Function at 0x402590
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x644
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x63c], eax
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x624], 0
mov dword [ebp - 0x614], 0
test ecx, ecx
jne 0x4025fa
push 0
lea eax, [ebp - 0x60c]
push eax
push 4
lea eax, [ebp - 0x624]
push eax
push dword [edi + 0x18]
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004050db
mov esp, ebp
pop ebp
ret 8
lea eax, [ebp - 0x618]
mov dword [ebp - 0x618], ecx
push eax
lea ecx, [edi + 0x23c]
call fcn.00404a80
mov esi, dword [eax]
mov dword [ebp - 0x61c], esi
test esi, esi
jne 0x40265e
mov eax, dword [ebp - 0x618]
lea ecx, [ebp - 0x61c]
push ecx
push 0x423624
push eax
mov edx, dword [eax]
call dword [edx + 0x38]
lea eax, [ebp - 0x618]
push eax
lea ecx, [edi + 0x23c]
call fcn.00404a80
mov ecx, dword [ebp - 0x61c]
mov dword [eax], ecx
mov esi, dword [ebp - 0x61c]
test esi, esi
je 0x4025cc
mov eax, dword [esi]
lea ecx, [ebp - 0x620]
push ecx
push 0
lea ecx, [ebp - 0x608]
push ecx
lea ecx, [ebp - 0x614]
push ecx
push esi
call dword [eax + 0x18]
mov eax, dword [esi]
lea ecx, [ebp - 0x62c]
push ecx
push dword [ebp - 0x614]
push esi
call dword [eax + 0x10]
push 0
lea eax, [ebp - 0x60c]
push eax
push 4
lea eax, [ebp - 0x62c]
push eax
push dword [edi + 0x18]
call dword [sym.imp.KERNEL32.dll_WriteFile]
nop dword [eax]
mov eax, dword [esi]
lea ecx, [ebp - 0x620]
push ecx
push pe_nt_image_headers32
lea ecx, [ebp - 0x608]
push ecx
lea ecx, [ebp - 0x614]
push ecx
push esi
call dword [eax + 0x18]
cmp dword [ebp - 0x620], 0
mov dword [ebp - 0x63c], eax
mov dword [ebp - 0x628], 0
jbe 0x4027db
lea ebx, [ebp - 0x608]
push 0
lea eax, [ebp - 0x60c]
push eax
push 4
push ebx
push dword [edi + 0x18]
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea ecx, [ebp - 0x634]
mov dword [ebp - 0x610], 0
mov eax, dword [esi]
push ecx
lea ecx, [ebp - 0x630]
push ecx
lea ecx, [ebp - 0x610]
push ecx
push 0xff
lea ecx, [ebp - 0x208]
push ecx
push dword [ebx]
push esi
call dword [eax + 0x30]
mov eax, dword [ebp - 0x610]
add eax, eax
push 0
mov dword [ebp - 0x610], eax
lea eax, [ebp - 0x60c]
push eax
push 4
lea eax, [ebp - 0x610]
push eax
push dword [edi + 0x18]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea eax, [ebp - 0x60c]
push eax
push dword [ebp - 0x610]
lea eax, [ebp - 0x208]
push eax
push dword [edi + 0x18]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea eax, [ebp - 0x60c]
push eax
push 4
lea eax, [ebp - 0x630]
push eax
push dword [edi + 0x18]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea eax, [ebp - 0x60c]
push eax
push 4
lea eax, [ebp - 0x634]
push eax
push dword [edi + 0x18]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 0x628]
add ebx, 4
inc eax
mov dword [ebp - 0x628], eax
cmp eax, dword [ebp - 0x620]
jb 0x4026f3
mov eax, dword [ebp - 0x63c]
test eax, eax
je 0x4026b0
push dword [ebp - 0x614]
mov eax, dword [esi]
push esi
call dword [eax + 0xc]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004050db
mov esp, ebp
pop ebp
ret 8