Function at 0x415300
Capabilities:
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x4323ab
mov eax, dword fs:[0]
push eax
mov eax, 0x4028
call fcn.0041bfd0
mov eax, dword [0x4417c0]
xor eax, esp
mov dword [esp + 0x4024], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4417c0]
xor eax, esp
push eax
lea eax, [esp + 0x403c]
mov dword fs:[0], eax
lea eax, [esp + 0x18]
push eax
call fcn.00418bd0
add esp, 4
test eax, eax
je 0x415357
xor eax, eax
jmp 0x4155fb
mov eax, dword [esp + 0x404c]
lea edx, [esp + 0x2038]
sub edx, eax
jmp 0x415370
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x415370
lea edi, [esp + 0x2038]
add edi, 0xfffffffe
lea esp, [esp]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x415390
push 0
mov ecx, 9
mov esi, str.RkKernelExport.xls
rep movsd dword es:[edi], dword [esi]
push 0x80
push 4
push 0
push 0
push 0x10000000
lea ecx, [esp + 0x2050]
push ecx
movsw word es:[edi], word [esi]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x415350
lea ecx, [esp + 0x28]
call fcn.00417e20
mov ebp, dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea edx, [esp + 0x20]
push edx
push 2
lea eax, [esp + 0x2c]
push eax
push ebx
mov dword [esp + 0x4058], 0
mov dword [esp + 0x34], 0xfeff
call ebp
lea ecx, [esp + 0x38]
push str.Ordinal_tVirtual_Address_tOrg._Virtual_Address_tName_tModule_tOrg._Module_tType_tFull_path_n
push ecx
call fcn.0041c953
lea eax, [esp + 0x40]
add esp, 8
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x415421
sub eax, edx
push 0
sar eax, 1
lea edx, [esp + 0x20]
push edx
add eax, eax
push eax
lea ecx, [esp + 0x44]
push ecx
push ebx
call ebp
mov eax, dword [esp + 0x18]
push 0xffffffffffffffff
lea edx, [esp + 0x18]
push edx
push eax
call fcn.00418da0
add esp, 0xc
test eax, eax
jne 0x4155ce
mov edi, edi
mov ecx, dword [esp + 0x14]
cmp dword [ecx + 0x1c], 0
je 0x4155b2
mov esi, dword [ecx + 0xc]
mov eax, esi
lea edi, [eax + 2]
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x415476
sub eax, edi
sar eax, 1
je 0x4155b2
mov edx, dword [ecx + 0x14]
mov eax, dword [ecx + 0x10]
push edx
mov edx, dword [ecx + 8]
push eax
mov eax, dword [ecx + 4]
mov ecx, dword [ecx + 0x18]
push esi
push edx
push eax
push ecx
lea edx, [esp + 0x50]
push str._s_t_s_t_s_t_s_t_s_t_s_t
push edx
call fcn.0041c953
mov eax, dword [esp + 0x34]
add esp, 0x20
cmp dword [eax + 0x10], 0
je 0x4154dc
mov edx, dword [eax + 0x10]
push 0x800
lea ecx, [esp + 0x303c]
push ecx
push edx
lea ecx, [esp + 0x34]
call fcn.00418480
mov eax, dword [esp + 0x14]
jmp 0x4154e6
xor ecx, ecx
mov word [esp + 0x3038], cx
mov eax, dword [eax + 0x20]
lea edi, [esp + 0x38]
add edi, 0xfffffffe
sub eax, 1
je 0x415510
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x4154f5
mov esi, str.Normal_hook_t
jmp 0x415521
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x415510
mov esi, 0x434ec0
mov ecx, 6
rep movsd dword es:[edi], dword [esi]
lea eax, [esp + 0x3038]
movsw word es:[edi], word [esi]
mov edx, eax
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x415533
lea edi, [esp + 0x38]
sub eax, edx
add edi, 0xfffffffe
jmp 0x415550
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x415550
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x38]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x415573
mov edx, dword [0x434ebc]
lea eax, [esp + 0x38]
mov dword [edi], edx
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x415590
sub eax, edx
push 0
sar eax, 1
lea ecx, [esp + 0x20]
push ecx
lea edx, [eax + eax]
push edx
lea eax, [esp + 0x44]
push eax
push ebx
call ebp
mov edx, dword [esp + 0x18]
push 0xffffffffffffffff
lea ecx, [esp + 0x18]
push ecx
push edx
call fcn.00418da0
add esp, 0xc
test eax, eax
je 0x415460
lea eax, [esp + 0x18]
push eax
call fcn.00418f70
add esp, 4
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x28]
mov dword [esp + 0x4044], 0xffffffff
call fcn.00417e30
mov eax, 1
mov ecx, dword [esp + 0x403c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x4024]
xor ecx, esp
call fcn.0041a7bc
add esp, 0x4034
ret