Function at 0x403b60
Capabilities:
Write file on windows

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x68
mov eax, dword [0x41f004]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, ecx
mov eax, dword [edi]
mov eax, dword [eax]
mov al, byte [eax + 0x15]
mov byte [ebp - 0x51], al
cmp al, 3
je 0x403bdb
test al, al
je 0x403bdb
lea esi, [edi + 4]
push esi
push str.Dumping_memory_to__s_n
call fcn.00401010
add esp, 8
push 0
push 0
push 2
push 0
push 1
push 0x40000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x403bf0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Failed_to_create_file__error__08x_n
call fcn.00401010
add esp, 8
xor al, al
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00404630
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
movzx eax, byte [ebp - 0x51]
mov byte [ebp - 0x58], 0
sub eax, 1
je 0x403d8d
sub eax, 1
je 0x403d51
sub eax, 2
jne 0x403e91
mov eax, dword [edi]
lea edx, [ebp - 0x5c]
push edx
lea edx, [ebp - 0x50]
mov dword [ebp - 0xc], 0xc02a400
push edx
mov ecx, dword [eax]
lea edx, [ebp - 0xc]
mov word [ebp - 8], 0xbc02
mov byte [ebp - 6], 1
mov dword [ebp - 0x5c], 0x40
mov eax, dword [ecx]
push 7
push edx
call dword [eax + 0x10]
xor ecx, ecx
mov dword [ebp - 0x60], ecx
mov eax, ecx
mov byte [ebp - 9], cl
shr eax, 8
lea edx, [ebp - 0x5c]
mov byte [ebp - 0xa], al
mov eax, dword [edi]
push edx
mov word [ebp - 0xc], 0xb000
lea edx, [ebp - 0x50]
mov byte [ebp - 8], 0x10
mov ecx, dword [eax]
mov dword [ebp - 0x5c], 0x40
push edx
push 5
mov eax, dword [ecx]
lea edx, [ebp - 0xc]
push edx
mov eax, dword [eax + 0x10]
call eax
test al, al
je 0x403d37
mov eax, dword [ebp - 0x60]
push 0
push 0
movzx eax, ax
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov edx, dword [ebp - 0x5c]
xor eax, eax
add edx, 0xfffffffe
mov dword [ebp - 0x5c], edx
je 0x403cff
cmp edx, 0x40
jb 0x403cff
movups xmm1, xmmword [0x41d520]
mov ecx, edx
and ecx, 0xffffffc0
nop dword [eax]
nop dword [eax + eax]
movups xmm0, xmmword [ebp + eax - 0x50]
pandn xmm0, xmm1
movups xmmword [ebp + eax - 0x50], xmm0
movups xmm0, xmmword [ebp + eax - 0x40]
pandn xmm0, xmm1
movups xmmword [ebp + eax - 0x40], xmm0
movups xmm0, xmmword [ebp + eax - 0x30]
pandn xmm0, xmm1
movups xmmword [ebp + eax - 0x30], xmm0
movups xmm0, xmmword [ebp + eax - 0x20]
pandn xmm0, xmm1
movups xmmword [ebp + eax - 0x20], xmm0
add eax, 0x40
cmp eax, ecx
jb 0x403cc0
cmp eax, edx
jae 0x403d0c
not byte [ebp + eax - 0x50]
inc eax
cmp eax, edx
jb 0x403d03
push 0
lea eax, [ebp - 0x64]
push eax
push edx
lea eax, [ebp - 0x50]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 0x60]
mov eax, 0x2000
add ecx, 0x10
mov dword [ebp - 0x60], ecx
cmp cx, ax
jb 0x403c47
jmp 0x403d3f
mov ecx, dword [ebp - 0x60]
mov eax, 0x2000
cmp cx, ax
jne 0x403e91
mov byte [ebp - 0x58], 1
jmp 0x403e91
push ecx
mov ecx, dword [edi]
push 0x400
push 0
push esi
call fcn.00402560
test al, al
je 0x403e91
push ecx
mov ecx, dword [edi]
push 0xe000
push 0x4000
push esi
call fcn.00402560
test al, al
je 0x403e91
mov byte [ebp - 0x58], 1
jmp 0x403e91
mov ecx, dword [edi]
push 0x40
push 0x80
push 0x40
push 0
push esi
call fcn.00402660
test al, al
je 0x403e91
mov ecx, dword [edi]
push 0x80
push 0x1000
push 0x80
push 0
push esi
call fcn.00402660
test al, al
je 0x403e91
mov ecx, dword [edi]
push 0x80
push 0x3080
push 0x3000
push 0
push esi
call fcn.00402660
test al, al
je 0x403e91
mov ecx, dword [edi]
push 0x80
push 0
push 0x4000
push 0
push esi
call fcn.00402660
test al, al
je 0x403e91
mov ecx, dword [edi]
push 0x40
push 0x80
push 0x40
push 0x80
push esi
call fcn.00402660
test al, al
je 0x403e91
mov ecx, dword [edi]
push 0x80
push 0x1000
push 0x80
push 0x80
push esi
call fcn.00402660
test al, al
je 0x403e91
mov ecx, dword [edi]
push 0x80
push 0x3080
push 0x3000
push 0x80
push esi
call fcn.00402660
test al, al
je 0x403e91
mov ecx, dword [edi]
push 0x80
push 0xa000
push 0x4000
push 0x80
push esi
call fcn.00402660
mov ecx, dword [ebp - 0x58]
test al, al
movzx ecx, cl
mov edx, 1
cmovne ecx, edx
mov dword [ebp - 0x58], ecx
cmp byte [ebp - 0x58], 1
mov eax, str.Done..._n_n
mov ecx, str.Aborting..._n
cmove ecx, eax
push ecx
call fcn.00401010
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov al, byte [ebp - 0x58]
xor ecx, ebp
pop edi
pop esi
call fcn.00404630
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret