Function at 0x402770
Capabilities:
Terminate process
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
call fcn.00402a70
cmp dword [0x417270], 0
jne 0x40288a
cmp dword [ebp + 8], 0
je 0x402796
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
jmp 0x40279d
mov dword [ebp - 0x1c], 1
mov ecx, dword [ebp - 0x1c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 4], eax
cmp dword [0x417274], 0
je 0x40287d
cmp dword [ebp - 4], 0
jne 0x402818
push 0
push 0x41726c
push 0x22
push 0x416244
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [ebp + 8]
push edx
call fcn.00402c70
add esp, 4
push 0
push 0x41726c
push 0xb
push 0x416268
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp + 8]
push eax
call fcn.00402d30
add esp, 4
call fcn.00402ba0
jmp 0x40287d
push 0
push 0x41726c
push 6
push 0x416274
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 4]
push ecx
call fcn.00402c70
add esp, 4
push 0
push 0x41726c
push 2
push 0x41627c
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalSize]
mov ecx, dword [ebp - 4]
lea edx, [ecx + eax - 1]
push edx
call fcn.00402c70
add esp, 4
call fcn.00402ba0
mov eax, dword [ebp - 4]
jmp 0x402a62
mov eax, dword [ebp + 8]
add eax, 8
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
add ecx, 0x2000
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x14]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 8], 0
jne 0x40291f
cmp dword [0x417274], 0
je 0x40291a
push 0
push 0x41726c
push 0x22
push str.GlobalAlloc_fails:_requested_size
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.00402c70
add esp, 4
push 0
push 0x41726c
push 0xb
push str._User_size
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [ebp + 8]
push edx
call fcn.00402d30
add esp, 4
call fcn.00402ba0
jmp 0x402a5f
mov eax, dword [ebp - 8]
add eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
add ecx, 0xfff
or ecx, 0xfff
sub ecx, 0xfff
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x18]
sub edx, dword [ebp - 0x10]
mov eax, dword [ebp - 8]
mov dword [edx], eax
mov ecx, dword [ebp - 0x18]
sub ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x18]
mov dword [ecx + 4], edx
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x10]
add eax, 8
mov dword [ebp - 8], eax
cmp dword [0x417274], 0
je 0x4029ca
push 0
push 0x41726c
push 6
push str.Alloc
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 8]
push ecx
call fcn.00402c70
add esp, 4
push 0
push 0x41726c
push 2
push 0x4162b8
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 8]
lea ecx, [eax + edx - 1]
push ecx
call fcn.00402c70
add esp, 4
call fcn.00402ba0
mov edx, dword [ebp + 8]
neg edx
sbb edx, edx
add edx, 2
push edx
push 0x1000
push 0x1000
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
jne 0x402a5f
cmp dword [0x417274], 0
je 0x402a58
push 0
push 0x41726c
push 0x19
push str.VirtualAlloc_fails:_page
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.00402c70
add esp, 4
push 0
push 0x41726c
push 0x15
push str._GetLastError_result
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00402d30
add esp, 4
call fcn.00402ba0
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov dword [ebp - 8], 0
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret