Function at 0x439654
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0xc], edi
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], ebx
mov ebx, ecx
mov edi, edx
mov esi, eax
test esi, esi
je 0x439a3f
mov ecx, dword [esi + 0xd4]
movzx eax, byte [esi + 0x160]
movzx edx, byte [esi + 0x161]
mov dword [ebp - 4], ecx
mov ecx, dword [esi + 0x130]
and eax, 0x80
shr eax, 7
mov dword [ebp - 0x18], eax
and edx, 1
xor eax, eax
mov dword [ebp - 0x1c], edx
mov dword [esi + 0xc0], eax
mov dword [esi + 0xc4], eax
mov dword [esi + 0xe0], eax
test ebx, ebx
jne 0x43974a
test esi, esi
je 0x4399d2
movzx eax, byte [esi + 0x15d]
test al, 4
jne 0x4396d8
mov ecx, 1
jmp 0x4399b5
mov ecx, dword [ebp - 4]
lea eax, [ebp - 8]
push 0
mov edx, dword [esi + 0x38]
mov ebx, dword [esi + 0x40]
push eax
sub ebx, edx
push ebx
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, eax
mov edx, dword [esi + 0x38]
mov edi, dword [esi + 0xe4]
mov dword [esi + 0x40], 0
test ecx, ecx
mov dword [esi + 0x3c], edx
mov eax, ebx
jne 0x439712
mov ecx, 0xffffffff
and byte [esi + 0x15d], 0xfb
add edi, edx
cdq
mov dword [esi + 0x44], edi
mov edi, dword [esi + 0xb8]
add ebx, edi
adc edx, dword [esi + 0xbc]
mov dword [esi + 0xb8], ebx
mov dword [esi + 0xb0], ebx
mov dword [esi + 0xbc], edx
mov dword [esi + 0xb4], edx
jmp 0x4399b5
test esi, esi
je 0x4397c1
mov eax, dword [esi + 0x40]
mov dword [ebp - 0x20], eax
test eax, eax
je 0x4397c1
cmp edi, eax
je 0x4397c1
mov edx, eax
mov eax, dword [esi + 0x38]
sub edx, eax
mov dword [ebp - 0x20], edx
je 0x4397c1
lea edx, [ebp - 8]
push 0
mov dword [ebp - 0x28], ecx
push edx
mov edx, dword [ebp - 0x20]
push edx
push eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 0x28]
test eax, eax
jne 0x439791
mov ecx, 0xffffffff
jmp 0x4399b5
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], ebx
mov ebx, dword [esi + 0xb8]
cdq
add eax, ebx
mov ebx, dword [ebp - 0x24]
adc edx, dword [esi + 0xbc]
mov dword [esi + 0xb8], eax
mov dword [esi + 0xb0], eax
mov dword [esi + 0xbc], edx
mov dword [esi + 0xb4], edx
mov eax, dword [0x4caa54]
test eax, eax
je 0x43985c
test ecx, ecx
jne 0x4397d9
mov ecx, 0xffffffff
jmp 0x43984f
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x4397e9
cmp ecx, 0xfffffffa
je 0x439a2f
cmp ecx, 2
je 0x4397f3
cmp ecx, 1
jne 0x43980b
call fcn.0046a39c
mov dword [ebp - 0x20], eax
mov eax, dword [0x4caa54]
test eax, eax
je 0x439834
mov eax, 1
jmp 0x439810
xor eax, eax
mov dword [ebp - 0x20], eax
mov edx, dword [ebp - 0x18]
test edx, edx
je 0x439830
mov edx, dword [ebp - 0x1c]
test edx, edx
je 0x439830
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
push edx
call fcn.0046a24c
mov eax, dword [ebp - 0x28]
add esp, 4
test eax, eax
je 0x43985c
mov eax, dword [ebp - 0x20]
push 0
push eax
push ebx
push edi
call fcn.0046cd60
add esp, 0x10
mov ecx, eax
cmp ecx, ebx
je 0x43984f
mov ecx, 0xffffffff
test esi, esi
jne 0x4399b5
jmp 0x4399c3
test esi, esi
je 0x4398db
movzx eax, byte [esi + 0x161]
test al, 0x40
jne 0x439873
mov eax, dword [esi + 0x40]
mov dword [ebp - 0x1c], eax
jmp 0x4398bf
movzx eax, byte [esi + 0x15f]
test al, 1
je 0x439886
mov eax, dword [esi + 0x40]
mov dword [ebp - 0x1c], eax
jmp 0x4398bf
mov eax, dword [esi + 0x38]
mov dword [ebp - 0x20], eax
cmp edi, eax
je 0x43989c
mov eax, dword [esi + 0x40]
mov dword [ebp - 0x1c], eax
cmp edi, eax
jne 0x4398ce
jmp 0x4398a2
mov eax, dword [esi + 0x40]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x20]
add eax, dword [esi + 0xdc]
mov edx, dword [esi + 0xe4]
mov ecx, dword [esi + 0x3c]
lea ecx, [ecx + edx*2]
cmp eax, ecx
ja 0x439992
mov eax, dword [ebp - 0x1c]
cmp edi, eax
jne 0x4398ce
add ebx, dword [ebp - 0x1c]
mov edi, dword [esi + 0x38]
sub ebx, edi
mov eax, dword [esi + 0x12c]
cmp eax, 0x40000
ja 0x4398e0
mov eax, 0x40000
cmp ebx, eax
jbe 0x439935
mov edx, ebx
test esi, esi
je 0x4398f7
mov eax, dword [esi + 0x12c]
cmp eax, 0x40000
ja 0x4398fc
mov eax, 0x40000
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x24], ebx
mov ebx, eax
mov dword [ebp - 0x28], esi
mov ecx, dword [ebp - 4]
lea edx, [ebp - 8]
push 0
push edx
push ebx
push edi
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, eax
cmp ecx, 1
je 0x4399d9
mov ebx, dword [ebp - 0x24]
mov esi, dword [ebp - 0x28]
test ecx, ecx
jne 0x439949
mov ecx, 0xffffffff
jmp 0x439949
mov edx, dword [ebp - 4]
lea eax, [ebp - 8]
push 0
push eax
push ebx
push edi
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, eax
test esi, esi
je 0x4399c3
mov edi, dword [esi + 0x38]
add edi, dword [esi + 0xe4]
mov dword [esi + 0x44], edi
mov edi, dword [esi + 0xb8]
mov eax, ebx
cdq
and byte [esi + 0x15d], 0xfb
add ebx, edi
mov dword [esi + 0x40], 0
adc edx, dword [esi + 0xbc]
mov dword [esi + 0xb8], ebx
mov dword [esi + 0xb0], ebx
mov dword [esi + 0xbc], edx
mov dword [esi + 0xb4], edx
jmp 0x4399b5
or byte [esi + 0x15d], 4
add edi, ebx
mov dword [esi + 0x40], edi
mov eax, ebx
add dword [esi + 0x44], edx
cdq
mov ecx, 1
add dword [esi + 0xb0], ebx
adc dword [esi + 0xb4], edx
xor edx, edx
mov dword [esi + 0xa0], edx
mov dword [esi + 0xa4], edx
mov ebx, dword [ebp - 0x14]
mov esi, dword [ebp - 0x10]
mov edi, dword [ebp - 0xc]
mov eax, ecx
mov esp, ebp
pop ebp
ret
mov ecx, 1
jmp 0x4399c3
mov edx, dword [ebp - 8]
mov esi, dword [ebp - 0x1c]
add edi, edx
sub esi, edx
mov dword [ebp - 0x1c], esi
mov esi, dword [ebp - 0x28]
test esi, esi
je 0x4399fe
mov esi, dword [esi + 0x12c]
mov dword [ebp - 0x20], esi
cmp esi, 0x40000
ja 0x439a06
mov esi, 0x40000
mov dword [ebp - 0x20], esi
mov esi, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
cmp esi, eax
ja 0x439a18
mov ebx, esi
test ebx, ebx
jne 0x439a1c
jmp 0x439a24
test esi, esi
je 0x439a24
test edx, edx
ja 0x439907
mov ebx, dword [ebp - 0x24]
mov esi, dword [ebp - 0x28]
jmp 0x439949
mov eax, dword [ebp - 4]
mov dword [ebp - 0x20], eax
mov eax, 1
jmp 0x439817
mov eax, dword [0x4caa54]
test eax, eax
jne 0x439a68
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [ebp - 4], eax
mov eax, dword [0x4caa54]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], eax
mov ecx, 1
jmp 0x4396b3
call fcn.0046a39c
jmp 0x439a50