Function at 0x42e4b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x40c
mov eax, dword [0x45b990]
push ebx
push esi
push edi
mov ebx, ecx
push 0
xor eax, ebp
mov esi, edx
push 0x4505db
mov ecx, 0x45ceac
mov dword [esp + 0x41c], eax
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], esi
call fcn.00408930
mov eax, dword [ebx + 8]
test eax, eax
je 0x42e4fa
mov edx, esi
mov ecx, ebx
call fcn.0042e7a0
mov eax, dword [ebx + 0xc]
test eax, eax
je 0x42e506
call fcn.0042eaa0
mov eax, dword [ebx + 0x14]
test eax, eax
je 0x42e512
call fcn.0042eb50
mov eax, dword [ebx + 0x18]
test eax, eax
je 0x42e51f
push esi
call fcn.0042ec00
mov eax, dword [ebx + 0x1c]
test eax, eax
je 0x42e551
mov esi, dword [esi + 4]
mov ecx, 0xb3
lea edi, [esp + 0x18]
rep movsd dword es:[edi], dword [esi]
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
mov eax, dword [esp + 0x18]
push eax
lea ebx, [esp + 0x20]
call fcn.0042ed30
mov esi, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov eax, dword [0x45e1b8]
test eax, eax
je 0x42e56c
mov edi, dword [eax]
push esi
call fcn.0042e080
mov ecx, dword [0x45e1b8]
push eax
call dword [edi + 4]
mov eax, dword [ebx + 0x44]
mov edi, 0x10
cmp eax, edi
jb 0x42e57d
mov eax, dword [ebx + 0x30]
jmp 0x42e580
lea eax, [ebx + 0x30]
push pe_nt_image_headers32
push eax
lea ecx, [esp + 0x318]
push ecx
call fcn.00437d40
push pe_nt_image_headers32
lea edx, [esp + 0x320]
push 0x4535ec
push edx
call fcn.00437e70
mov al, byte [ebx + 0x9c]
add esp, 0x18
test al, al
je 0x42e64b
lea eax, [esp + 0x10]
push eax
call fcn.00438147
lea ecx, [esp + 0x14]
push ecx
call fcn.00437424
mov edx, dword [eax]
mov ecx, dword [eax + 4]
push edx
mov edx, dword [eax + 8]
push ecx
mov ecx, dword [eax + 0xc]
push edx
mov edx, dword [eax + 0x10]
mov eax, dword [eax + 0x14]
push ecx
inc edx
push edx
sub eax, 0x64
push eax
push str._02d__02d__02d__02d__02d__02d
lea ecx, [esp + 0x30c]
push 0x28
push ecx
call fcn.004375dd
mov al, byte [ebx + 0x9c]
add esp, 0x2c
test al, al
je 0x42e64b
cmp dword [ebx + 0x60], edi
jb 0x42e615
mov ecx, dword [ebx + 0x4c]
jmp 0x42e618
lea ecx, [ebx + 0x4c]
cmp dword [ebx + 0x44], edi
jb 0x42e622
mov eax, dword [ebx + 0x30]
jmp 0x42e625
lea eax, [ebx + 0x30]
lea edx, [esp + 0x2e8]
push edx
push ecx
push eax
push str._s_s__s.log
lea eax, [esp + 0x320]
push 0xff
push eax
call fcn.004375dd
add esp, 0x18
jmp 0x42e681
cmp dword [ebx + 0x60], edi
jb 0x42e655
mov ecx, dword [ebx + 0x4c]
jmp 0x42e658
lea ecx, [ebx + 0x4c]
cmp dword [ebx + 0x44], edi
jb 0x42e662
mov eax, dword [ebx + 0x30]
jmp 0x42e665
lea eax, [ebx + 0x30]
push ecx
push eax
push str._s_s.log
lea ecx, [esp + 0x31c]
push 0xff
push ecx
call fcn.004375dd
add esp, 0x14
lea eax, [esp + 0x310]
mov byte [esp + 0x40f], 0
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x42e693
sub eax, edx
push eax
lea edx, [esp + 0x314]
push edx
lea ecx, [ebx + 0x80]
call fcn.00408930
push 0
push 0x80000080
push 2
push 0
push 0
push 0x40000000
lea eax, [esp + 0x328]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x42e706
cmp dword [0x45cec4], edi
mov eax, dword [0x45ceb0]
jae 0x42e6e9
mov eax, 0x45ceb0
mov edx, dword [0x45cec0]
push 0
lea ecx, [esp + 0x14]
push ecx
push edx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x414]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004395fe
mov esp, ebp
pop ebp
ret