Function at 0x415990
Capabilities:
Resolve function by parsing pe exports
Write file on windows

Disassembly:
sub esp, 0x1c
push ebx
push ebp
mov eax, ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], eax
push esi
push edi
test eax, eax
jne 0x4159ad
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
mov edi, dword [eax + 0x3c]
add edi, eax
mov dword [esp + 0x28], edi
mov eax, dword [edi + 0x84]
test eax, eax
je 0x415df3
push eax
push str.pImport__Size:__x_n
push 0x100000
push 0x420410
call fcn.00401010
mov ebp, dword [sym.imp.KERNEL32.dll_GetStdHandle]
add esp, 0x10
mov esi, eax
mov dword [0x42040c], esi
push 0xfffffffffffffff5
call ebp
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
push 0x420408
push esi
push 0x420410
push eax
call ebx
push dword [edi + 0x80]
push str.pImport__VirtualAddress:__x_n
push 0x100000
push 0x420410
call fcn.00401010
add esp, 0x10
mov esi, eax
mov dword [0x42040c], esi
push 0xfffffffffffffff5
call ebp
push 0
push 0x420408
push esi
push 0x420410
push eax
call ebx
push dword [edi + 0xdc]
push str.pIAT__Size:__x_n
push 0x100000
push 0x420410
call fcn.00401010
add esp, 0x10
mov esi, eax
mov dword [0x42040c], esi
push 0xfffffffffffffff5
call ebp
push 0
push 0x420408
push esi
push 0x420410
push eax
call ebx
push dword [edi + 0xd8]
push str.pIAT__VirtualAddress:__x_n
push 0x100000
push 0x420410
call fcn.00401010
add esp, 0x10
mov esi, eax
mov dword [0x42040c], esi
push 0xfffffffffffffff5
call ebp
push 0
push 0x420408
push esi
push 0x420410
push eax
call ebx
mov edi, dword [edi + 0x80]
mov eax, dword [esp + 0x14]
add edi, eax
mov ecx, dword [edi + 0xc]
test ecx, ecx
je 0x415df3
mov dword [esp + 0x20], 0
nop
add eax, ecx
push eax
push str.import_lib_name:__s_n
push 0x100000
push 0x420410
call fcn.00401010
add esp, 0x10
mov esi, eax
mov dword [0x42040c], esi
push 0xfffffffffffffff5
call ebp
push 0
push 0x420408
push esi
push 0x420410
push eax
call ebx
mov eax, dword [esp + 0x18]
mov ecx, dword [eax + 0x2c]
mov eax, dword [edi + 0xc]
add eax, dword [esp + 0x14]
push eax
call ecx
mov ebx, eax
test ebx, ebx
jne 0x415b53
push str.hModule_is_NULL_n
push 0x100000
push 0x420410
call fcn.00401010
add esp, 0xc
mov esi, eax
mov dword [0x42040c], esi
push 0xfffffffffffffff5
call ebp
push ebx
push 0x420408
push esi
push 0x420410
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 0x14]
mov esi, dword [edi]
mov edx, dword [edi + 0x10]
lea ebp, [esi + eax]
lea ecx, [edx + eax]
mov eax, dword [ebp]
mov dword [esp + 0x1c], ecx
test eax, eax
je 0x415d8c
sub edx, esi
mov edi, ebp
mov dword [esp + 0x24], edx
test eax, eax
jns 0x415bfc
push str.ordinal_is_used_n
push 0x100000
push 0x420410
call fcn.00401010
add esp, 0xc
mov esi, eax
mov dword [0x42040c], esi
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push 0
push 0x420408
push esi
push 0x420410
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test ebx, ebx
je 0x415bef
mov esi, dword [ebx + 0x3c]
movzx ecx, word [ebp]
mov edx, dword [esi + ebx + 0x78]
add edx, ebx
sub ecx, dword [edx + 0x10]
mov eax, dword [edx + 0x1c]
lea ecx, [eax + ecx*4]
mov eax, dword [esi + ebx + 0x7c]
mov ecx, dword [ecx + ebx]
add eax, edx
cdq
add ecx, ebx
mov ebp, eax
mov esi, edx
mov eax, ecx
cdq
cmp edx, esi
ja 0x415bef
jb 0x415bf1
cmp eax, ebp
jbe 0x415bf1
xor ecx, ecx
mov edx, dword [esp + 0x1c]
mov dword [edx], ecx
jmp 0x415d73
push ecx
push str.abc:__p_t
push 0x100000
push 0x420410
call fcn.00401010
add esp, 0x10
mov esi, eax
mov dword [0x42040c], esi
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push 0
push 0x420408
push esi
push 0x420410
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
add edx, 2
mov ecx, dword [eax + 0x5c]
mov eax, dword [ebp]
add eax, edx
push eax
push ebx
call ecx
push eax
push str.VA:__p_t
push 0x100000
push 0x420410
call fcn.00401010
add esp, 0x10
mov esi, eax
mov dword [0x42040c], esi
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push 0
push 0x420408
push esi
push 0x420410
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp]
mov ecx, dword [esp + 0x14]
movzx eax, word [eax + ecx]
push eax
push str.__hx_t
push 0x100000
push 0x420410
call fcn.00401010
add esp, 0x10
mov esi, eax
mov dword [0x42040c], esi
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push 0
push 0x420408
push esi
push 0x420410
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [esp + 0x14]
mov eax, dword [ebp]
add ecx, 2
add eax, ecx
push eax
push str.__s_t
push 0x100000
push 0x420410
call fcn.00401010
add esp, 0x10
mov esi, eax
mov dword [0x42040c], esi
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push 0
push 0x420408
push esi
push 0x420410
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp]
mov ecx, dword [esp + 0x14]
add ecx, 2
add eax, ecx
push eax
mov eax, dword [esp + 0x1c]
push ebx
mov eax, dword [eax + 0x5c]
call eax
mov edx, dword [esp + 0x1c]
push eax
push str.iat:__llx_n
push 0x100000
push 0x420410
mov dword [edx], eax
call fcn.00401010
add esp, 0x10
mov esi, eax
mov dword [0x42040c], esi
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push 0
push 0x420408
push esi
push 0x420410
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [esp + 0x24]
add edi, 4
add ecx, edi
mov ebp, edi
mov dword [esp + 0x1c], ecx
mov eax, dword [edi]
test eax, eax
jne 0x415b7b
push 0x41d4ec
push 0x100000
push 0x420410
call fcn.00401010
mov ebp, dword [sym.imp.KERNEL32.dll_GetStdHandle]
add esp, 0xc
mov esi, eax
mov dword [0x42040c], esi
push 0xfffffffffffffff5
call ebp
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
push 0x420408
push esi
push 0x420410
push eax
call ebx
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
add eax, 0x14
mov dword [esp + 0x20], eax
mov edi, dword [ecx + 0x80]
add edi, eax
mov eax, dword [esp + 0x14]
add edi, eax
mov ecx, dword [edi + 0xc]
test ecx, ecx
jne 0x415ad0
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x1c
ret