Function at 0x40a9a2
Capabilities:
Parse pe header
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
xor edi, edi
push 0x44f020
push 0x445dac
mov dword [0x4515cc], edi
mov dword [0x4515c4], edi
call fcn.0040d967
push str.Dumping_security_dll...
call fcn.0040d967
mov eax, dword [0x45ef74]
add esp, 0xc
mov esi, dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov ebx, 0x451570
add eax, 8
mov dword [0x45155c], eax
push ebx
push 4
push 0x451554
push eax
push dword [ebp + 8]
call esi
test eax, eax
je 0x40aa2d
mov eax, dword [0x451554]
test eax, eax
je 0x40ac43
push ebx
mov dword [0x4515c4], eax
mov eax, dword [0x45ef64]
push 4
add eax, 0xffffffd0
push 0x451554
push eax
push dword [ebp + 8]
mov dword [0x45155c], eax
call esi
test eax, eax
jne 0x40aa4b
push dword [0x45155c]
push str.ReadProcessMemory_Error_DetermineSecurityARMVM_address:__p
call fcn.0040d967
push edi
call fcn.0040d967
add esp, 0xc
jmp 0x40ac43
mov eax, dword [0x451554]
test eax, eax
je 0x40ac43
push 4
push 0x3000
push dword [0x4515c4]
mov dword [0x4515cc], eax
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [0x4515d4], eax
test eax, eax
jne 0x40aa91
push str.VirtualAlloc_Error_dump_security_dll
call fcn.0040d967
push edi
call fcn.0040d967
pop ecx
pop ecx
jmp 0x40ac1e
push dword [0x4515c4]
push edi
push eax
call sub.VCRUNTIME140D.dll_memset
add esp, 0xc
push ebx
push dword [0x4515c4]
push dword [0x4515d4]
push dword [0x4515cc]
push dword [ebp + 8]
call esi
test eax, eax
jne 0x40aadb
cmp dword [0x451570], edi
jne 0x40aadb
push dword [0x4515cc]
push str.ReadProcessMemory_Error_DumpSecurityDll_address:__p
call fcn.0040d967
push edi
jmp 0x40ac16
mov ecx, dword [0x4515d4]
mov dword [0x45f430], ecx
mov dword [0x45f434], ecx
mov eax, dword [ecx + 0x3c]
lea edx, [ecx + 0x18]
add eax, 4
add eax, ecx
mov dword [0x45f438], eax
add edx, dword [ecx + 0x3c]
mov dword [0x45f43c], edx
mov eax, dword [ecx + 0x3c]
add eax, 0xf8
add eax, ecx
mov dword [0x45f440], eax
mov eax, 0x5a4d
cmp word [ecx], ax
je 0x40ab2e
push str.IMAGE_DOS_SIGNATURE_not_found
call fcn.0040d967
jmp 0x40aa8b
mov eax, dword [ecx + 0x3c]
cmp dword [ecx + eax], 0x4550
je 0x40ab41
push str.IMAGE_NT_SIGNATURE_not_found
jmp 0x40ab24
mov eax, dword [edx + 0x38]
mov esi, 0x44f958
push esi
mov dword [0x45d560], eax
call fcn.0040e4e3
pop ecx
test eax, eax
je 0x40ac3d
push 0x5c
push esi
call fcn.00414dac
mov dword [0x44f84c], eax
pop ecx
pop ecx
test eax, eax
je 0x40ab76
inc eax
mov dword [0x44f84c], eax
push edi
push 0x80
push 2
push edi
push 3
push 0xc0000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [0x44f45c], eax
cmp eax, 0xffffffff
jne 0x40aba7
push dword [0x44f84c]
push str.CreateFile_Error:__s
jmp 0x40aad0
mov esi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push edi
push edi
push edi
push eax
call esi
push edi
push 0x451574
push dword [0x45d560]
push dword [0x4515d4]
push dword [0x44f45c]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x40abe5
push dword [0x44f84c]
push str.WriteFile_Error:__s
jmp 0x40aad0
push edi
push edi
push dword [0x45d560]
push dword [0x44f45c]
call esi
push dword [0x44f45c]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push str.Dump_done_
call fcn.0040d967
push dword [0x44f84c]
push str.Saved_to:__s
call fcn.0040d967
add esp, 0xc
mov eax, dword [0x44f45c]
test eax, eax
je 0x40ac34
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x44f45c], edi
pop edi
pop esi
pop ebx
pop ebp
jmp fcn.0040b686
mov dword [0x44f958], edi
pop edi
pop esi
pop ebx
pop ebp
ret