Function at 0x40b100
Capabilities:
Write file on windows

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d5db4
mov eax, dword fs:[0]
push eax
push ecx
push ebx
sub esp, 0x1d8
mov eax, dword [0x51f164]
xor eax, ebp
mov dword [ebp - 0x1c], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, edx
mov dword [ebp - 0x148], ecx
mov eax, dword [ebx + 0xc]
lea ecx, [ebp - 0x68]
mov esi, dword [ebx + 8]
mov dword [ebp - 4], 0
push 5
push str.wenf
mov dword [ebp - 0x144], eax
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x54], 0xf
mov byte [ebp - 0x68], 0
call fcn.00431800
mov edx, dword [ebx + 0x10]
mov byte [ebp - 4], 1
test edx, edx
je 0x40b319
lea ecx, [ebp - 0x98]
call fcn.004022c0
lea eax, [ebp - 0x98]
mov byte [ebp - 4], 2
push eax
mov edx, 0x4fbf10
lea ecx, [ebp - 0x184]
call fcn.00438f40
add esp, 4
push 0x4fbf0c
mov ecx, eax
mov byte [ebp - 4], 3
call fcn.00431940
mov edx, dword [ebp - 0x54]
movq xmm1, qword [eax + 0x10]
movq qword [ebp - 0x168], xmm1
movq qword [ebp - 0x1bc], xmm1
movups xmm0, xmmword [eax]
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
movups xmmword [ebp - 0x158], xmm0
movups xmmword [ebp - 0x1cc], xmm0
cmp edx, 0x10
jb 0x40b243
mov ecx, dword [ebp - 0x68]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40b22a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40b9fe
push edx
push ecx
call fcn.00490c3c
movups xmm0, xmmword [ebp - 0x158]
add esp, 8
movq xmm1, qword [ebp - 0x168]
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x170]
movq qword [ebp - 0x58], xmm1
mov dword [ebp - 0x1bc], 0
mov dword [ebp - 0x1b8], 0xf
mov byte [ebp - 0x1cc], 0
movups xmmword [ebp - 0x68], xmm0
cmp edx, 0x10
jb 0x40b2a5
mov ecx, dword [ebp - 0x184]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40b29b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40b9fe
push edx
push ecx
call fcn.00490c3c
add esp, 8
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x84]
mov dword [ebp - 0x174], 0
mov dword [ebp - 0x170], 0xf
mov byte [ebp - 0x184], 0
cmp edx, 0x10
jb 0x40b2fe
mov ecx, dword [ebp - 0x98]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40b2f4
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40ba03
push edx
push ecx
call fcn.00490c3c
add esp, 8
mov dword [ebp - 0x88], 0
mov dword [ebp - 0x84], 0xf
mov byte [ebp - 0x98], 0
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 0xf
mov byte [ebp - 0x50], 0
push edi
mov edx, str.d7j3
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x1b4]
call fcn.00438f40
add esp, 4
push str.y9a0
mov ecx, eax
mov byte [ebp - 4], 5
call fcn.00431940
mov dword [ebp - 0x150], 0
mov dword [ebp - 0x14c], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x160], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x150], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
push esi
lea edx, [ebp - 0x160]
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x19c]
call fcn.00439720
add esp, 4
push str.m5ha
mov ecx, eax
mov byte [ebp - 4], 7
call fcn.00431940
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x38], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x28], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov byte [ebp - 4], 9
mov edx, dword [ebp - 0x188]
cmp edx, 0x10
jb 0x40b426
mov ecx, dword [ebp - 0x19c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40b41c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40ba08
push edx
push ecx
call fcn.00490c3c
add esp, 8
mov dword [ebp - 0x18c], 0
mov dword [ebp - 0x188], 0xf
mov byte [ebp - 0x19c], 0
mov byte [ebp - 4], 0xa
mov edx, dword [ebp - 0x14c]
cmp edx, 0x10
jb 0x40b47f
mov ecx, dword [ebp - 0x160]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40b475
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40ba08
push edx
push ecx
call fcn.00490c3c
add esp, 8
mov dword [ebp - 0x150], 0
mov dword [ebp - 0x14c], 0xf
mov byte [ebp - 0x160], 0
mov byte [ebp - 4], 0xb
mov edx, dword [ebp - 0x1a0]
cmp edx, 0x10
jb 0x40b4d8
mov ecx, dword [ebp - 0x1b4]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40b4ce
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40ba08
push edx
push ecx
call fcn.00490c3c
add esp, 8
push 0x4c
lea eax, [ebp - 0x138]
mov dword [ebp - 0x1a4], 0
push 0
push eax
mov dword [ebp - 0x1a0], 0xf
mov byte [ebp - 0x1b4], 0
call fcn.004a8980
mov eax, dword [0x51fbe0]
lea ecx, [ebp - 0x138]
add esp, 0xc
mov eax, dword [eax + 4]
add eax, 0x51fbe0
push eax
call fcn.0042fa60
push 0x38
lea eax, [ebp - 0xe8]
mov byte [ebp - 4], 0xc
push 0
push eax
call fcn.004a8980
add esp, 0xc
push 0x4c
call fcn.0049089a
add esp, 4
mov dword [ebp - 0x140], eax
mov dword [ebp - 0x16c], eax
push 0x4c
push 0
push eax
mov byte [ebp - 4], 0xd
call fcn.004a8980
add esp, 0xc
push 0x10
call fcn.0049089a
add esp, 4
mov dword [ebp - 0x13c], eax
mov dword [ebp - 0x164], eax
xorps xmm0, xmm0
mov byte [ebp - 4], 0xe
push 0
mov ecx, eax
movups xmmword [eax], xmm0
call fcn.00444760
mov eax, dword [ebp - 0x13c]
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 0xd
push dword [section..data]
mov dword [eax + 0xc], ecx
lea ecx, [ebp - 0x138]
mov dword [eax], vtable.CryptoPP::StringSinkTemplate_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___.0
mov dword [eax + 4], vtable.CryptoPP::StringSinkTemplate_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___.1.0
mov eax, dword [ebp - 0x138]
push 0
push dword [ebp - 0x144]
mov eax, dword [eax + 0x1c]
call eax
push dword [ebp - 0x13c]
mov ecx, dword [ebp - 0x140]
push 0
push 0
push eax
call fcn.0044c2b0
mov eax, dword [ebp - 0x140]
push eax
push ecx
lea ecx, [ebp - 0xe8]
mov byte [ebp - 4], 0xc
mov dword [eax], vtable.CryptoPP::PK_EncryptorFilter.0
mov dword [eax + 4], vtable.CryptoPP::PK_EncryptorFilter.1.0
lea eax, [ebp - 0x38]
push eax
call fcn.004076c0
mov byte [ebp - 4], 0xf
lea eax, [ebp - 0x38]
mov ecx, 0x18
nop dword [eax]
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x40b610
mov eax, 0x18
mov byte [edi], 0
lea edi, [edi + 1]
sub eax, 1
jne 0x40b620
mov eax, 0x18
mov byte [esi], 0
lea esi, [esi + 1]
sub eax, 1
jne 0x40b630
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x148]
cmp dword [eax + 0x14], 8
jb 0x40b64c
mov eax, dword [eax]
push 0
push 0x8000000
push 3
push 0
push 0
push 4
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x40b76f
mov ecx, dword [ebp - 0xdc]
mov dword [ebp - 0xe8], vtable.CryptoPP::SourceTemplate_class_CryptoPP::StringStore_.0
mov dword [ebp - 0xe4], vtable.CryptoPP::SourceTemplate_class_CryptoPP::StringStore_.1.0
test ecx, ecx
je 0x40b691
mov eax, dword [ecx]
push 1
call dword [eax]
lea ecx, [ebp - 0x12c]
call fcn.00407d70
mov edx, dword [ebp - 0x24]
mov dword [ebp - 0xf0], vtable.CryptoPP::NameValuePairs.0
cmp edx, 0x10
jb 0x40b6da
mov ecx, dword [ebp - 0x38]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40b6d0
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40ba1c
push edx
push ecx
call fcn.00490c3c
add esp, 8
mov edx, dword [ebp - 0x3c]
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0xf
mov byte [ebp - 0x38], 0
cmp edx, 0x10
jb 0x40b720
mov ecx, dword [ebp - 0x50]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40b716
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40ba1c
push edx
push ecx
call fcn.00490c3c
add esp, 8
mov edx, dword [ebp - 0x54]
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 0xf
mov byte [ebp - 0x50], 0
cmp edx, 0x10
jb 0x40b9de
mov ecx, dword [ebp - 0x68]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40b760
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40ba1c
push edx
push ecx
call fcn.00490c3c
add esp, 8
jmp 0x40b9de
push 2
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp byte [0x5200e9], 0
lea eax, [ebp - 0x50]
lea edx, [ebp - 0x68]
push eax
jne 0x40b7ff
lea ecx, [ebp - 0xb0]
call fcn.004395d0
add esp, 4
lea ecx, [ebp - 0x20]
cmp dword [ebp - 0x9c], 0x10
lea eax, [ebp - 0xb0]
cmovae eax, dword [ebp - 0xb0]
push 0
push ecx
push dword [ebp - 0xa0]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [ebp - 0x9c]
cmp edx, 0x10
jb 0x40b8c9
mov ecx, dword [ebp - 0xb0]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40b8bf
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40ba0d
jmp 0x40b8bf
lea ecx, [ebp - 0x1e4]
call fcn.004395d0
add esp, 4
push str.4r3d
mov ecx, eax
mov byte [ebp - 4], 0x10
call fcn.00431940
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x80], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x70], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov edx, dword [ebp - 0x1d0]
cmp edx, 0x10
jb 0x40b879
mov ecx, dword [ebp - 0x1e4]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40b86f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40ba12
push edx
push ecx
call fcn.00490c3c
add esp, 8
cmp dword [ebp - 0x6c], 0x10
lea ecx, [ebp - 0x20]
push 0
push ecx
push dword [ebp - 0x70]
lea eax, [ebp - 0x80]
cmovae eax, dword [ebp - 0x80]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [ebp - 0x6c]
cmp edx, 0x10
jb 0x40b8c9
mov ecx, dword [ebp - 0x80]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40b8bf
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40ba17
push edx
push ecx
call fcn.00490c3c
add esp, 8
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc dword [0x529514]
mov ecx, dword [ebp - 0xdc]
mov dword [ebp - 0xe8], vtable.CryptoPP::SourceTemplate_class_CryptoPP::StringStore_.0
mov dword [ebp - 0xe4], vtable.CryptoPP::SourceTemplate_class_CryptoPP::StringStore_.1.0
test ecx, ecx
je 0x40b8fa
mov eax, dword [ecx]
push 1
call dword [eax]
lea ecx, [ebp - 0x12c]
call fcn.00407d70
mov edx, dword [ebp - 0x24]
mov dword [ebp - 0xf0], vtable.CryptoPP::NameValuePairs.0
cmp edx, 0x10
jb 0x40b943
mov ecx, dword [ebp - 0x38]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40b939
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40ba1c
push edx
push ecx
call fcn.00490c3c
add esp, 8
mov edx, dword [ebp - 0x3c]
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0xf
mov byte [ebp - 0x38], 0
cmp edx, 0x10
jb 0x40b989
mov ecx, dword [ebp - 0x50]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40b97f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40ba1c
push edx
push ecx
call fcn.00490c3c
add esp, 8
mov edx, dword [ebp - 0x54]
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 0xf
mov byte [ebp - 0x50], 0
cmp edx, 0x10
jb 0x40b9cb
mov ecx, dword [ebp - 0x68]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40b9c1
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40ba1c
push edx
push ecx
call fcn.00490c3c
add esp, 8
mov eax, 1
jmp 0x40b9e0
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.004905bb
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.004b5132
call fcn.004b5132
call fcn.004b5132
call fcn.004b5132
call fcn.004b5132
call fcn.004b5132
call fcn.004b5132
int3