Function at 0x40b080
Capabilities:
Write file on windows

Disassembly:
or al, 0x5f
mov word [esi], es
mov eax, dword [eax + ecx + 0x5e]
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push ebp
mov ebp, esp
push esi
mov esp, eax
or byte [edi - 0x6a], dl
adc dword [eax], 0x8b47468b
loope 0x40b0a5
mov ch, 0xc1
mov dword [ebp + 0x10], 0
jne 0x40b063
add byte [ebp - 0x39], dh
mov al, byte [esi + 0x7f]
test al, al
je 0x40b10d
mov esi, dword [ebp + 4]
lea ecx, [ebp + 8]
push 0
add al, 0x8d
dec ebp
or byte [edx], ch
push ecx
and byte [eax], al
push 0xffffffffffffff87
xchg edx, eax
test dword [edx - 1], edx
adc eax, 0x5d40c00c
test eax, eax
jne 0x40b099
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov ss, esi
aad 0x99
jne 0x40b0d2
mov ecx, dword [ebp - 0x6a]
pop edi
pop esi
mov dword [ecx], eax
pop ebp
ret
call dword [edx]
push edx
cmp ah, 0xa
add byte [0xafc09], bh
jne 0x40b11b
mov eax, 0x1113c
or al, 0x4d
adc al, 0x5f
pop esi
invalid
wait
ret
mov eax, dword [esi + 0xc]
test eax, eax
je 0x40b137
mov cl, byte [esi + 8]
test cl, cl
jne 0x40b0f0
mov ecx, dword [esi + 0x50]
mov dword [eax + 8], ecx
sbb al, 0xde
push eax
mov edx, dword [esi + 0x54]
mov ecx, 0x1f20
call 0xd1b810
mov edx, dword [esi + 0xc]
mov dword [eax + 0xc468b17], edi
mov eax, dword [esi + 0xc]
mov ebx, eax
or al, 0x53
lea ecx, [ebp + 0x10]
insd dword es:[edi], dx
mov eax, dword [esi + 4]
push ecx
push edi
push edx
push eax
call dword [0x7b40c010]
test eax, eax
push 7
xor eax, eax
jge 0x40b182
add dword [eax], eax
scasb al, byte es:[edi]
mov edi, dword [0x40b398]
rcl edi, 0x11
ror byte [edi], 0x84
sbb eax, dword [ecx]
cmp dword [eax], eax
call edi
add eax, 0x92fc80
cmp eax, 0xb0065
jne 0x40b1f1
mov ebx, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [esi + 0x14]
mov eax, dword [esi + 0x10]
test ecx, ecx
jl 0x40b13e
jg 0x40b192
test eax, eax
jbe 0x40b1a2
push 0xffffffffffffffd0
push 0x3e8
push ecx
push eax
cmp eax, 0x3f0
jmp 0x40b1af
and eax, ecx
cmp eax, 0x475fff8
or eax, eax
jmp 0x40b1af
mov ecx, dword [esi + 0xc]
push eax
mov edx, dword [esi]
adc byte [edx - 1], dl
pop ecx
clc
cmp edi, 0x80
je 0x40b148
test dword [edi], edi
je 0x40b1f8
mov eax, dword [0x414460]
mov ebx, dword [esi + 4]
test dword [ebp + 0x18], eax
push eax
push ds
in al, dx
add byte [ecx], al
push eax
call fcn.0040a940
add esp, 0xc
sbb ah, byte [eax + 9]
inc ecx
add byte [ebp + 0x530574c0], al
dec esi
jmp 0x40b1f8
cmp eax, 0xeb4c15ff
je 0x40b1f8
mov ecx, dword [esi + 0xc]
mov ecx, dword [ebx + 0x10458d04]
push 1
push eax
push ecx
push edx
inc dword [esi - 0x37]
rol byte [eax], 0xc8
sal byte [edi + edx*2 + 0x33], 0xc0
sal dword [ecx + 0xb], cl
sbb eax, sym.imp.KERNEL32.dll_GetLastError
call ebx
test eax, eax
je 0x40b285
call ebx
add eax, 0xafc80
sub byte [eax + eax + 0xb], ah
add byte [edi + eax - 0x23], dh
arpl word [eax], ax
or ebx, dword [esi - 0x7ee512]
add bh, byte [edx]
mov bl, 0
jne 0x40b24f
fdiv st(0)
adc al, 0x8b
push ebp
adc byte [ebx + 6], bl
mov ch, bh
adc dword [ecx], eax
add byte [ecx - 0x3ca2a1ef], cl
cmp eax, 0x5c0afced
mov bl, 0x12
lodsb al, byte [esi]
dec ebp
in eax, dx
adc al, 0x55
push 0x5b
pop edi
or dword [esi + 0x11], edi
add dword [eax], eax
mov dword [ecx], edx
pushal
pop ebp
ret
mov ecx, dword [ebp + 0x10]
test ecx, ecx
jne 0x40b29e
mov ecx, dword [ebp + 0x14]
sub eax, 0x5f5bfb55
idiv byte [esi + 0x11]
add dword [edx], ebx
mov dword [edx], ebp
mov al, byte [0x568bc35d]
or al, 0x85
sal byte [ebx + edi*2 - 0x76], cl
push esi
or byte [edx + edx*8 + 0x568b1175], al
push eax
mov edx, dword [esi + 0xc]
test edx, edx
je 0x40b320
mov dl, byte [esi + 8]
test dl, dl
jne 0x40b2bd
mov edx, dword [esi + 0x50]
add ebp, dword [edi - 0x7cabb175]
rol dword [eax], 1
mov dword [esi + 0x50], edx
mov dword [esi + 0x54], ecx
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0x10]
pop ebx
xor eax, 0x755e1144
xchg byte [eax - 0x6f6f6f70], dl
arpl word [ebp - 0x75], dx
in al, dx
aad 0x56
mov ecx, dword [ecx]
or byte [edx - 0x3f7bd3ba], cl
je 0xfeb3a1
mov ecx, dword [esi + 0x2a]
xor eax, eax
push ebx
sbb dword [ecx + eax + 0x57], 0xffffff89
inc ebp
cld
mov dword [ebp - 0x46], eax
jne 0x40b395
mov ebx, dword [ecx]
jl 0x40b338
jae 0x40b30e
test byte [ecx - 0x74ffff4c], dl
pop esi
xchg dword [ebx + 0x576ff84], eax
or eax, 0x2e
mov ebx, dword [esi - 0x79]
add dword [edi + edi*8 - 0x377cfa8a], 0x2e
jmp 0x40b313
jmp 0x40b313
mov edx, dword [esi + 0x59]
lea ecx, [ebp - 4]
push 0xfffffffffffffffd
popfd
push eax
push ebx
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
adc eax, sym.imp.KERNEL32.dll_WriteFile
test eax, eax
je 0x40b358
inc esp
inc ebp
cld
mov edx, dword [esi + 0x50]
xchg ebp, eax
xor al, 0x54
jg 0x40b304
adc ecx, 0x36
sub edi, eax
clc
add ebx, eax
mov dword [esi + 0x50], edx
test edi, edi
mov dword [esi + 0x54], ecx
mov eax, dword [0x8458b99]
pop edi
scasd eax, dword es:[edi]
inc esi
cmp al, 0
add byte [eax], al
add byte [ebx + 0x5e], bl
leave
in eax, 0x5d
jle 0x40b35b
add byte [ebx + 0x51c0563d], cl
add bh, bh
mov edi, dword [0x51c056]
invalid
rcl byte [ecx], 0xff
aas
push 0xffffffffffffffc0
and al, 5
mov dword [ebp + 8], eax
jmp 0x40b373
test dword [0xafc80], 0x3108455e
inc ebp
and byte [ebx + 0x4e8b5056], cl
push esp
xor dword [ebp + 0x20], eax
mov edx, dword [esi + 0x50]
mov ecx, dword [esi + 0x54]
add esi, dword [ecx - 0x75]
inc ebp
or byte [edi], bh
push esi
pop ss
adc ecx, 0xd
adc edx, ebp
mov dword [esi + 0x54], ecx
jne 0x40b36a
mov dword [esi + 0x3c], 0xfadb00
jae 0x40b3dc
or byte [eax + 0x15], ch
pop esi
or ch, ah
lodsb al, byte [esi]
rol byte [esi + edi*2], 1
xor eax, dword [eax + ebp*2 + 0x145de58b]
add al, 0xc8
rcl dword [eax - 0x6f79ed70]
out dx, al
nop
inc esi
nop
push ebp
mov edi, dword [esi]
cld
inc ebp
adc byte [ebx - 0x874f3b3], cl
or byte [eax + 0x51], dl
push edx
push 0x7700000c
pop ebp
pop ebp
or al, 8
nop
push 0x90909047
cld
inc esi
mov edi, esp
or byte [ebp + 0x10], dl
mov eax, dword [ebp + 8]
imul edx, dword [esi - 0x73], 0x4a
invalid