Function at 0x406770
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x18
push ebx
push ebp
push esi
mov esi, dword [esp + 0x2c]
push edi
mov ecx, 0xa
mov edi, 0x4363e0
xor ebx, ebx
rep movsd dword es:[edi], dword [esi]
mov edx, dword [0x4363e4]
mov ecx, dword [0x4363e8]
mov edi, 0x436430
mov byte [0x436420], 0xa
lea esi, [edx + 1]
mov byte [0x436421], 5
mov byte [0x436422], 1
mov byte [0x436423], 8
lea eax, [esi + esi*2]
mov word [0x436424], bx
and eax, 0xfffc
dec ecx
mov dword [esp + 0x18], eax
lea eax, [edx - 1]
mov word [0x436428], ax
mov eax, 0x48
mov word [0x43642a], cx
mov word [0x43642c], ax
mov word [0x43642e], ax
mov ecx, 0xc
xor eax, eax
mov word [0x436426], bx
rep stosd dword es:[edi], eax
mov byte [0x436460], al
mov eax, edx
and eax, 0x80000001
mov word [0x436464], 1
mov byte [0x436461], 3
jns 0x406821
dec eax
or eax, 0xfffffffe
inc eax
mov word [0x436462], si
jne 0x406831
mov word [0x436462], dx
mov ecx, 0xe
xor eax, eax
mov edi, 0x436466
mov ebp, dword [sym.imp.KERNEL32.dll_WriteFile]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x14]
push ebx
mov ebx, dword [esp + 0x30]
push ecx
push 0x80
push 0x436420
push ebx
stosw word es:[edi], ax
call ebp
mov cx, word [0x4363ee]
mov esi, dword [0x4363e4]
cmp cx, 8
jne 0x406877
mov dword [esp + 0x18], esi
jmp 0x406893
cmp cx, 0x10
jne 0x406886
lea edx, [esi + esi]
mov dword [esp + 0x18], edx
jmp 0x406893
cmp cx, 0x18
jne 0x406893
lea eax, [esi + esi*2]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x18]
mov edx, eax
and edx, reloc.WSOCK32.dll_closesocket
jns 0x4068a6
dec edx
or edx, 0xfffffffc
inc edx
je 0x4068bc
cdq
and edx, 3
add eax, edx
sar eax, 2
lea eax, [eax*4 + 4]
mov dword [esp + 0x18], eax
mov edx, dword [0x4363ec]
xor eax, eax
and edx, 0xffff
mov ax, cx
imul edx, eax
cmp edx, 8
jne 0x406a34
mov ecx, dword [esp + 0x34]
mov eax, dword [0x4363e8]
test eax, eax
lea edi, [ecx - 1]
mov dword [esp + 0x2c], 0
jle 0x4069c8
xor edx, edx
test esi, esi
jle 0x406978
jmp 0x406901
mov edx, dword [esp + 0x34]
mov cl, byte [edi]
xor eax, eax
mov byte [esp + 0x11], cl
inc edi
inc eax
inc edx
cmp cl, byte [edi]
jne 0x406919
cmp eax, 0x3f
jg 0x406919
cmp edx, esi
jl 0x406909
cmp eax, 1
mov dword [esp + 0x34], edx
jle 0x40693c
or al, 0xc0
lea edx, [esp + 0x14]
mov byte [esp + 0x12], al
push 0
push edx
lea eax, [esp + 0x1a]
push 2
mov byte [esp + 0x1f], cl
push eax
jmp 0x406967
test cl, cl
je 0x406959
mov byte [esp + 0x13], cl
lea ecx, [esp + 0x14]
push 0
push ecx
lea edx, [esp + 0x1a]
push 2
mov byte [esp + 0x1e], 0xc1
push edx
jmp 0x406967
lea eax, [esp + 0x14]
push 0
push eax
lea ecx, [esp + 0x19]
push 1
push ecx
push ebx
call ebp
mov esi, dword [0x4363e4]
mov eax, dword [esp + 0x34]
cmp eax, esi
jl 0x4068fd
mov edx, esi
and edx, 0x80000001
jns 0x406987
dec edx
or edx, 0xfffffffe
inc edx
je 0x4069a5
lea eax, [esp + 0x14]
push 0
push eax
lea ecx, [esp + 0x19]
push 1
push ecx
push ebx
mov byte [esp + 0x25], 0
call ebp
mov esi, dword [0x4363e4]
mov eax, dword [esp + 0x18]
cmp eax, esi
je 0x4069b1
sub eax, esi
add edi, eax
mov eax, dword [esp + 0x2c]
mov ecx, dword [0x4363e8]
inc eax
cmp eax, ecx
mov dword [esp + 0x2c], eax
jl 0x4068f5
lea edx, [esp + 0x14]
push 0
push edx
lea eax, [esp + 0x19]
push 1
push eax
push ebx
mov byte [esp + 0x25], 0xc
call ebp
mov ecx, dword [esp + 0x30]
mov eax, 0x4360e1
add ecx, 0x29
mov dl, byte [ecx + 1]
add ecx, 4
mov byte [eax - 1], dl
mov dl, byte [ecx - 4]
mov byte [eax], dl
mov dl, byte [ecx - 5]
mov byte [eax + 1], dl
add eax, 3
cmp eax, 0x4363e1
jl 0x4069ea
lea eax, [esp + 0x14]
push 0
push eax
push 0x300
push 0x4360e0
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x18
ret
mov ecx, dword [0x4363e8]
imul ecx, esi
push ecx
call fcn.00418887
mov edx, dword [0x4363e8]
mov esi, eax
imul edx, dword [0x4363e4]
push edx
mov dword [esp + 0x24], esi
call fcn.00418887
mov edi, eax
mov eax, dword [0x4363e8]
imul eax, dword [0x4363e4]
push eax
mov dword [esp + 0x2c], edi
call fcn.00418887
mov ecx, dword [0x4363e8]
mov edx, dword [0x4363e4]
mov ebp, eax
add esp, 0xc
lea eax, [ecx - 1]
mov dword [esp + 0x24], ebp
imul eax, edx
lea ecx, [eax + esi]
lea esi, [eax + edi]
lea edi, [eax + ebp]
mov eax, dword [0x4363e8]
xor ebp, ebp
test eax, eax
jle 0x406b15
mov eax, dword [esp + 0x34]
lea ebx, [eax + 2]
test edx, edx
mov dword [esp + 0x34], 0
jle 0x406ae2
mov eax, ebx
mov dl, byte [eax - 2]
inc ecx
mov byte [edi], dl
mov dl, byte [eax - 1]
mov byte [esi], dl
mov dl, byte [eax]
mov byte [ecx - 1], dl
mov edx, dword [esp + 0x34]
inc esi
inc edi
inc edx
add eax, 3
mov dword [esp + 0x34], edx
mov edx, dword [0x4363e4]
cmp dword [esp + 0x34], edx
jl 0x406ab8
mov eax, dword [0x4363e8]
mov edi, dword [esp + 0x18]
sub eax, ebp
mov ecx, dword [esp + 0x1c]
sub eax, 2
mov esi, dword [esp + 0x20]
imul eax, edx
add ebx, edi
mov edi, dword [esp + 0x24]
add ecx, eax
add esi, eax
add edi, eax
mov eax, dword [0x4363e8]
inc ebp
cmp ebp, eax
jl 0x406aaa
mov ebx, dword [esp + 0x2c]
mov eax, dword [0x4363e8]
xor ebp, ebp
test eax, eax
jle 0x406c20
xor eax, eax
mov dword [esp + 0x30], eax
test eax, eax
jne 0x406b39
mov ecx, dword [esp + 0x1c]
mov esi, edx
imul esi, ebp
jmp 0x406b50
cmp eax, 1
mov esi, edx
jne 0x406b49
mov ecx, dword [esp + 0x20]
imul esi, ebp
jmp 0x406b50
mov ecx, dword [esp + 0x24]
imul esi, ebp
add esi, ecx
xor edi, edi
test edx, edx
jle 0x406bcf
mov cl, byte [esi]
xor eax, eax
mov byte [esp + 0x11], cl
inc esi
inc eax
inc edi
cmp cl, byte [esi]
jne 0x406b70
cmp eax, 0x3f
jge 0x406b70
cmp edi, edx
jl 0x406b60
cmp eax, 1
jle 0x406b8f
or al, 0xc0
lea edx, [esp + 0x14]
mov byte [esp + 0x12], al
push 0
push edx
lea eax, [esp + 0x1a]
push 2
mov byte [esp + 0x1f], cl
push eax
jmp 0x406bba
test cl, cl
je 0x406bac
mov byte [esp + 0x13], cl
lea ecx, [esp + 0x14]
push 0
push ecx
lea edx, [esp + 0x1a]
push 2
mov byte [esp + 0x1e], 0xc1
push edx
jmp 0x406bba
lea eax, [esp + 0x14]
push 0
push eax
lea ecx, [esp + 0x19]
push 1
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [0x4363e4]
cmp edi, edx
jl 0x406b58
mov eax, dword [esp + 0x30]
mov ecx, edx
and ecx, 0x80000001
jns 0x406bde
dec ecx
or ecx, 0xfffffffe
inc ecx
je 0x406c04
lea edx, [esp + 0x14]
push 0
push edx
lea eax, [esp + 0x19]
push 1
push eax
push ebx
mov byte [esp + 0x25], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [0x4363e4]
mov eax, dword [esp + 0x30]
inc eax
cmp eax, 3
mov dword [esp + 0x30], eax
jl 0x406b2a
mov eax, dword [0x4363e8]
inc ebp
cmp ebp, eax
jl 0x406b24
mov ecx, dword [esp + 0x1c]
push ecx
call fcn.00418858
mov edx, dword [esp + 0x24]
push edx
call fcn.00418858
mov eax, dword [esp + 0x2c]
push eax
call fcn.00418858
add esp, 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x18
ret