Function at 0x4022a0
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 0x10]
sub esp, 0x18
push ebp
push esi
mov esi, dword [ecx]
push esi
call fcn.00403080
mov ebp, eax
test ebp, ebp
jne 0x4022c4
pop esi
xor al, al
pop ebp
add esp, 0x18
ret 0x14
push ebx
push edi
mov edi, dword [esp + 0x30]
push edi
call fcn.00403c90
push esi
push ebp
push edi
mov dword [esp + 0x2c], eax
call fcn.00403c60
mov di, word [ebp + 0xe]
mov ecx, dword [ebp + 4]
mov eax, dword [ebp + 8]
mov esi, dword [esp + 0x3c]
movzx ebx, di
imul ebx, ecx
cdq
add ebx, 0x1f
xor eax, edx
shr ebx, 5
sub eax, edx
cmp esi, 3
mov dword [esp + 0x24], ebx
jne 0x40230f
cdq
sub eax, edx
sar eax, 1
mov dword [esp + 0x10], eax
jmp 0x402313
mov dword [esp + 0x10], eax
mov dl, byte [esp + 0x2c]
test dl, dl
je 0x402541
cmp di, 2
je 0x40251a
cmp di, 1
je 0x40251a
lea edx, [ecx + ecx + 0x1f]
shr edx, 5
cmp esi, 3
mov dword [esp + 0x1c], edx
jne 0x40235f
add ecx, 0x1f
shr ecx, 5
mov dword [esp + 0x20], ecx
add ecx, edx
imul ecx, eax
lea edx, [ecx*4 + 0x38]
mov dword [esp + 0x2c], edx
jmp 0x40236d
imul edx, eax
lea eax, [edx*4 + 0x38]
mov dword [esp + 0x2c], eax
mov ecx, dword [esp + 0x2c]
push ecx
call fcn.00403080
mov esi, dword [esi*4 + 0x401148]
movzx edx, word [ebp + 0xe]
push esi
push 2
push esi
push edx
mov edi, eax
push 0x138a
mov dword [esp + 0x44], edi
call fcn.00403010
push eax
call fcn.00403fd0
mov cx, word [ebp + 0xe]
add esp, 0x14
cmp cx, 0x18
jne 0x4023b4
mov dword [esp + 0x18], 0
jmp 0x4023bf
mov eax, 1
shl eax, cl
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x18]
xor esi, esi
cmp eax, esi
mov dword [edi + 0x28], esi
mov dword [edi + 0x2c], 0x808080
mov dword [edi + 0x30], 0xc0c0c0
mov dword [edi + 0x34], 0xffffff
jbe 0x4023fe
mov eax, dword [ebp + esi*4 + 0x28]
lea edi, [ebp + 0x28]
push eax
call fcn.00401fd0
mov dword [edi + esi*4], eax
mov eax, dword [esp + 0x18]
inc esi
cmp esi, eax
jb 0x4023e1
mov edi, dword [esp + 0x30]
cmp dword [esp + 0x3c], 3
mov ecx, 0xa
mov esi, ebp
rep movsd dword es:[edi], dword [esi]
mov esi, dword [esp + 0x30]
mov word [esi + 0xe], 2
jne 0x402446
mov ecx, dword [esi + 4]
lea eax, [ecx + ecx + 0x1f]
and eax, 0xffffffe0
cdq
and edx, 7
add eax, edx
mov edi, eax
lea eax, [ecx + 0x1f]
and eax, 0xffffffe0
cdq
and edx, 7
add eax, edx
sar edi, 3
sar eax, 3
add edi, eax
imul edi, dword [esp + 0x10]
mov dword [esi + 0x14], edi
mov edi, dword [esp + 0x34]
push edi
push 1
push 0x28
push esi
call dword [sym.imp.MSVCR71.dll_fwrite]
add esp, 0x10
cmp eax, 1
jne 0x402686
push edi
push 4
push 4
lea edi, [esi + 0x28]
push edi
call dword [sym.imp.MSVCR71.dll_fwrite]
add esp, 0x10
cmp eax, 4
jne 0x4026b3
mov ecx, dword [esp + 0x18]
lea eax, [ebp + 0x28]
lea edx, [eax + ecx*4]
mov dword [esp + 0x14], edx
lea ecx, [esp + 0x18]
push ecx
mov ecx, dword [esp + 0x20]
lea edx, [esp + 0x18]
push edx
push ecx
xor edx, edx
mov dx, word [ebp + 0xe]
push ebx
mov ebx, dword [esp + 0x20]
push ebx
add edi, 0x10
mov dword [esp + 0x2c], edi
push edx
push eax
call fcn.00402190
cmp dword [esp + 0x3c], 3
jne 0x4024dc
mov eax, dword [esp + 0x20]
imul eax, ebx
shl eax, 2
test eax, eax
jbe 0x4024dc
mov ecx, dword [esp + 0x14]
mov edx, eax
mov eax, dword [esp + 0x18]
mov bl, byte [ecx]
mov byte [eax], bl
inc eax
inc ecx
dec edx
jne 0x4024d3
mov eax, dword [esp + 0x38]
mov ebx, dword [esp + 0x2c]
mov ecx, dword [eax + 0x10]
mov dword [ecx], ebx
sub ebx, 0x38
je 0x402767
cmp ebx, 0x400
mov esi, ebx
jbe 0x402501
mov esi, 0x400
mov edx, dword [esp + 0x34]
push esi
push edi
push edx
sub ebx, esi
call fcn.00403cc0
add edi, esi
test ebx, ebx
jne 0x4024f2
jmp 0x402763
push ebp
call dword [sym.imp.MSVCR71.dll_free]
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x34]
add esp, 4
push 0
push eax
push ecx
call fcn.00403da0
pop edi
pop ebx
pop esi
xor al, al
pop ebp
add esp, 0x18
ret 0x14
cmp di, 2
je 0x40256e
push ebp
call dword [sym.imp.MSVCR71.dll_free]
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x34]
add esp, 4
push 0
push edx
push eax
call fcn.00403da0
pop edi
pop ebx
pop esi
xor al, al
pop ebp
add esp, 0x18
ret 0x14
lea edx, [ecx*4 + 0x1f]
shr edx, 5
cmp esi, 3
mov dword [esp + 0x1c], edx
jne 0x40259d
add ecx, 0x1f
shr ecx, 5
mov dword [esp + 0x20], ecx
add ecx, edx
imul ecx, eax
lea ecx, [ecx*4 + 0x68]
mov dword [esp + 0x2c], ecx
jmp 0x4025ab
imul edx, eax
lea edx, [edx*4 + 0x68]
mov dword [esp + 0x2c], edx
mov eax, dword [esp + 0x2c]
add eax, 4
push eax
call fcn.00403080
mov edi, eax
mov eax, dword [esi*4 + 0x401148]
push eax
push 4
push eax
push 2
push 0x138a
mov dword [esp + 0x44], edi
lea ebx, [edi + 0x28]
call fcn.00403010
push eax
call fcn.00403fd0
mov eax, 0xffffff
mov dword [ebx + 0xc], eax
mov dword [ebx + 0x10], eax
mov dword [ebx + 0x14], eax
mov dword [ebx + 0x18], eax
mov dword [ebx + 0x1c], eax
mov dword [ebx + 0x20], eax
mov dword [ebx + 0x24], eax
mov dword [ebx + 0x28], eax
mov dword [ebx + 0x2c], eax
mov dword [ebx + 0x30], eax
mov dword [ebx + 0x34], eax
mov dword [ebx + 0x38], eax
mov dword [ebx + 0x3c], eax
mov eax, dword [esp + 0x50]
mov dword [ebx], 0
mov dword [ebx + 4], 0x808080
mov dword [ebx + 8], 0xc0c0c0
mov ecx, 0xa
mov esi, ebp
rep movsd dword es:[edi], dword [esi]
mov esi, dword [esp + 0x44]
add esp, 0x14
cmp eax, 3
mov word [esi + 0xe], 4
jne 0x40266e
mov ecx, dword [esi + 4]
lea eax, [ecx*4 + 0x1f]
and eax, 0xffffffe0
cdq
and edx, 7
add eax, edx
mov edi, eax
lea eax, [ecx + 0x1f]
and eax, 0xffffffe0
cdq
and edx, 7
add eax, edx
sar edi, 3
sar eax, 3
add edi, eax
imul edi, dword [esp + 0x10]
mov dword [esi + 0x14], edi
mov edi, dword [esp + 0x34]
push edi
push 1
push 0x28
push esi
call dword [sym.imp.MSVCR71.dll_fwrite]
add esp, 0x10
cmp eax, 1
je 0x40269f
push 0x40137c
call fcn.00403f90
add esp, 4
pop edi
pop ebx
pop esi
xor al, al
pop ebp
add esp, 0x18
ret 0x14
push edi
push 0x10
push 4
push ebx
call dword [sym.imp.MSVCR71.dll_fwrite]
add esp, 0x10
cmp eax, 0x10
je 0x4026cc
push 0x401348
call fcn.00403f90
add esp, 4
pop edi
pop ebx
pop esi
xor al, al
pop ebp
add esp, 0x18
ret 0x14
lea eax, [ebp + 0x28]
lea ecx, [eax + 0x10]
mov dword [esp + 0x14], ecx
lea edx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x20]
lea ecx, [esp + 0x18]
push ecx
mov ecx, dword [esp + 0x2c]
push edx
xor edx, edx
mov dx, word [ebp + 0xe]
push ecx
lea edi, [ebx + 0x40]
mov ebx, dword [esp + 0x20]
push ebx
mov dword [esp + 0x2c], edi
push edx
push eax
call fcn.00402190
cmp dword [esp + 0x3c], 3
jne 0x40272b
mov eax, dword [esp + 0x20]
imul eax, ebx
shl eax, 2
test eax, eax
jbe 0x40272b
mov ecx, dword [esp + 0x14]
mov edx, eax
mov eax, dword [esp + 0x18]
mov bl, byte [ecx]
mov byte [eax], bl
inc eax
inc ecx
dec edx
jne 0x402722
mov eax, dword [esp + 0x38]
mov ebx, dword [esp + 0x2c]
mov ecx, dword [eax + 0x10]
mov dword [ecx], ebx
sub ebx, 0x68
je 0x402767
lea ecx, [ecx]
cmp ebx, 0x400
mov esi, ebx
jbe 0x40274f
mov esi, 0x400
mov edx, dword [esp + 0x34]
push esi
push edi
push edx
sub ebx, esi
call fcn.00403cc0
add edi, esi
test ebx, ebx
jne 0x402740
mov esi, dword [esp + 0x30]
mov edi, dword [sym.imp.MSVCR71.dll_free]
push ebp
call edi
push esi
call edi
add esp, 8
pop edi
pop ebx
pop esi
mov al, 1
pop ebp
add esp, 0x18
ret 0x14