Function at 0x40a380
Capabilities:
Contain obfuscated stackstrings
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4e0894
mov eax, dword fs:[0]
push eax
sub esp, 0x7d0
mov eax, dword [0x5265f0]
xor eax, esp
mov dword [esp + 0x7c8], eax
push ebx
push esi
push edi
mov eax, dword [0x5265f0]
xor eax, esp
push eax
lea eax, [esp + 0x7e0]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x24], edi
mov dword [esp + 0x2c], vtable.CCapture.0
xor ebx, ebx
mov dword [esp + 0x7e8], ebx
mov eax, dword [edi + 4]
cmp eax, 0x100
mov esi, dword [0x52f854]
jne 0x40a693
cmp esi, ebx
fld dword [0x505b90]
fstp dword [esp + 0x14]
je 0x40a416
mov eax, dword [esi]
mov edx, dword [eax + 0x88]
push ebx
push ebx
mov ecx, esi
call edx
fmul qword [0x505be8]
fstp dword [esp + 0x14]
mov eax, dword [edi + 8]
cmp eax, 0x74
jne 0x40a5be
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax + 0x94]
push ebx
push ebx
push 0x132f
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 5
ja case.default.0x40a443
jmp dword [eax*4 + 0x40a910]
fldz
fld dword [esp + 0x14]
fcom st(1)
fnstsw ax
fstp st(1)
test ah, 0x41
jne 0x40a46b
call fcn.004c51b0
push eax
push str.cpu__d.bmp
jmp 0x40a552
xor eax, eax
fstp st(0)
push eax
push str.cpu__d.bmp
jmp 0x40a552
push str.cache.bmp
lea eax, [esp + 0x4d8]
push pe_nt_image_headers32
push eax
call fcn.004225f0
add esp, 0xc
jmp 0x40a567
fldz
fld dword [esp + 0x14]
fcom st(1)
fnstsw ax
fstp st(1)
test ah, 0x41
jne 0x40a4c7
call fcn.004c51b0
push eax
push str.mainboard.bmp
push pe_nt_image_headers32
lea ecx, [esp + 0x4e0]
push ecx
jmp 0x40a55f
xor eax, eax
fstp st(0)
push eax
push str.mainboard.bmp
push pe_nt_image_headers32
lea ecx, [esp + 0x4e0]
push ecx
jmp 0x40a55f
fldz
fld dword [esp + 0x14]
fcom st(1)
fnstsw ax
fstp st(1)
test ah, 0x41
jne 0x40a4fe
call fcn.004c51b0
push eax
push str.memory__d.bmp
jmp 0x40a552
xor eax, eax
fstp st(0)
push eax
push str.memory__d.bmp
jmp 0x40a552
push str.spd.bmp
jmp 0x40a47f
push str.graphics.bmp
lea ecx, [esp + 0x4d8]
push pe_nt_image_headers32
push ecx
call fcn.004225f0
add esp, 0xc
jmp 0x40a567
fldz
fld dword [esp + 0x14]
fcom st(1)
fnstsw ax
fstp st(1)
test ah, 0x41
jne 0x40a548
call fcn.004c51b0
jmp 0x40a54c
fstp st(0)
xor eax, eax
push eax
push str.snap__d.bmp
push pe_nt_image_headers32
lea edx, [esp + 0x4e0]
push edx
call fcn.004225f0
add esp, 0x10
push ebx
push ebx
push pe_nt_image_headers32
lea eax, [esp + 0x6e0]
push eax
push 0xffffffffffffffff
lea ecx, [esp + 0x4e8]
push ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push 0x4f8ed4
lea edx, [esp + 0x6d8]
push edx
lea eax, [esp + 0x28]
push eax
call fcn.004c3608
mov ecx, dword [esp + 0x2c]
add esp, 0xc
push ecx
call fcn.00403f80
mov edx, dword [esp + 0x20]
push edx
call fcn.004c2f55
add esp, 4
jmp 0x40a8e0
cmp eax, 0x75
jne 0x40a5ce
push ebx
call fcn.00403f80
jmp 0x40a8e0
cmp eax, 0x76
jne 0x40a621
fldz
fld dword [esp + 0x14]
fcom st(1)
fnstsw ax
fstp st(1)
test ah, 0x41
jne 0x40a5eb
call fcn.004c51b0
jmp 0x40a5ef
fstp st(0)
xor eax, eax
push eax
push str.cpuz__d.cvf
lea eax, [esp + 0x4dc]
push pe_nt_image_headers32
push eax
call fcn.004225f0
add esp, 0x10
lea ecx, [esp + 0x4d4]
push ecx
push 0x52f7a8
call fcn.00408e30
jmp 0x40a8e0
cmp eax, 0x77
jne 0x40a674
fldz
fld dword [esp + 0x14]
fcom st(1)
fnstsw ax
fstp st(1)
test ah, 0x41
jne 0x40a63e
call fcn.004c51b0
jmp 0x40a642
fstp st(0)
xor eax, eax
push eax
push str.cpuz__d.txt
lea edx, [esp + 0x4dc]
push pe_nt_image_headers32
push edx
call fcn.004225f0
add esp, 0x10
lea eax, [esp + 0x4d4]
push eax
mov eax, 0x52f7a8
call fcn.00409040
jmp 0x40a8e0
cmp eax, 0x78
jne 0x40a8e0
xor ecx, ecx
cmp dword [0x5310e0], ebx
sete cl
mov dword [0x5310e0], ecx
jmp 0x40a8e0
cmp eax, 0x104
jne 0x40a8e0
cmp dword [edi + 8], 0x79
jne 0x40a8e0
mov ecx, 0x52f7a8
call fcn.004b4391
push 0xc
call fcn.004b3e57
add esp, 4
mov dword [esp + 0x18], eax
cmp eax, ebx
mov byte [esp + 0x7e8], 1
je 0x40a6db
mov ecx, eax
call fcn.00422160
mov edi, eax
mov dword [esp + 0x14], edi
jmp 0x40a6e1
mov dword [esp + 0x14], ebx
mov edi, ebx
mov byte [esp + 0x7e8], 0
mov edx, dword [edi]
mov eax, dword [edx + 0xc]
mov ecx, edi
call eax
mov ecx, dword [edi]
mov edx, dword [ecx + 0x20]
push 0x530c88
push 0x4f7398
push 0x4f73a0
push str.CPU_Z_version
push edi
call edx
mov eax, dword [esi]
mov edx, dword [eax + 0x240]
add esp, 0x14
push edi
mov ecx, esi
call edx
mov eax, dword [edi + 8]
mov esi, dword [eax - 0xc]
add edi, 8
cmp dword [eax - 4], 1
jle 0x40a737
mov eax, esi
push eax
mov ecx, edi
call fcn.00401170
mov ecx, dword [edi]
lea ebx, [esi + 0x10]
push 0x4000
mov dword [esp + 0x1c], ecx
mov byte [esp + 0x4b0], 0x6d
mov byte [esp + 0x4b1], 0x55
mov byte [esp + 0x4b2], 0x37
mov byte [esp + 0x4b3], 0x33
mov byte [esp + 0x4b4], 0x36
mov byte [esp + 0x4b5], 0x4a
mov byte [esp + 0x4b6], 0x6a
mov byte [esp + 0x4b7], 0x39
mov byte [esp + 0x4b8], 0x6b
mov byte [esp + 0x4b9], 0x45
mov byte [esp + 0x4ba], 0x30
mov byte [esp + 0x4bb], 0x42
mov byte [esp + 0x4bc], 0x66
mov byte [esp + 0x4bd], 0x64
mov byte [esp + 0x4be], 0x67
mov byte [esp + 0x4bf], 0x31
mov byte [esp + 0x4c0], 0
and ebx, 0xfffffff0
call fcn.004b3e82
add esp, 4
push 0x4000
mov edi, eax
push 0
push edi
call fcn.004c43d0
mov edx, dword [esp + 0x24]
add esp, 0xc
push esi
push edx
push 0x4000
push edi
call fcn.004c3b7b
add esp, 0x10
mov dword [esp + 0x34], vtable.CRJK.0
mov byte [esp + 0x38], 0
lea eax, [esp + 0x4ac]
push eax
lea esi, [esp + 0x38]
mov byte [esp + 0x7ec], 2
call fcn.00419a40
push ebx
mov edx, edi
mov ecx, edi
mov eax, esi
call fcn.0041a4f0
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
push str.CPUZ.dat
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [esp + 0x18], eax
je 0x40a8aa
xor esi, esi
test ebx, ebx
jle 0x40a8a3
lea esp, [esp]
movzx ecx, byte [esi + edi]
push ecx
push str._02x
lea edx, [esp + 0x4d4]
push 8
push edx
call fcn.004c3b7b
mov edx, dword [esp + 0x28]
add esp, 0x10
push 0
lea eax, [esp + 0x2c]
push eax
push 2
lea ecx, [esp + 0x4d8]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
add esi, 1
cmp esi, ebx
jl 0x40a860
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call fcn.004b3e87
mov esi, dword [esp + 0x18]
mov byte [esp + 0x7ec], 0
mov eax, dword [esi]
mov edx, dword [eax + 0x10]
add esp, 4
mov ecx, esi
call edx
mov eax, dword [esi]
mov edx, dword [eax]
push 1
mov ecx, esi
call edx
mov ecx, 0x52f7a8
call fcn.004b43a6
mov edi, dword [esp + 0x24]
mov ecx, dword [esp + 0x1c]
push edi
call fcn.004b4817
mov ecx, dword [esp + 0x7e0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x7c8]
xor ecx, esp
call fcn.004c2fd1
mov esp, ebp
pop ebp
ret 4