Function at 0x407c80
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [esp], 1
mov eax, dword [fcn.0040b0f0]
call eax
mov edx, dword [ebp + 8]
mov dword [esp + 8], edx
mov dword [esp + 4], str.usage:__s___write_C:WindowsTempdoc.docx____valid_____duplicate_____help_
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
mov dword [esp], 1
mov eax, dword [fcn.0040b0f0]
call eax
mov dword [esp + 4], eax
mov dword [esp], 0xa
call sub.msvcrt.dll_fputc
mov dword [esp], 1
mov eax, dword [fcn.0040b0f0]
call eax
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x11
mov dword [esp + 4], 1
mov dword [esp], str.Dumpfile_options:
call sub.msvcrt.dll_fwrite
mov dword [esp], 1
mov eax, dword [fcn.0040b0f0]
call eax
mov dword [esp + 4], eax
mov dword [esp], 0xa
call sub.msvcrt.dll_fputc
mov dword [esp], 1
mov eax, dword [fcn.0040b0f0]
call eax
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x23
mov dword [esp + 4], 1
mov dword [esp], str.______write_DUMP_PATH___w_DUMP_PATH
call sub.msvcrt.dll_fwrite
mov dword [esp], 1
mov eax, dword [fcn.0040b0f0]
call eax
mov dword [esp + 4], eax
mov dword [esp], 0xa
call sub.msvcrt.dll_fputc
mov dword [esp], 1
mov eax, dword [fcn.0040b0f0]
call eax
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x20
mov dword [esp + 4], 1
mov dword [esp], str.____________filename_of_the_dump
call sub.msvcrt.dll_fwrite
mov dword [esp], 1
mov eax, dword [fcn.0040b0f0]
call eax
mov dword [esp + 4], eax
mov dword [esp], 0xa
call sub.msvcrt.dll_fputc
mov dword [esp], 1
mov eax, dword [fcn.0040b0f0]
call eax
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0xf
mov dword [esp + 4], 1
mov dword [esp], str.______valid___v
call sub.msvcrt.dll_fwrite
mov dword [esp], 1
mov eax, dword [fcn.0040b0f0]
call eax
mov dword [esp + 4], eax
mov dword [esp], 0xa
call sub.msvcrt.dll_fputc
mov dword [esp], 1
mov eax, dword [fcn.0040b0f0]
call eax
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x30
mov dword [esp + 4], 1
mov dword [esp], str.____________create_a_dump_with_a_valid_signature
call sub.msvcrt.dll_fwrite
mov dword [esp], 1
mov eax, dword [fcn.0040b0f0]
call eax
mov dword [esp + 4], eax
mov dword [esp], 0xa
call sub.msvcrt.dll_fputc
mov dword [esp], 1
mov eax, dword [fcn.0040b0f0]
call eax
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 1
mov dword [esp], str.Obtain_an_LSASS_handle_via:
call sub.msvcrt.dll_fwrite
mov dword [esp], 1
mov eax, dword [fcn.0040b0f0]
call eax
mov dword [esp + 4], eax
mov dword [esp], 0xa
call sub.msvcrt.dll_fputc
mov dword [esp], 1
mov eax, dword [fcn.0040b0f0]
call eax
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x13
mov dword [esp + 4], 1
mov dword [esp], str.______duplicate___d
call sub.msvcrt.dll_fwrite
mov dword [esp], 1
mov eax, dword [fcn.0040b0f0]
call eax
mov dword [esp + 4], eax
mov dword [esp], 0xa
call sub.msvcrt.dll_fputc
mov dword [esp], 1
mov eax, dword [fcn.0040b0f0]
call eax
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x2e
mov dword [esp + 4], 1
mov dword [esp], str.____________duplicate_an_existing_LSASS_handle
call sub.msvcrt.dll_fwrite
mov dword [esp], 1
mov eax, dword [fcn.0040b0f0]
call eax
mov dword [esp + 4], eax
mov dword [esp], 0xa
call sub.msvcrt.dll_fputc
mov dword [esp], 1
mov eax, dword [fcn.0040b0f0]
call eax
mov dword [esp + 0xc], eax
mov dword [esp + 8], 5
mov dword [esp + 4], 1
mov dword [esp], str.Help:
call sub.msvcrt.dll_fwrite
mov dword [esp], 1
mov eax, dword [fcn.0040b0f0]
call eax
mov dword [esp + 4], eax
mov dword [esp], 0xa
call sub.msvcrt.dll_fputc
mov dword [esp], 1
mov eax, dword [fcn.0040b0f0]
call eax
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0xe
mov dword [esp + 4], 1
mov dword [esp], str.______help___h
call sub.msvcrt.dll_fwrite
mov dword [esp], 1
mov eax, dword [fcn.0040b0f0]
call eax
mov dword [esp + 4], eax
mov dword [esp], 0xa
call sub.msvcrt.dll_fputc
mov dword [esp], 1
mov eax, dword [fcn.0040b0f0]
call eax
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x2d
mov dword [esp + 4], 1
mov dword [esp], str.____________print_this_help_message_and_leave
call sub.msvcrt.dll_fwrite
mov dword [esp], 1
mov eax, dword [fcn.0040b0f0]
call eax
mov dword [esp + 4], eax
mov dword [esp], 0xa
call sub.msvcrt.dll_fputc
nop
leave
ret