Function at 0x402e40
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1fc
push 4
push 0
lea eax, [ebp - 0xc]
push eax
call sub.ntdll.dll_memset
add esp, 0xc
push 0x64
push 0
lea ecx, [ebp - 0x1a8]
push ecx
call sub.ntdll.dll_memset
add esp, 0xc
push 0x64
push 0
lea edx, [ebp - 0xd8]
push edx
call sub.ntdll.dll_memset
add esp, 0xc
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x1b4], eax
lea ecx, [ebp - 0x1b4]
mov dword [ebp - 0x1fc], ecx
mov dword [ebp - 0x1ac], 0
jmp 0x402eaf
mov edx, dword [ebp - 0x1ac]
add edx, 1
mov dword [ebp - 0x1ac], edx
cmp dword [ebp - 0x1ac], 4
jge 0x402ede
mov eax, dword [ebp - 0x1fc]
movsx cx, byte [eax]
mov edx, dword [ebp - 0x1ac]
mov word [ebp + edx*2 - 0xc], cx
mov eax, dword [ebp - 0x1fc]
add eax, 1
mov dword [ebp - 0x1fc], eax
jmp 0x402ea0
push 0x401614
lea ecx, [ebp - 0xd8]
push ecx
call dword [sym.imp.ntdll.dll_wcscpy]
add esp, 8
lea edx, [ebp - 0xd8]
push edx
lea eax, [ebp - 0x1a8]
push eax
call dword [sym.imp.ntdll.dll_wcscpy]
add esp, 8
push 4
lea ecx, [ebp - 0xc]
push ecx
lea edx, [ebp - 0x1a8]
push edx
call dword [sym.imp.ntdll.dll_wcsncat]
add esp, 0xc
push 0x401650
lea eax, [ebp - 0x1a8]
push eax
call dword [sym.imp.ntdll.dll_wcscat]
add esp, 8
lea ecx, [ebp - 0x1a8]
push ecx
call fcn.004026e0
add esp, 4
cmp dword [0x40a004], 0
je 0x402f61
mov edx, dword [ebp + 8]
mov dword [ebp - 0x1b0], edx
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1e0], eax
jmp 0x402f73
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x1b0], ecx
mov edx, dword [ebp + 0x14]
mov dword [ebp - 0x1e0], edx
lea eax, [ebp - 0x1a8]
push eax
lea ecx, [ebp - 0x1f4]
push ecx
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov dword [ebp - 0x1f8], 0
mov dword [ebp - 0xdc], 0
mov dword [ebp - 0x1c0], 0
xor edx, edx
mov dword [ebp - 0x1bc], edx
mov dword [ebp - 0x1ec], 0
xor eax, eax
mov dword [ebp - 0x1e8], eax
mov byte [ebp - 0x1d9], 0
mov dword [ebp - 0x1d8], 0x18
mov dword [ebp - 0x1d4], 0
mov dword [ebp - 0x1cc], 0
lea ecx, [ebp - 0x1f4]
mov dword [ebp - 0x1d0], ecx
mov dword [ebp - 0x1c8], 0
mov dword [ebp - 0x1c4], 0
push 0
push 0
push 0x60
push 2
push 2
push 0x80
push 0
lea edx, [ebp - 0x1ec]
push edx
lea eax, [ebp - 0x1d8]
push eax
push 0x100002
lea ecx, [ebp - 0x1b8]
push ecx
call dword [sym.imp.ntdll.dll_NtCreateFile]
mov dword [ebp - 0x1e4], eax
cmp dword [ebp - 0x1e4], 0
jl 0x403109
push 0x401660
call fcn.004026e0
add esp, 4
mov edx, dword [0x40a044]
add edx, dword [ebp - 0x1b0]
mov dword [ebp - 4], edx
push 0
lea eax, [ebp - 0x1c0]
push eax
mov ecx, dword [ebp - 0x1e0]
push ecx
mov edx, dword [ebp - 4]
push edx
lea eax, [ebp - 0x1ec]
push eax
push 0
push 0
push 0
mov ecx, dword [ebp - 0x1b8]
push ecx
call dword [sym.imp.ntdll.dll_NtWriteFile]
mov dword [ebp - 0x1e4], eax
cmp dword [ebp - 0x1e4], 0
jge 0x4030d5
cmp dword [ebp - 0x1b8], 0
je 0x4030b7
mov edx, dword [ebp - 0x1b8]
push edx
call dword [sym.imp.ntdll.dll_NtClose]
mov byte [ebp - 0x1d9], 0
push 0x4016c0
call fcn.004026e0
add esp, 4
mov al, byte [ebp - 0x1d9]
jmp 0x403139
cmp dword [ebp - 0x1b8], 0
je 0x4030eb
mov eax, dword [ebp - 0x1b8]
push eax
call dword [sym.imp.ntdll.dll_NtClose]
push 0x4016e8
call fcn.004026e0
add esp, 4
mov byte [ebp - 0x1d9], 1
mov al, byte [ebp - 0x1d9]
jmp 0x403139
cmp dword [ebp - 0x1b8], 0
je 0x40311f
mov ecx, dword [ebp - 0x1b8]
push ecx
call dword [sym.imp.ntdll.dll_NtClose]
push 0x401740
call fcn.004026e0
add esp, 4
mov byte [ebp - 0x1d9], 0
mov al, byte [ebp - 0x1d9]
mov esp, ebp
pop ebp
ret