Function at 0x402e7f
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x103c
call fcn.0040a8e0
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [0x415e70]
xor eax, eax
and dword [ebp - 0x102c], 0
xor ecx, ecx
push ebx
xor ebx, ebx
mov dword [ebp - 0x1010], edx
and dword [ebp - 0x100c], ebx
push esi
mov esi, dword [0x415e68]
mov dword [ebp - 0x1014], ebx
mov bl, byte [edx]
push edi
mov dword [ebp - 0x103c], esi
mov dword [ebp - 0x1024], eax
mov dword [ebp - 0x101c], ecx
cmp dword [str.lmi_instantchat.exe], eax
je 0x402f15
mov eax, 0x4150c0
push str.HEADER
push dword [eax]
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
mov ecx, dword [ebp - 0x101c]
test eax, eax
je 0x402f0f
inc ecx
mov dword [ebp - 0x101c], ecx
lea eax, [ecx*4 + 0x4150c0]
cmp dword [eax], 0
jne 0x402ee5
mov edx, dword [ebp - 0x1010]
cmp esi, 0xd
mov esi, dword [sym.imp.KERNEL32.dll_SetLastError]
jb 0x4031e2
mov edi, dword [edx + 5]
shl ecx, 2
mov dword [ebp - 0x1020], ecx
cmp edi, 0xffffffff
je 0x4031e2
cmp edi, ecx
jb 0x4031e2
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0x1014], eax
test eax, eax
jne 0x402f62
push 0xe
jmp 0x4031e4
cmp bl, 0xe1
jae 0x4031e2
and dword [ebp - 0x1034], 0
cmp bl, 0x2d
jb 0x402f8e
xor ah, ah
mov cl, 0x2d
mov al, bl
div cl
movzx eax, al
mov dword [ebp - 0x1034], eax
add bl, 0xd3
dec eax
jne 0x402f88
xor ecx, ecx
mov dword [ebp - 0x1018], ecx
cmp bl, 9
jb 0x402fb4
xor ah, ah
mov cl, 9
mov al, bl
div cl
movzx eax, al
mov ecx, eax
mov dword [ebp - 0x1018], eax
add bl, 0xf7
dec eax
jne 0x402fae
movzx eax, bl
mov dword [ebp - 0x1038], eax
add ecx, eax
mov eax, 0x300
shl eax, cl
lea eax, [eax*2 + 0xe6c]
push eax
push 0
mov dword [ebp - 0x1030], eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
mov dword [ebp - 0x100c], ebx
test ebx, ebx
jne 0x402ff8
push 0xe
call esi
jmp 0x4031ec
mov ebx, dword [ebp - 0x1014]
lea eax, [ebp - 0x1028]
mov edx, dword [ebp - 0x1030]
push eax
mov eax, dword [ebp - 0x103c]
push edi
push ebx
mov ebx, dword [ebp - 0x100c]
add eax, 0xfffffff3
push eax
mov eax, dword [ebp - 0x1010]
mov ecx, ebx
add eax, 0xd
push eax
push dword [ebp - 0x1034]
push dword [ebp - 0x1018]
push dword [ebp - 0x1038]
call fcn.00402374
add esp, 0x20
test eax, eax
jne 0x4031db
cmp dword [ebp - 0x1028], edi
jne 0x4031db
mov ecx, dword [ebp - 0x1014]
test dword [ecx], 0x80000000
je 0x403085
cmp dword [ecx], 0x80000001
jne 0x4031db
push ecx
mov edx, edi
call fcn.00402d4e
pop ecx
mov dword [ebp - 0x102c], eax
jmp 0x4031ec
mov eax, dword [ebp - 0x101c]
test eax, eax
je 0x4031db
and dword [ebp - 0x1010], 0
mov edx, dword [ebp - 0x1020]
test eax, eax
je 0x4031ab
mov ebx, dword [ebp - 0x1014]
sub ecx, 0x4150c0
mov eax, dword [ebp - 0x1010]
mov dword [ebp - 0x1030], ecx
mov ecx, dword [ecx + eax*4 + 0x4150c0]
mov dword [ebp - 0x1018], ecx
add ecx, edx
mov dword [ebp - 0x1028], ecx
cmp ecx, edi
ja 0x4031e2
push dword [eax*4 + 0x4150c0]
lea eax, [ebp - 0x1004]
mov byte [ebp - 0x1004], 0
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0
push 0x8000080
push 2
push 0
push 1
push 0x40000000
lea eax, [ebp - 0x1004]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x1024], eax
cmp eax, 0xffffffff
je 0x4031e6
push 0
lea ecx, [ebp - 0x1008]
push ecx
push dword [ebp - 0x1018]
mov ecx, dword [ebp - 0x1020]
add ecx, ebx
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4031e6
mov eax, dword [ebp - 0x1018]
cmp dword [ebp - 0x1008], eax
jne 0x4031e6
mov eax, dword [ebp - 0x1024]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x1028]
xor eax, eax
mov ecx, dword [ebp - 0x1030]
mov dword [ebp - 0x1024], eax
mov eax, dword [ebp - 0x1010]
inc eax
mov dword [ebp - 0x1020], edx
mov dword [ebp - 0x1010], eax
cmp eax, dword [ebp - 0x101c]
jb 0x4030c0
mov ecx, dword [ebp - 0x1014]
mov ebx, dword [ebp - 0x100c]
lea eax, [edx + 0x10]
cmp eax, edi
jae 0x4031cb
add ecx, edx
test dword [ecx], 0x80000000
je 0x4031cb
cmp dword [ecx], 0x80000001
jne 0x4031db
sub edi, edx
jmp 0x403071
cmp edx, edi
jne 0x4031db
mov dword [ebp - 0x102c], 1
jmp 0x4031ec
push 0xd
jmp 0x402ff1
push 0xd
call esi
mov ebx, dword [ebp - 0x100c]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [ebp - 0x1008], eax
mov eax, dword [ebp - 0x1014]
test eax, eax
je 0x403214
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call edi
test ebx, ebx
je 0x403224
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call edi
mov eax, dword [ebp - 0x1024]
test eax, eax
je 0x40323a
cmp eax, 0xffffffff
je 0x40323a
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x1008]
call esi
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x102c]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.00403259
mov esp, ebp
pop ebp
ret