn.00425e20
mov eax, dword [0x44de90]
push esi
push edi
push dword [ebp + 0xc]
mov dword [ebp - 4], eax
push str.Decrypting_using_key0x_x..
call fcn.00425036
pop ecx
pop ecx
xor esi, esi
push esi
push 0x80
push 3
push esi
push 1
push 0xc0000000
push dword [ebp + 8]
call dword [0x451df8]
mov edi, eax
cmp edi, 0xffffffff
je 0x415f67
cmp edi, esi
je 0x415f67
mov eax, dword [ebp + 0xc]
xor edx, edx
mov dword [ebp - 0x1013c], esi
mov byte [ebp - 0x1c], 0x30
mov byte [ebp - 0x1b], 0x4f
mov byte [ebp - 0x1a], 0x9d
mov byte [ebp - 0x19], 0x67
mov byte [ebp - 0x18], 0xbf
mov byte [ebp - 0x17], 5
mov byte [ebp - 0x16], 0xd6
mov byte [ebp - 0x15], 0x25
mov byte [ebp - 0x14], 0xc5
mov byte [ebp - 0x13], 0xf5
mov byte [ebp - 0x12], 0x12
mov byte [ebp - 0x11], 0x39
mov byte [ebp - 0x10], 0xb6
mov byte [ebp - 0xf], 0x60
mov byte [ebp - 0xe], 0xbe
mov byte [ebp - 0xd], 0x43
mov byte [ebp - 0xc], 0xb2
mov byte [ebp - 0xb], 0xfc
mov byte [ebp - 0xa], 0x4d
mov byte [ebp - 9], 0xa
mov byte [ebp - 8], 0x8d
mov byte [ebp - 7], 0xc0
mov byte [ebp - 6], 0xc9
mov byte [ebp - 5], 0x87
xor ecx, ecx
push ebx
mov ebx, eax
mov byte [ebp + ecx - 0x34], al
shl ebx, 0x18
shr eax, 8
or eax, ebx
inc edx
cmp edx, 4
jne 0x415e14
mov ebx, eax
xor edx, edx
shl ebx, 0x18
shr eax, 8
inc edx
or eax, ebx
inc ecx
cmp ecx, 0x18
jb 0x415df3
push 0x18
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x138]
push eax
call fcn.00415c10
push 0x18
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x138]
push eax
call fcn.00415c6f
add esp, 0x18
xor eax, eax
mov cl, byte [ebp + eax - 0x1c]
xor byte [ebp + eax - 0x34], cl
inc eax
cmp eax, 0x18
jb 0x415e43
push 2
push esi
push 0xfffffffffffffff9
push edi
mov dword [ebp - 0x10140], esi
call dword [0x451e40]
push esi
lea eax, [ebp - 0x1013c]
push eax
push 7
lea eax, [ebp - 0x10138]
push eax
push edi
call dword [0x451e3c]
test eax, eax
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
je 0x415eaf
cmp dword [ebp - 0x1013c], esi
jbe 0x415eaf
push esi
push esi
push esi
push edi
call dword [0x451e40]
push esi
lea eax, [ebp - 0x10140]
push eax
push dword [ebp - 0x1013c]
lea eax, [ebp - 0x10138]
push eax
push edi
call ebx
push esi
push esi
push 7
push edi
call dword [0x451e40]
push 0x18
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x138]
push eax
call fcn.00415c10
add esp, 0xc
jmp 0x415f1c
mov eax, dword [ebp - 0x1013c]
cmp eax, esi
jbe 0x415f38
push 1
push esi
neg eax
push eax
push edi
call dword [0x451e40]
push dword [ebp - 0x1013c]
lea eax, [ebp - 0x10138]
push eax
lea eax, [ebp - 0x138]
push eax
call fcn.00415cd6
add esp, 0xc
push esi
lea eax, [ebp - 0x10140]
push eax
push dword [ebp - 0x1013c]
lea eax, [ebp - 0x10138]
push eax
push edi
call ebx
push esi
lea eax, [ebp - 0x1013c]
push eax
push 7
lea eax, [ebp - 0x10138]
push eax
push edi
call dword [0x451e3c]
test eax, eax
jne 0x415ed1
push 2
push esi
push 0xfffffffffffffff9
push edi
call dword [0x451e40]
push edi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp + 8]
push str._ok._n
call fcn.00425036
pop ecx
pop ecx
push 3
pop eax
pop ebx
jmp 0x415f69
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
call fcn.00425221
leave
ret