Function at 0x4681e0
Capabilities:
Terminate process
Write file on windows

Disassembly:
mov eax, 0x47195c
mov edx, 1
jmp 0x461980
sub esp, 8
mov esi, eax
mov edi, edx
xor edx, edx
mov ecx, eax
inc eax
cmp byte [ecx], 0
je 0x461934
inc edx
jmp 0x461929
push 0
lea eax, [esp + 4]
push eax
push edx
push esi
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.DLL_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.DLL_WriteFile]
push 0
lea eax, [esp + 4]
push eax
push 2
lea eax, [esp + 0x10]
push eax
push 0xfffffffffffffff4
mov word [esp + 0x18], 0xa0d
call dword [sym.imp.KERNEL32.DLL_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.DLL_WriteFile]
mov eax, edi
jmp 0x462f50
mov ebx, eax
mov ecx, edx
mov edx, ds
call fcn.00462fa0
test eax, eax
jne 0x461995
mov edx, ecx
mov eax, ebx
jmp 0x461920
mov eax, ecx
jmp 0x462f50
push ecx
push esi
push edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], ebx
test eax, eax
jl 0x4682c8
cmp eax, dword [0x471c64]
jae 0x4682c8
call fcn.004647f0
mov edx, eax
mov ebx, eax
test eax, eax
je 0x4682c8
test al, 2
je 0x4682dc
mov eax, dword [ebp - 4]
call fcn.00463550
mov esi, eax
mov eax, dword [ebp - 4]
call dword [0x471a8c]
test dl, 0x80
je 0x46826e
test dh, 0x20
jne 0x46826e
push esi
call dword [sym.imp.KERNEL32.DLL_GetFileType]
cmp eax, 1
jne 0x46826e
push 2
lea eax, [ebp - 0x10]
push eax
xor ecx, ecx
push ecx
push esi
mov dword [ebp - 0x10], ecx
call dword [sym.imp.KERNEL32.DLL_SetFilePointer]
cmp eax, 0xffffffff
jne 0x46826e
call dword [sym.imp.KERNEL32.DLL_GetLastError]
test eax, eax
jne 0x4682f0
xor esi, esi
xor ecx, ecx
mov dword [ebp - 0x1c], esi
test bh, 0x80
je 0x468291
mov edx, ebx
mov eax, dword [ebp - 4]
and dh, 0x7f
call fcn.00464810
mov eax, dword [ebp - 4]
call fcn.00467fa0
mov ecx, eax
test ecx, ecx
jne 0x4682ad
test bl, 0x40
je 0x468300
lea ecx, [ebp - 0x1c]
mov ebx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004681a0
mov ecx, eax
mov eax, dword [ebp - 4]
call dword [0x471a90]
cmp ecx, 0xffffffff
jne 0x468434
mov eax, ecx
mov esp, ebp
pop ebp
pop edi
pop esi
pop ecx
ret
call dword [0x471a84]
mov dword [eax + 4], 4
mov eax, 0xffffffff
jmp 0x4682c1
call dword [0x471a84]
mov dword [eax + 4], 6
mov eax, 0xffffffff
jmp 0x4682c1
mov eax, dword [ebp - 4]
call dword [0x471a90]
call fcn.00463240
jmp 0x4682c1
call fcn.00460220
mov dword [ebp - 0x18], eax
cmp eax, 0xb0
jb 0x460269
mov esi, 0x200
cmp dword [ebp - 0x18], 0x230
jae 0x468326
mov esi, pe_nt_image_headers32
lea eax, [esi + 3]
and al, 0xfc
sub esp, eax
xor eax, eax
mov edi, esp
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0xc], 0
jbe 0x468372
mov eax, dword [ebp - 8]
add eax, dword [ebp - 0x18]
cmp byte [eax], 0xa
jne 0x4683b8
mov eax, dword [ebp - 0x14]
mov byte [edi + eax], 0xd
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp esi, eax
jne 0x4683b8
lea ecx, [ebp - 0x14]
mov ebx, eax
mov edx, edi
mov eax, dword [ebp - 4]
call fcn.004681a0
mov edx, eax
mov ecx, eax
cmp eax, 0xffffffff
jne 0x4683a2
mov edx, dword [ebp - 0x14]
test edx, edx
je 0x4682ad
lea ecx, [ebp - 0x18]
mov eax, dword [ebp - 4]
mov ebx, edx
mov edx, edi
call fcn.004681a0
mov ecx, eax
cmp eax, 0xc
jne 0x468429
mov eax, dword [ebp - 0x18]
add dword [ebp - 0x1c], eax
jmp 0x4682ad
mov eax, dword [ebp - 0x14]
add dword [ebp - 0x1c], eax
cmp edx, 0xc
je 0x468372
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
xor eax, eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 8]
add eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
mov al, byte [eax]
mov byte [edx + edi], al
mov eax, dword [ebp - 0x14]
inc eax
inc dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
cmp esi, eax
je 0x4683e2
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0xc]
jb 0x46833d
jmp 0x468372
lea ecx, [ebp - 0x14]
mov ebx, eax
mov edx, edi
mov eax, dword [ebp - 4]
call fcn.004681a0
mov edx, eax
mov ecx, eax
cmp eax, 0xffffffff
je 0x468372
mov eax, dword [ebp - 0x14]
add dword [ebp - 0x1c], eax
cmp edx, 0xc
je 0x468372
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
xor eax, eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0xc]
jb 0x46833d
jmp 0x468372
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
jmp 0x4682ad
mov eax, dword [ebp - 0x1c]
mov esp, ebp
pop ebp
pop edi
pop esi
pop ecx
ret