Function at 0x42bc40
Capabilities:
Terminate process
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [ebp - 0x10], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
cmp dword [0x44d040], 1
jle 0x42bc87
call sub.cygwin1.dll___getreent
mov edx, dword [0x46a18c]
add edx, dword [0x46a190]
mov dword [esp + 8], edx
mov dword [esp + 4], 0x42bba0
mov eax, dword [eax + 0xc]
mov dword [esp], eax
call fcn.004489fe
mov edx, dword [ebp - 0x14]
mov byte [edx + 0x1fe], 0x55
mov byte [edx + 0x1ff], 0xaa
cmp dword [0x46a190], 0
je 0x42bd6a
call sub.cygwin1.dll___getreent
mov eax, dword [eax + 0xc]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x16
mov dword [esp + 4], 1
mov dword [esp], 0x42bbc4
call sub.cygwin1.dll_fwrite
mov eax, dword [ebp - 0x10]
shl eax, 4
add eax, dword [ebp - 0x14]
mov byte [eax + 0x1be], pe_nt_image_headers32
mov byte [eax + 0x1bf], 0xff
mov byte [eax + 0x1c0], 0xff
mov byte [eax + 0x1c1], 0xff
mov byte [eax + 0x1c2], 0x96
mov byte [eax + 0x1c3], 0xff
mov byte [eax + 0x1c4], 0xff
mov byte [eax + 0x1c5], 0xff
mov byte [eax + 0x1c6], 0
mov byte [eax + 0x1c7], 0
mov byte [eax + 0x1c8], 0
mov byte [eax + 0x1c9], 0
mov edx, dword [0x46a018]
mov esi, edx
sub esi, dword [0x46a01c]
mov edx, esi
shl edx, 0xb
mov esi, edx
shr esi, 9
mov edx, esi
mov byte [eax + 0x1ca], dl
mov edx, esi
sar edx, 8
mov byte [eax + 0x1cb], dl
mov edx, esi
sar edx, 0x10
mov byte [eax + 0x1cc], dl
mov byte [eax + 0x1cd], 0
inc dword [ebp - 0x10]
mov eax, dword [0x46a190]
mov edx, eax
add eax, dword [0x46a18c]
cmp dword [ebp - 0x10], eax
jge 0x42bee7
mov eax, dword [ebp - 0x10]
sub eax, edx
mov eax, dword [eax*4 + 0x47c170]
mov dword [esp + 4], eax
mov eax, dword [0x46a010]
mov dword [esp], eax
call fcn.0040e8e3
mov ebx, eax
test eax, eax
jne 0x42bddb
call sub.cygwin1.dll___getreent
mov edx, dword [ebp - 0x10]
sub edx, dword [0x46a190]
mov edx, dword [edx*4 + 0x47c170]
mov dword [esp + 8], edx
mov dword [esp + 4], 0x42bbe0
mov eax, dword [eax + 0xc]
mov dword [esp], eax
call fcn.004489fe
mov dword [esp], 1
call sub.cygwin1.dll_exit
lea eax, [eax + 0xa]
mov dword [esp], eax
call fcn.0040eb72
lea edi, [eax*4]
lea eax, [ebx + 0x12]
mov dword [esp], eax
call fcn.0040eb72
test eax, eax
jns 0x42be02
lea eax, [eax + 0x1ff]
sar eax, 9
lea esi, [eax + 1]
call sub.cygwin1.dll___getreent
mov edx, dword [ebp - 0x10]
sub edx, dword [0x46a190]
mov edx, dword [edx*4 + 0x47c170]
mov dword [esp + 0xc], edx
mov ebx, dword [ebp - 0x10]
inc ebx
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x42bc20
mov eax, dword [eax + 0xc]
mov dword [esp], eax
call fcn.004489fe
mov eax, dword [ebp - 0x10]
shl eax, 4
add eax, dword [ebp - 0x14]
mov byte [eax + 0x1be], pe_nt_image_headers32
mov byte [eax + 0x1bf], 0xff
mov byte [eax + 0x1c0], 0xff
mov byte [eax + 0x1c1], 0xff
mov byte [eax + 0x1c2], 0x41
mov byte [eax + 0x1c3], 0xff
mov byte [eax + 0x1c4], 0xff
mov byte [eax + 0x1c5], 0xff
mov edx, edi
mov byte [eax + 0x1c6], dl
mov edx, edi
sar edx, 8
mov byte [eax + 0x1c7], dl
mov edx, edi
sar edx, 0x10
mov byte [eax + 0x1c8], dl
mov edx, edi
sar edx, 0x18
mov byte [eax + 0x1c9], dl
mov edx, esi
mov byte [eax + 0x1ca], dl
mov edx, esi
sar edx, 8
mov byte [eax + 0x1cb], dl
mov edx, esi
sar edx, 0x10
mov byte [eax + 0x1cc], dl
mov edx, esi
sar edx, 0x18
mov byte [eax + 0x1cd], dl
mov dword [ebp - 0x10], ebx
mov edx, dword [0x46a190]
mov eax, dword [0x46a18c]
add eax, edx
cmp ebx, eax
jl 0x42bd80
cmp dword [ebp - 0x10], 3
jg 0x42bf29
mov eax, dword [ebp - 0x10]
shl eax, 4
add eax, dword [ebp - 0x14]
mov byte [eax + 0x1bf], 0xff
mov byte [eax + 0x1c0], 0xff
mov byte [eax + 0x1c1], 0xff
mov byte [eax + 0x1c3], 0xff
mov byte [eax + 0x1c4], 0xff
mov byte [eax + 0x1c5], 0xff
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jle 0x42beed
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret