Function at 0x4bea34
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x4bed9d
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, dword [ebx + 0x328]
call fcn.00435c58
push pe_nt_image_headers32
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_SetPriorityClass
push 0xf
call sub.kernel32.dll_GetCurrentThread
push eax
call sub.kernel32.dll_SetThreadPriority
xor esi, esi
mov al, byte [ebx + 0x2953]
test al, 2
je 0x4bea9b
cmp byte [ebx + 0x50e], 0
je 0x4bea9b
and al, 0xd
mov byte [ebx + 0x2953], al
mov eax, ebx
call fcn.004b527c
mov al, byte [ebx + 0x2953]
test al, 4
je 0x4beab4
and al, 0xb
mov byte [ebx + 0x2953], al
mov eax, ebx
call fcn.004b527c
mov eax, dword [ebx + 0x39ac]
cmp eax, 0x11
je 0x4beac4
cmp eax, 0x1b
jne 0x4beacd
mov dword [ebp - 8], 0x1000
jmp 0x4bead4
mov dword [ebp - 8], 0x800
mov eax, dword [ebp - 8]
sub eax, 2
jl 0x4beafe
inc eax
mov dword [ebp - 0xc], eax
mov eax, 2
xor edx, edx
mov dl, byte [ebx + eax + 0x294b]
add edx, esi
and edx, 0xff
mov esi, edx
inc eax
dec dword [ebp - 0xc]
jne 0x4beae5
mov eax, esi
mov byte [ebx + 0x294c], al
mov eax, dword [0x4d5d70]
mov eax, dword [eax + 0x378]
mov edx, 8
call fcn.00446d28
mov eax, dword [0x4d5d70]
mov eax, dword [eax + 0x378]
xor edx, edx
call fcn.00446d1c
mov eax, dword [0x4d5d70]
mov eax, dword [eax + 0x378]
xor edx, edx
call fcn.00446d38
xor eax, eax
mov dword [ebp - 4], eax
cmp byte [ebx + 0x39f2], 0
jne 0x4bed6c
mov byte [ebx + 0x5c4], 0x55
push 0
lea eax, [ebx + 0x3974]
push eax
push 4
lea eax, [ebx + 0x5c4]
push eax
mov eax, dword [ebx + 0x3e0]
push eax
call sub.kernel32.dll_WriteFile_1
mov byte [ebx + 0x5c4], 0x84
push 0
lea eax, [ebx + 0x3974]
push eax
push 4
lea eax, [ebx + 0x5c4]
push eax
mov eax, dword [ebx + 0x3e0]
push eax
call sub.kernel32.dll_WriteFile_1
mov byte [ebx + 0x5c4], 0x80
push 0
lea eax, [ebx + 0x3974]
push eax
push 4
lea eax, [ebx + 0x5c4]
push eax
mov eax, dword [ebx + 0x3e0]
push eax
call sub.kernel32.dll_WriteFile_1
mov eax, dword [ebp - 8]
test eax, eax
jns 0x4bebcc
add eax, 0xff
sar eax, 8
dec eax
test eax, eax
jl 0x4bed0d
inc eax
mov dword [ebp - 0xc], eax
xor edi, edi
mov eax, dword [0x4d5d70]
call fcn.004be134
mov byte [ebx + 0x5c4], 0x81
push 0
lea eax, [ebx + 0x3974]
push eax
push 4
lea eax, [ebx + 0x5c4]
push eax
mov eax, dword [ebx + 0x3e0]
push eax
call sub.kernel32.dll_WriteFile_1
mov eax, 1
mov edx, edi
shl edx, 8
add edx, eax
mov dl, byte [ebx + edx + 0x294b]
mov byte [ebx + eax + 0x5c3], dl
inc eax
cmp eax, 0x101
jne 0x4bec12
cmp dword [ebp - 4], 0
jne 0x4bec61
cmp byte [ebx + 0x39f3], 0
jne 0x4bec61
push 0
lea eax, [ebx + 0x3974]
push eax
push pe_nt_image_headers32
lea eax, [ebx + 0x5c4]
push eax
mov eax, dword [ebx + 0x3e0]
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x4becc5
push 0x20
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_SetPriorityClass
push 0
call sub.kernel32.dll_GetCurrentThread
push eax
call sub.kernel32.dll_SetThreadPriority
push pe_nt_image_headers32
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_SetPriorityClass
push 0xf
call sub.kernel32.dll_GetCurrentThread
push eax
call sub.kernel32.dll_SetThreadPriority
mov esi, 1
push 0
lea eax, [ebx + 0x3974]
push eax
push 1
lea eax, [ebx + esi + 0x5c3]
push eax
mov eax, dword [ebx + 0x3e0]
push eax
call sub.kernel32.dll_WriteFile_1
inc esi
cmp esi, 0x101
jne 0x4bec9d
push 0x1e
call sub.kernel32.dll_Sleep_1
mov byte [ebx + 0x5c4], 0x80
push 0
lea eax, [ebx + 0x3974]
push eax
push 4
lea eax, [ebx + 0x5c4]
push eax
mov eax, dword [ebx + 0x3e0]
push eax
call sub.kernel32.dll_WriteFile_1
mov eax, dword [0x4d5d70]
mov eax, dword [eax + 0x378]
mov edx, edi
call fcn.00446d38
inc edi
dec dword [ebp - 0xc]
jne 0x4bebde
mov eax, dword [0x4d5d70]
call fcn.004bf054
test al, al
je 0x4bed5f
cmp byte [ebx + 0x39f3], 0
jne 0x4bed3a
cmp dword [ebp - 4], 0
je 0x4bed33
mov byte [ebx + 0x39f3], 1
jmp 0x4bed3a
mov byte [ebx + 0x39f3], 0
mov byte [ebx + 0x39f2], 0
mov bl, 1
push 0x20
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_SetPriorityClass
push 0
call sub.kernel32.dll_GetCurrentThread
push eax
call sub.kernel32.dll_SetThreadPriority
jmp 0x4bed8f
inc dword [ebp - 4]
cmp dword [ebp - 4], 4
jne 0x4beb44
push 0x20
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_SetPriorityClass
push 0
call sub.kernel32.dll_GetCurrentThread
push eax
call sub.kernel32.dll_SetThreadPriority
mov byte [ebx + 0x39f2], 1
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4beda4
ret