Function at 0x401470
Capabilities:
Read .ini file
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x4fc2a8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xa40
mov eax, dword [0x531a1c]
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x24], esi
mov dword [esp + 0x1c], eax
xor ebx, ebx
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x4a]
mov word [esp + 0x48], bx
push 0x104
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x4c]
mov dword [esp + 0xa5c], ebx
push ecx
push ebx
stosw word es:[edi], ax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea edx, [esp + 0x48]
lea ecx, [esp + 0x14]
push edx
call fcn.004da85a
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x20]
mov byte [esp + 0xa58], 1
mov eax, dword [eax - 8]
add eax, 0xfffffffc
push eax
push ecx
lea ecx, [esp + 0x1c]
call fcn.004d4845
mov edx, dword [eax]
lea eax, [esp + 0x1c]
push edx
push str._s.ini
push eax
mov byte [esp + 0xa64], 2
call fcn.004d4ca7
add esp, 0xc
lea ecx, [esp + 0x20]
mov byte [esp + 0xa58], 1
call fcn.004da7e6
mov ecx, dword [esp + 0x1c]
push ebx
push ecx
call fcn.0045d370
add esp, 8
test eax, eax
jne 0x40177b
mov edx, dword [0x50cd38]
mov dword [esp + 0x10], edx
push str.________________________________________________________________________________________________r_n
lea ecx, [esp + 0x14]
mov byte [esp + 0xa5c], 3
call fcn.00437520
push 0x5307e0
lea ecx, [esp + 0x14]
call fcn.00437520
push 0x5307a0
lea ecx, [esp + 0x14]
call fcn.00437520
push 0x53075c
lea ecx, [esp + 0x14]
call fcn.00437520
push 0x530758
lea ecx, [esp + 0x14]
call fcn.00437520
push 0x530730
lea ecx, [esp + 0x14]
call fcn.00437520
push 0x530720
lea ecx, [esp + 0x14]
call fcn.00437520
push str.__01000000657374000000000004000000010000006214236500010000006573740000000000040000000100000063142365000100000065737400000000000400000001000000641423650001000000657374000000000004000000010000006514236500090000006573740000000000030000000100000014236500_r_n
lea ecx, [esp + 0x14]
call fcn.00437520
push 0x530614
lea ecx, [esp + 0x14]
call fcn.00437520
push str.__01000000647400000000000010000000010000000000000040234772656174536B7920660009000000647400000000000010000000010000000000000004070702060506010704050300_r_n
lea ecx, [esp + 0x14]
call fcn.00437520
push 0x53056c
lea ecx, [esp + 0x14]
call fcn.00437520
push str.__0900000068740000000000000800000001000000181B031A1510197C00_r_n
lea ecx, [esp + 0x14]
call fcn.00437520
push 0x530520
lea ecx, [esp + 0x14]
call fcn.00437520
push str.__020000006C640000000000000300000001000000847D1C000C0000006C6400000400000004000000010000000200010000_r_n
lea ecx, [esp + 0x14]
call fcn.00437520
push 0x5304a8
lea ecx, [esp + 0x14]
call fcn.00437520
push str.__09000000737A746B001000000800000002000000667352774F73724C00_r_n
lea ecx, [esp + 0x14]
call fcn.00437520
push 0x530458
lea ecx, [esp + 0x14]
call fcn.00437520
push str.__09000000747968790000000010000000010000001502981900000000010000000000000000_r_n
lea ecx, [esp + 0x14]
call fcn.00437520
push 0x530758
lea ecx, [esp + 0x14]
call fcn.00437520
push 0x5303e8
lea ecx, [esp + 0x14]
call fcn.00437520
push str.__pdf_t_t_t25504446_r_n
lea ecx, [esp + 0x14]
call fcn.00437520
push str.__doc_xls_ppt_t_tD0CF11E0_r_n
lea ecx, [esp + 0x14]
call fcn.00437520
push str.__jpg_jpeg_t_tFFD8FF_r_n
lea ecx, [esp + 0x14]
call fcn.00437520
push str.__png_t_t_t89504E47_r_n
lea ecx, [esp + 0x14]
call fcn.00437520
push str.__docx_xlsx_pptx_t504B_r_n
lea ecx, [esp + 0x14]
call fcn.00437520
push str.__r_n_r_n
lea ecx, [esp + 0x14]
call fcn.00437520
push str._HeaderFlag__r_n
lea ecx, [esp + 0x14]
call fcn.00437520
push str.TSDED_OtherEncryptFlag_r_n
lea ecx, [esp + 0x14]
call fcn.00437520
push str.SDFile_Transform_DecryptFileHeader.pdf25504446_.doc_.xls_.pptD0CF11E0_.jpg_.jpegFFD8FF_.png89504E47_.docx_.xlsx_.pptx504B_r_n
lea ecx, [esp + 0x14]
call fcn.00437520
mov eax, dword [esp + 0x1c]
push ebx
push ebx
push 1
push ebx
push ebx
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x401725
mov eax, dword [esp + 0x10]
mov dword [esp + 0x20], ebx
lea edx, [esp + 0x20]
push ebx
mov ecx, dword [eax - 8]
push edx
push ecx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x10]
mov byte [esp + 0xa58], 1
call fcn.00436910
mov eax, dword [0x531a1c]
mov dword [esp + 0x18], eax
mov ecx, dword [esp + 0x1c]
lea edx, [esp + 0x18]
push ecx
push str.The__TSDED_OtherEncryptFlag__is_empty__Please_configure__s__
push edx
mov byte [esp + 0xa64], 4
call fcn.004d4ca7
mov eax, dword [esp + 0x24]
add esp, 0xc
push ebx
push ebx
push eax
call fcn.004e77ab
lea ecx, [esp + 0x18]
mov byte [esp + 0xa58], 1
call fcn.004da7e6
lea ecx, [esp + 0x14]
mov byte [esp + 0xa58], 0
call fcn.004da7e6
lea ebp, [esi + 0x1c]
push 0xffffffffffffffff
push ebx
mov ecx, ebp
mov dword [esi + 4], ebx
call fcn.004d8f0b
lea ebx, [esi + 8]
xor edi, edi
push 0xffffffffffffffff
push edi
mov ecx, ebx
call fcn.004025f0
mov dword [esi + 0x30], edi
mov word [esp + 0x250], di
mov ecx, 0x1ff
xor eax, eax
lea edi, [esp + 0x252]
lea edx, [esp + 0x250]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x20], 0
push ecx
push 0x400
push edx
push 0x5441d0
push str.TSDED_OtherEncryptFlag
push str.HeaderFlag
stosw word es:[edi], ax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
jbe 0x40187f
lea eax, [esp + 0x250]
lea ecx, [esp + 0x14]
push eax
call fcn.0043b820
mov ecx, dword [esp + 0x14]
mov byte [esp + 0xa58], 5
mov eax, dword [ecx - 8]
cdq
sub eax, edx
mov edi, eax
sar edi, 1
cmp edi, 0x15
jb 0x40186e
push 0xffffffffffffffff
push edi
mov ecx, ebp
call fcn.004d8f0b
mov edx, dword [esp + 0x14]
push edi
push ebp
push edx
call fcn.00454f90
mov edx, dword [esi + 0x20]
add esp, 0xc
mov ecx, dword [edx + 0xc]
lea eax, [ecx + 0x15]
cmp eax, edi
ja 0x401a27
cmp ecx, dword [esi + 0x30]
jbe 0x40185d
mov dword [esi + 0x30], ecx
sub edi, eax
add edx, eax
cmp edi, 0x15
jae 0x401847
mov dword [esp + 0x20], 1
lea ecx, [esp + 0x14]
mov byte [esp + 0xa58], 0
call fcn.0043c090
mov ecx, 0x200
xor eax, eax
lea edi, [esp + 0x250]
xor ebp, ebp
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x250]
push eax
push 0x400
push ecx
push 0x5441d0
push 0x5301a8
push str.HeaderFlag
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
jbe 0x401c9c
lea edx, [esp + 0x250]
lea ecx, [esp + 0x18]
push edx
call fcn.0043b820
mov eax, dword [0x50cd3c]
mov dword [esp + 0x10], eax
lea ecx, [esp + 0x34]
lea edx, [esp + 0x14]
push ecx
push 0x5301a4
push edx
lea ecx, [esp + 0x24]
mov byte [esp + 0xa64], 7
mov dword [esp + 0x40], ebp
call fcn.004409c0
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0xa5c], 8
call fcn.0043c240
lea ecx, [esp + 0x14]
mov byte [esp + 0xa58], 7
call fcn.0043c090
mov eax, dword [esp + 0x10]
mov ecx, dword [eax - 8]
test ecx, ecx
je 0x401c75
lea ecx, [esp + 0x10]
call fcn.0043ff60
lea ecx, [esp + 0x10]
call fcn.0043fc60
push 0x7c
lea ecx, [esp + 0x14]
call fcn.0043d1f0
mov edi, eax
cmp edi, 0xffffffff
je 0x401c2b
mov eax, dword [0x50cd3c]
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
lea ecx, [esp + 0x38]
push edi
push ecx
lea ecx, [esp + 0x18]
mov byte [esp + 0xa60], 9
call fcn.0043e860
push eax
lea ecx, [esp + 0x2c]
mov byte [esp + 0xa5c], 0xa
call fcn.0043c240
lea ecx, [esp + 0x38]
mov byte [esp + 0xa58], 9
call fcn.0043c090
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x10]
mov eax, dword [edx - 8]
sub eax, edi
dec eax
push eax
lea eax, [esp + 0x40]
push eax
call fcn.0043e650
push eax
lea ecx, [esp + 0x30]
mov byte [esp + 0xa5c], 0xb
call fcn.0043c240
lea ecx, [esp + 0x3c]
mov byte [esp + 0xa58], 9
call fcn.0043c090
mov eax, dword [ebx + 8]
mov ebp, eax
mov dword [esp + 0x40], ebp
inc ebp
test ebp, ebp
jne 0x401a3e
mov edi, dword [ebx + 4]
test edi, edi
je 0x401a1a
mov ecx, eax
dec eax
test ecx, ecx
je 0x401a07
lea ebp, [eax + 1]
mov ecx, edi
call fcn.00401d20
add edi, 8
dec ebp
jne 0x4019fa
mov eax, dword [ebx + 4]
push eax
call fcn.004da446
add esp, 4
mov dword [ebx + 4], 0
xor eax, eax
mov dword [ebx + 0xc], eax
mov dword [ebx + 8], eax
jmp 0x401be6
push 0xffffffffffffffff
push 0
mov ecx, ebp
call fcn.004d8f0b
mov dword [esi + 0x30], 0
jmp 0x40186e
mov ecx, dword [ebx + 4]
test ecx, ecx
jne 0x401aa9
lea edi, [ebp*8]
push edi
call fcn.004da41d
mov ecx, edi
mov esi, eax
mov edx, ecx
xor eax, eax
mov edi, esi
mov dword [ebx + 4], esi
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
add esp, 4
and ecx, 3
mov dword [esp + 0x14], esi
rep stosb byte es:[edi], al
lea edi, [ebp]
mov dword [esp + 0x30], esi
test esi, esi
mov byte [esp + 0xa58], 0xc
je 0x401a8c
mov ecx, esi
call fcn.00401d00
add esi, 8
dec edi
mov byte [esp + 0xa58], 9
mov dword [esp + 0x14], esi
jne 0x401a75
mov dword [ebx + 0xc], ebp
mov dword [ebx + 8], ebp
jmp 0x401be2
mov edi, dword [ebx + 0xc]
cmp ebp, edi
jg 0x401b49
cmp eax, ebp
jge 0x401b1d
mov edx, ebp
lea edi, [ecx + eax*8]
sub edx, eax
xor eax, eax
mov dword [esp + 0x14], edi
lea ecx, [edx*8]
mov esi, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, esi
and ecx, 3
rep stosb byte es:[edi], al
mov eax, edx
dec edx
test eax, eax
je 0x401b3d
mov esi, dword [esp + 0x14]
lea edi, [edx + 1]
mov dword [esp + 0x30], esi
test esi, esi
mov byte [esp + 0xa58], 0xd
je 0x401aff
mov ecx, esi
call fcn.00401d00
add esi, 8
dec edi
mov byte [esp + 0xa58], 9
mov dword [esp + 0x14], esi
jne 0x401ae8
mov esi, dword [esp + 0x24]
mov dword [ebx + 8], ebp
jmp 0x401be6
jle 0x401b41
sub eax, ebp
lea edi, [ecx + ebp*8]
mov ecx, eax
dec eax
test ecx, ecx
je 0x401b41
lea esi, [eax + 1]
push 0
mov ecx, edi
call fcn.00402770
add edi, 8
dec esi
jne 0x401b2e
mov esi, dword [esp + 0x24]
mov dword [ebx + 8], ebp
jmp 0x401be6
mov ecx, dword [ebx + 0x10]
test ecx, ecx
jne 0x401b74
cdq
and edx, 7
add eax, edx
mov ecx, eax
sar ecx, 3
cmp ecx, 4
jge 0x401b67
mov ecx, 4
jmp 0x401b74
cmp ecx, 0x400
jle 0x401b74
mov ecx, 0x400
lea eax, [edi + ecx]
cmp ebp, eax
mov dword [esp + 0x14], eax
jl 0x401b83
mov dword [esp + 0x14], ebp
mov edx, dword [esp + 0x14]
lea eax, [edx*8]
push eax
call fcn.004da41d
mov ecx, dword [ebx + 8]
mov esi, dword [ebx + 4]
shl ecx, 3
mov edx, ecx
mov edi, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov edx, ebp
and ecx, 3
add esp, 4
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebx + 8]
mov dword [esp + 0x30], eax
sub edx, ecx
lea eax, [eax + ecx*8]
push edx
push eax
call fcn.00402790
mov eax, dword [ebx + 4]
push eax
call fcn.004da446
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x18]
add esp, 4
mov dword [ebx + 4], ecx
mov dword [ebx + 8], ebp
mov dword [ebx + 0xc], edx
mov esi, dword [esp + 0x24]
mov eax, dword [ebx + 4]
mov ecx, dword [esp + 0x40]
lea edx, [esp + 0x28]
lea edi, [eax + ecx*8]
push edx
mov ecx, edi
call fcn.0043c240
lea eax, [esp + 0x2c]
lea ecx, [edi + 4]
push eax
call fcn.0043c240
lea ecx, [esp + 0x2c]
mov byte [esp + 0xa58], 0xe
call fcn.0043c090
lea ecx, [esp + 0x28]
mov byte [esp + 0xa58], 7
call fcn.0043c090
lea ecx, [esp + 0x34]
lea edx, [esp + 0x44]
push ecx
push 0x5301a4
push edx
lea ecx, [esp + 0x24]
call fcn.004409c0
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0xa5c], 0xf
call fcn.0043c240
lea ecx, [esp + 0x44]
mov byte [esp + 0xa58], 7
call fcn.0043c090
mov eax, dword [esp + 0x10]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x401930
lea ecx, [esp + 0x10]
mov byte [esp + 0xa58], 6
call fcn.0043c090
lea ecx, [esp + 0x18]
mov byte [esp + 0xa58], 0
call fcn.0043c090
mov ebp, 1
mov eax, dword [esp + 0x20]
test eax, eax
je 0x401caf
test ebp, ebp
je 0x401caf
mov eax, 1
jmp 0x401cb1
xor eax, eax
lea ecx, [esp + 0x1c]
mov dword [esi + 4], eax
mov dword [esp + 0xa58], 0xffffffff
call fcn.004da7e6
mov ecx, dword [esp + 0xa50]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0xa4c
ret