Function at 0x413c2c
Capabilities:
Encode data using xor
Get file size
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff960
push esi
push edi
mov byte [ebp - 0x41], dl
mov dword [ebp - 0x40], eax
mov eax, 0x4ccf04
call fcn.004b9cc0
mov byte [ebp - 0x49], 0x84
mov dx, word [0x4cb387]
mov word [ebp - 0x4b], dx
mov ecx, dword [0x4cb389]
mov dword [ebp - 0x50], ecx
mov cl, byte [0x4cb38d]
mov byte [ebp - 0x4c], cl
mov esi, 0x4cb38e
lea edi, [ebp - 0x1a8]
mov ecx, 0x4b
rep movsd dword es:[edi], dword [esi]
mov esi, 0x4cb4bc
lea edi, [ebp - 0x2c8]
mov ecx, 0x48
rep movsd dword es:[edi], dword [esi]
mov esi, 0x4cb5dc
lea edi, [ebp - 0x2e0]
mov ecx, 5
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov esi, 0x4cb5f2
lea edi, [ebp - 0x304]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov esi, 0x4cb613
lea edi, [ebp - 0x56c]
mov ecx, 0x9a
rep movsd dword es:[edi], dword [esi]
push 5
lea ecx, [ebp - 0x50]
mov dl, 0x1b
mov eax, dword [ebp - 0x40]
call fcn.00412b10
test eax, eax
je 0x413ce9
mov al, 4
mov edx, dword [ebp - 0x3c]
mov dword fs:[0], edx
jmp 0x414658
mov eax, dword [ebp - 0x40]
call fcn.004133b0
test eax, eax
je 0x413d06
mov al, 3
mov edx, dword [ebp - 0x3c]
mov dword fs:[0], edx
jmp 0x414658
cmp byte [0x4dead5], 9
je 0x413d20
mov al, 5
mov edx, dword [ebp - 0x3c]
mov dword fs:[0], edx
jmp 0x414658
push 0x10
push 0
lea ecx, [ebp - 0x7c]
push ecx
call fcn.004b98f0
add esp, 0xc
push 1
lea ecx, [ebp - 0x49]
mov dl, 0x1b
mov eax, dword [ebp - 0x40]
call fcn.00412b10
test eax, eax
je 0x413d54
mov al, 4
mov edx, dword [ebp - 0x3c]
mov dword fs:[0], edx
jmp 0x414658
mov eax, dword [ebp - 0x40]
call fcn.004133b0
test eax, eax
je 0x413d71
mov al, 3
mov edx, dword [ebp - 0x3c]
mov dword fs:[0], edx
jmp 0x414658
xor ecx, ecx
mov cl, byte [0x4dead6]
push ecx
push 0x4dead7
push 0x4deabe
call fcn.004b9880
add esp, 0xc
xor eax, eax
mov al, byte [0x4dead6]
push eax
push 0x4dead7
lea edx, [ebp - 0x7c]
push edx
call fcn.004b9880
add esp, 0xc
push 4
push 0x4cc522
lea ecx, [ebp - 0x7c]
push ecx
call fcn.004b9b4c
add esp, 0xc
test eax, eax
jne 0x413edc
mov word [ebp - 0x2c], 8
lea edx, [ebp - 0x7c]
lea eax, [ebp - 4]
call fcn.004c3c68
inc dword [ebp - 0x20]
mov edx, dword [eax]
mov eax, dword [sym.Project1.exe__Form3]
mov ecx, dword [eax]
mov eax, dword [ecx + 0x2d8]
call fcn.0048e39c
dec dword [ebp - 0x20]
lea eax, [ebp - 4]
mov edx, 2
call fcn.004c3e54
xor ecx, ecx
mov cl, byte [0x4deadf]
mov word [ebp - 0x52], cx
shl word [ebp - 0x52], 8
xor eax, eax
mov al, byte [0x4deade]
or word [ebp - 0x52], ax
mov dx, word [ebp - 0x52]
sub dx, 0x20
jne 0x413e24
mov byte [ebp - 0x43], 1
jmp 0x413e28
mov byte [ebp - 0x43], 0
push 5
xor ecx, ecx
mov cl, byte [ebp - 0x43]
imul ecx, ecx, 0xb
lea eax, [ebp - 0x2dc]
add ecx, eax
mov dl, 0x1b
mov eax, dword [ebp - 0x40]
call fcn.00412b10
test eax, eax
je 0x413e59
mov al, 4
mov edx, dword [ebp - 0x3c]
mov dword fs:[0], edx
jmp 0x414658
mov eax, dword [ebp - 0x40]
call fcn.004133b0
test eax, eax
je 0x413e76
mov al, 3
mov edx, dword [ebp - 0x3c]
mov dword fs:[0], edx
jmp 0x414658
cmp byte [0x4dead5], 9
jne 0x413edc
xor ecx, ecx
mov cl, byte [ebp - 0x43]
imul eax, ecx, 0xb
lea edx, [ebp - 0x2dc]
add eax, edx
mov dword [ebp - 0x48], eax
mov byte [0x4dec38], 1
xor ecx, ecx
mov cl, byte [ebp - 0x43]
imul eax, ecx, 0xb
mov dl, byte [ebp + eax - 0x2d7]
mov byte [0x4dec3b], dl
xor ecx, ecx
mov cl, byte [ebp - 0x43]
imul eax, ecx, 0xb
mov dl, byte [ebp + eax - 0x2d6]
mov byte [0x4dec3a], dl
mov dword [0x4dea60], 0x200
mov dword [0x4dea5c], 0x200
jmp 0x4144dd
push 4
push 0x4cc527
lea ecx, [ebp - 0x7c]
push ecx
call fcn.004b9b4c
add esp, 0xc
test eax, eax
je 0x413f0e
push 4
push 0x4cc52c
lea eax, [ebp - 0x7c]
push eax
call fcn.004b9b4c
add esp, 0xc
test eax, eax
jne 0x41409d
mov word [ebp - 0x2c], 0x14
lea edx, [ebp - 0x7c]
lea eax, [ebp - 8]
call fcn.004c3c68
inc dword [ebp - 0x20]
mov edx, dword [eax]
mov ecx, dword [sym.Project1.exe__Form3]
mov eax, dword [ecx]
mov eax, dword [eax + 0x2d8]
call fcn.0048e39c
dec dword [ebp - 0x20]
lea eax, [ebp - 8]
mov edx, 2
call fcn.004c3e54
xor ecx, ecx
mov cl, byte [0x4deae0]
mov word [ebp - 0x54], cx
shl word [ebp - 0x54], 8
xor eax, eax
mov al, byte [0x4deadf]
or word [ebp - 0x54], ax
movzx edx, word [ebp - 0x54]
cmp edx, 0x91
jg 0x413f9b
je 0x413fcc
cmp edx, 0x85
jg 0x413f8c
je 0x413fc6
sub edx, 0x60
je 0x413fd2
sub edx, 0x10
je 0x413fc6
sub edx, 0x10
je 0x413fd2
jmp 0x413fd8
sub edx, 0x88
je 0x413fcc
sub edx, 8
je 0x413fc6
jmp 0x413fd8
cmp edx, 0x200
jg 0x413fb4
je 0x413fcc
sub edx, 0x98
je 0x413fcc
sub edx, 0x68
je 0x413fcc
jmp 0x413fd8
sub edx, 0x210
je 0x413fcc
sub edx, 0xf0
je 0x413fcc
jmp 0x413fd8
mov byte [ebp - 0x43], 2
jmp 0x413fe9
mov byte [ebp - 0x43], 0
jmp 0x413fe9
mov byte [ebp - 0x43], 1
jmp 0x413fe9
mov al, 0xd
mov edx, dword [ebp - 0x3c]
mov dword fs:[0], edx
jmp 0x414658
push 5
xor ecx, ecx
mov cl, byte [ebp - 0x43]
imul ecx, ecx, 0xb
lea eax, [ebp - 0x300]
add ecx, eax
mov dl, 0x1b
mov eax, dword [ebp - 0x40]
call fcn.00412b10
test eax, eax
je 0x41401a
mov al, 4
mov edx, dword [ebp - 0x3c]
mov dword fs:[0], edx
jmp 0x414658
mov eax, dword [ebp - 0x40]
call fcn.004133b0
test eax, eax
je 0x414037
mov al, 3
mov edx, dword [ebp - 0x3c]
mov dword fs:[0], edx
jmp 0x414658
cmp byte [0x4dead5], 9
jne 0x41409d
xor ecx, ecx
mov cl, byte [ebp - 0x43]
imul eax, ecx, 0xb
lea edx, [ebp - 0x300]
add eax, edx
mov dword [ebp - 0x48], eax
mov byte [0x4dec38], 1
xor ecx, ecx
mov cl, byte [ebp - 0x43]
imul eax, ecx, 0xb
mov dl, byte [ebp + eax - 0x2fb]
mov byte [0x4dec3b], dl
xor ecx, ecx
mov cl, byte [ebp - 0x43]
imul eax, ecx, 0xb
mov dl, byte [ebp + eax - 0x2fa]
mov byte [0x4dec3a], dl
mov dword [0x4dea60], 0x800
mov dword [0x4dea5c], 0x800
jmp 0x4144dd
mov byte [ebp - 0x43], 0
cmp byte [ebp - 0x43], 0x2c
jae 0x4140d3
push 6
xor ecx, ecx
mov cl, byte [ebp - 0x43]
imul eax, ecx, 0xe
lea edx, [ebp - 0x56c]
add eax, edx
push eax
lea ecx, [ebp - 0x7c]
push ecx
call fcn.004b9b4c
add esp, 0xc
test eax, eax
je 0x4140d3
inc byte [ebp - 0x43]
cmp byte [ebp - 0x43], 0x2c
jb 0x4140a7
cmp byte [ebp - 0x43], 0x2c
je 0x41426c
mov word [ebp - 0x2c], 0x20
lea edx, [ebp - 0x7c]
lea eax, [ebp - 0xc]
call fcn.004c3c68
inc dword [ebp - 0x20]
mov edx, dword [eax]
mov eax, dword [sym.Project1.exe__Form3]
mov ecx, dword [eax]
mov eax, dword [ecx + 0x2d8]
call fcn.0048e39c
dec dword [ebp - 0x20]
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.004c3e54
push 5
xor ecx, ecx
mov cl, byte [ebp - 0x43]
imul ecx, ecx, 0xe
lea eax, [ebp - 0x566]
add ecx, eax
mov dl, 0x1b
mov eax, dword [ebp - 0x40]
call fcn.00412b10
test eax, eax
je 0x414146
mov al, 4
mov edx, dword [ebp - 0x3c]
mov dword fs:[0], edx
jmp 0x414658
mov eax, dword [ebp - 0x40]
call fcn.004133b0
test eax, eax
je 0x414163
mov al, 3
mov edx, dword [ebp - 0x3c]
mov dword fs:[0], edx
jmp 0x414658
cmp byte [0x4dead5], 9
jne 0x414269
xor ecx, ecx
mov cl, byte [ebp - 0x43]
imul eax, ecx, 0xe
lea edx, [ebp - 0x566]
add eax, edx
mov dword [ebp - 0x48], eax
push 2
lea ecx, [ebp - 0x4b]
mov dl, 0x1b
mov eax, dword [ebp - 0x40]
call fcn.00412b10
test eax, eax
je 0x4141a7
mov al, 4
mov edx, dword [ebp - 0x3c]
mov dword fs:[0], edx
jmp 0x414658
mov eax, dword [ebp - 0x40]
call fcn.004133b0
test eax, eax
je 0x4141c4
mov al, 3
mov edx, dword [ebp - 0x3c]
mov dword fs:[0], edx
jmp 0x414658
cmp byte [0x4dead5], 0x1b
jne 0x414217
xor ecx, ecx
mov cl, byte [ebp - 0x43]
mov eax, ecx
shl eax, 3
sub eax, ecx
mov dl, byte [ebp + eax*2 - 0x561]
mov eax, dword [ebp - 0x40]
call fcn.00414660
test al, al
je 0x4141fd
mov al, 3
mov edx, dword [ebp - 0x3c]
mov dword fs:[0], edx
jmp 0x414658
cmp byte [0x4dead5], 9
je 0x414217
mov al, 0x40
mov edx, dword [ebp - 0x3c]
mov dword fs:[0], edx
jmp 0x414658
mov byte [0x4dec38], 3
xor ecx, ecx
mov cl, byte [ebp - 0x43]
mov eax, ecx
shl eax, 3
sub eax, ecx
mov dl, byte [ebp + eax*2 - 0x560]
mov byte [0x4dec3b], dl
xor ecx, ecx
mov cl, byte [ebp - 0x43]
mov eax, ecx
shl eax, 3
sub eax, ecx
mov dl, byte [ebp + eax*2 - 0x55f]
mov byte [0x4dec3a], dl
mov dword [0x4dea60], 0x800
mov dword [0x4dea5c], 0x800
jmp 0x4144dd
inc byte [ebp - 0x43]
cmp byte [ebp - 0x43], 0x2c
jne 0x4140a1
mov byte [0x4dec3a], 0xff
mov dword [0x4dea60], 0x200
mov dword [0x4dea5c], 0x200
mov byte [ebp - 0x43], 0
push 2
xor ecx, ecx
mov cl, byte [ebp - 0x43]
shl ecx, 4
lea eax, [ebp - 0x2c8]
add ecx, eax
push ecx
lea edx, [ebp - 0x7a]
push edx
call fcn.004b9b4c
add esp, 0xc
test eax, eax
je 0x4142c1
inc byte [ebp - 0x43]
cmp byte [ebp - 0x43], 0x12
jb 0x414295
cmp byte [ebp - 0x43], 0x12
je 0x4143e8
xor ecx, ecx
mov cl, byte [ebp - 0x79]
mov word [ebp - 0x56], cx
shl word [ebp - 0x56], 8
xor eax, eax
mov al, byte [ebp - 0x7a]
or word [ebp - 0x56], ax
movzx edx, word [ebp - 0x56]
push edx
push 0x4cc531
push 0x4dead5
call fcn.004bb6d8
add esp, 0xc
mov word [ebp - 0x2c], 0x2c
mov edx, 0x4dead5
lea eax, [ebp - 0x10]
call fcn.004c3c68
inc dword [ebp - 0x20]
mov edx, dword [eax]
mov eax, dword [sym.Project1.exe__Form3]
mov ecx, dword [eax]
mov eax, dword [ecx + 0x2d8]
call fcn.0048e39c
dec dword [ebp - 0x20]
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.004c3e54
push 5
xor ecx, ecx
mov cl, byte [ebp - 0x43]
shl ecx, 4
lea eax, [ebp - 0x2c6]
add ecx, eax
mov dl, 0x1b
mov eax, dword [ebp - 0x40]
call fcn.00412b10
test eax, eax
je 0x414364
mov al, 4
mov edx, dword [ebp - 0x3c]
mov dword fs:[0], edx
jmp 0x414658
xor ecx, ecx
mov cl, byte [ebp - 0x43]
shl ecx, 4
lea eax, [ebp - 0x2c6]
add ecx, eax
mov dword [ebp - 0x48], ecx
mov eax, dword [ebp - 0x40]
call fcn.004133b0
test eax, eax
je 0x414394
mov al, 3
mov edx, dword [ebp - 0x3c]
mov dword fs:[0], edx
jmp 0x414658
cmp byte [0x4dead5], 9
jne 0x4143e8
xor ecx, ecx
mov cl, byte [ebp - 0x43]
shl ecx, 4
cmp byte [ebp + ecx - 0x2c0], 0
je 0x4144dd
mov byte [0x4dec38], 1
xor eax, eax
mov al, byte [ebp - 0x43]
shl eax, 4
mov dl, byte [ebp + eax - 0x2c1]
mov byte [0x4dec3b], dl
xor ecx, ecx
mov cl, byte [ebp - 0x43]
shl ecx, 4
mov al, byte [ebp + ecx - 0x2c0]
mov byte [0x4dec3a], al
jmp 0x4144dd
mov dl, byte [ebp - 0x41]
mov byte [ebp - 0x42], dl
cmp byte [ebp - 0x42], 0x3c
jae 0x4144c6
push 5
xor ecx, ecx
mov cl, byte [ebp - 0x42]
lea ecx, [ecx + ecx*4]
lea eax, [ebp - 0x1a8]
add ecx, eax
mov dl, 0x1b
mov eax, dword [ebp - 0x40]
call fcn.00412b10
test eax, eax
je 0x414429
mov al, 4
mov edx, dword [ebp - 0x3c]
mov dword fs:[0], edx
jmp 0x414658
mov eax, dword [ebp - 0x40]
call fcn.004133b0
test eax, eax
je 0x414449
mov al, byte [ebp - 0x42]
add al, 0x20
mov edx, dword [ebp - 0x3c]
mov dword fs:[0], edx
jmp 0x414658
cmp byte [0x4dead5], 9
jne 0x4144b9
xor ecx, ecx
mov cl, byte [ebp - 0x42]
push ecx
push 0x4cc53a
push 0x4dead5
call fcn.004bb6d8
add esp, 0xc
xor eax, eax
mov al, byte [ebp - 0x42]
lea edx, [eax + eax*4]
lea ecx, [ebp - 0x1a8]
add edx, ecx
mov dword [ebp - 0x48], edx
mov word [ebp - 0x2c], 0x38
mov edx, 0x4dead5
lea eax, [ebp - 0x14]
call fcn.004c3c68
inc dword [ebp - 0x20]
mov edx, dword [eax]
mov eax, dword [sym.Project1.exe__Form3]
mov ecx, dword [eax]
mov eax, dword [ecx + 0x2d8]
call fcn.0048e39c
dec dword [ebp - 0x20]
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.004c3e54
jmp 0x4144c6
inc byte [ebp - 0x42]
cmp byte [ebp - 0x42], 0x3c
jb 0x4143f8
cmp byte [ebp - 0x42], 0x3c
jne 0x4144dd
mov al, 6
mov edx, dword [ebp - 0x3c]
mov dword fs:[0], edx
jmp 0x414658
push 0x104
lea ecx, [ebp - 0x670]
push ecx
push 0
call sub.kernel32.dll_GetModuleFileNameA_1
push 0x5c
lea eax, [ebp - 0x670]
push eax
call fcn.004b9b45
add esp, 8
lea edx, [ebp - 0x670]
sub eax, edx
mov byte [ebp + eax - 0x670], 0
push 0x4cc597
lea ecx, [ebp - 0x670]
push ecx
call fcn.004b9994
add esp, 8
push 0
push 0x80
push 4
push 0
push 1
push 0x40000000
lea eax, [ebp - 0x670]
push eax
call sub.kernel32.dll_CreateFileA_1
mov dword [ebp - 0x5c], eax
cmp eax, 0xffffffff
je 0x41464c
push 2
push 0
push 0
push dword [ebp - 0x5c]
call sub.kernel32.dll_SetFilePointer_1
mov edx, dword [0x4cb87b]
mov dword [ebp - 0x68], edx
mov edx, dword [0x4cb87f]
mov dword [ebp - 0x64], edx
push 0x23
mov word [ebp - 0x2c], 0x44
lea eax, [ebp - 0x18]
call fcn.0040165c
mov edx, eax
inc dword [ebp - 0x20]
mov ecx, dword [sym.Project1.exe__Form3]
mov eax, dword [ecx]
mov eax, dword [eax + 0x2d4]
call fcn.0048e36c
lea eax, [ebp - 0x18]
call fcn.004042bc
push eax
lea edx, [ebp - 0x6a0]
push edx
call fcn.004b9880
add esp, 0xc
dec dword [ebp - 0x20]
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.004c3e54
push 8
lea ecx, [ebp - 0x7c]
push ecx
lea eax, [ebp - 0x67d]
push eax
call fcn.004b9880
add esp, 0xc
push 5
push dword [ebp - 0x48]
lea edx, [ebp - 0x675]
push edx
call fcn.004b9880
add esp, 0xc
push 0
push dword [ebp - 0x5c]
call sub.kernel32.dll_GetFileSize_1
mov byte [ebp - 0x5d], al
mov byte [ebp - 0x69], 0
xor ecx, ecx
mov cl, byte [ebp - 0x69]
mov al, byte [ebp - 0x5d]
xor byte [ebp + ecx - 0x6a0], al
inc byte [ebp - 0x5d]
xor edx, edx
mov dl, byte [ebp - 0x69]
and edx, 7
mov cl, byte [ebp + edx - 0x68]
xor eax, eax
mov al, byte [ebp - 0x69]
xor byte [ebp + eax - 0x6a0], cl
inc byte [ebp - 0x69]
cmp byte [ebp - 0x69], 0x30
jb 0x4145f9
push 0
push 0x4dec34
push 0x30
lea edx, [ebp - 0x6a0]
push edx
push dword [ebp - 0x5c]
call sub.kernel32.dll_WriteFile_1
push dword [ebp - 0x5c]
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
mov edx, dword [ebp - 0x3c]
mov dword fs:[0], edx
pop edi
pop esi
mov esp, ebp
pop ebp
ret