Function at 0x402c20
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1028
call fcn.004034d0
mov eax, dword [ebp + 8]
push ebx
mov bl, byte [eax]
push esi
xor esi, esi
push edi
mov edi, dword [ebp + 0x14]
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x24], esi
mov dword [ebp - 8], esi
mov dword [ebp - 0x10], esi
cmp edi, esi
je 0x402c72
cmp dword [edi], esi
je 0x402c72
mov eax, edi
mov ecx, dword [eax]
push str.HEADER
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x402c6f
inc esi
cmp dword [edi + esi*4], 0
lea eax, [edi + esi*4]
jne 0x402c53
mov dword [ebp - 0x10], esi
cmp dword [ebp + 0xc], 0xd
jb 0x402ec5
mov edx, dword [ebp + 8]
mov eax, dword [edx + 5]
mov dword [ebp - 0x20], eax
lea edi, [esi*4]
cmp eax, 0xffffffff
je 0x402ec5
cmp eax, edi
jb 0x402ec5
push eax
xor esi, esi
push esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 4], eax
cmp eax, esi
jne 0x402cbc
push 0xe
jmp 0x402ec7
cmp bl, 0xe1
jae 0x402ec5
mov dword [ebp - 0x28], esi
cmp bl, 0x2d
jb 0x402cec
movzx ecx, bl
mov eax, 0x6c16c16d
mul ecx
sub ecx, edx
shr ecx, 1
add ecx, edx
shr ecx, 5
movzx eax, cl
mov dword [ebp - 0x28], eax
add bl, 0xd3
dec eax
jne 0x402ce6
mov dword [ebp - 0x18], esi
cmp bl, 9
jb 0x402d0c
movzx ecx, bl
mov eax, 0x38e38e39
mul ecx
shr edx, 1
movzx eax, dl
mov dword [ebp - 0x18], eax
add bl, 0xf7
dec eax
jne 0x402d06
mov edx, dword [ebp - 0x18]
movzx ebx, bl
lea ecx, [ebx + edx]
mov esi, 0x300
shl esi, cl
lea esi, [esi + esi + 0xe6c]
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0x24], eax
test eax, eax
jne 0x402d41
push 0xe
jmp 0x402ec7
mov edx, dword [ebp - 0x20]
lea ecx, [ebp - 0xc]
push ecx
mov ecx, dword [ebp - 4]
push edx
mov edx, dword [ebp + 0xc]
push ecx
mov ecx, dword [ebp + 8]
add edx, 0xfffffff3
push edx
mov edx, dword [ebp - 0x28]
add ecx, 0xd
push ecx
mov ecx, dword [ebp - 0x18]
push edx
push ecx
push ebx
push esi
push eax
call fcn.004020c0
add esp, 0x28
test eax, eax
jne 0x402ec5
mov ebx, dword [ebp - 0x20]
cmp dword [ebp - 0xc], ebx
jne 0x402ec5
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
test ecx, ecx
jns 0x402dad
cmp ecx, 0x80000001
jne 0x402ec5
mov edx, dword [ebp + 0x10]
push edx
push ebx
push eax
call fcn.00402ab0
add esp, 0xc
mov dword [ebp - 0x14], eax
jmp 0x402ecd
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x402ec5
mov esi, dword [ebp + 0x14]
sub eax, esi
mov dword [ebp + 8], 0
mov dword [ebp + 0xc], eax
jmp 0x402dd3
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + esi]
mov dword [ebp - 0xc], eax
add eax, edi
cmp eax, ebx
ja 0x402ec5
mov eax, dword [ebp + 0x10]
mov byte [ebp - 0x1028], 0
test eax, eax
je 0x402dff
push eax
lea eax, [ebp - 0x1028]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ecx, dword [esi]
push ecx
lea edx, [ebp - 0x1028]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0
push 0x8000080
push 2
push 0
push 1
push 0x40000000
lea eax, [ebp - 0x1028]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
je 0x402ecd
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
push 0
lea ecx, [ebp - 0x1c]
push ecx
push edx
mov edx, dword [ebp - 8]
lea ecx, [edi + eax]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x402ecd
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0xc]
jne 0x402ecd
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + 8]
add edi, dword [ebp - 0xc]
inc eax
add esi, 4
mov dword [ebp - 8], 0
mov dword [ebp + 8], eax
cmp eax, dword [ebp - 0x10]
jb 0x402dd0
mov eax, dword [ebp - 4]
lea edx, [edi + 0x10]
cmp edx, ebx
jae 0x402eb8
mov ecx, dword [eax + edi]
add eax, edi
test ecx, ecx
jns 0x402eb8
cmp ecx, 0x80000001
jne 0x402ec5
mov ecx, dword [ebp + 0x10]
push ecx
sub ebx, edi
push ebx
push eax
call fcn.00402ab0
add esp, 0xc
mov dword [ebp - 0x14], eax
jmp 0x402ecd
cmp edi, ebx
jne 0x402ec5
mov dword [ebp - 0x14], 1
jmp 0x402ecd
push 0xd
call dword [sym.imp.KERNEL32.dll_SetLastError]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 4]
test eax, eax
je 0x402eef
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call esi
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x402f02
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call esi
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
test eax, eax
je 0x402f18
cmp eax, 0xffffffff
je 0x402f18
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebp - 0x14]
mov esp, ebp
pop ebp
ret