Function at 0x442500
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x8c
mov eax, dword [0x4db06c]
xor eax, esp
mov dword [esp + 0x88], eax
mov eax, dword [ebp + 8]
push ebx
push esi
add eax, 0xffff7f9c
mov esi, ecx
push edi
mov edi, dword [ebp + 0x10]
cmp eax, 0x28
ja case.0x44253a.32878
movzx eax, byte [eax + 0x442ba8]
jmp dword [eax*4 + 0x442b54]
mov eax, dword [ebp + 0xc]
cmp eax, 2
jne 0x442575
mov eax, dword [esi]
push edi
push 1
push 0x8082
call dword [eax + 0x140]
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x88]
xor ecx, esp
call fcn.00487555
mov esp, ebp
pop ebp
ret 0xc
cmp eax, 1
jne case.0x44270a.515
mov eax, dword [esi]
push edi
call dword [eax + 0x21c]
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x88]
xor ecx, esp
call fcn.00487555
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [esi]
push 0x13
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
call dword [eax + 0x160]
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x88]
xor ecx, esp
call fcn.00487555
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebp + 0xc]
sub eax, 0
je 0x4426d6
sub eax, 1
je 0x442622
sub eax, 2
jne case.0x44270a.515
push dword [esi + 0x264c]
call dword [sym.imp.KERNEL30.dll_EnterCriticalSection]
mov ecx, esi
call fcn.004335c0
test eax, eax
je 0x44260f
call fcn.0043b8b0
push dword [esi + 0x264c]
call dword [sym.imp.KERNEL30.dll_LeaveCriticalSection]
jmp case.0x44270a.515
call fcn.00444210
push dword [esi + 0x264c]
call dword [sym.imp.KERNEL30.dll_LeaveCriticalSection]
jmp case.0x44270a.515
mov ebx, dword [sym.imp.KERNEL30.dll_SetThreadExecutionState]
push SysReAllocString
call ebx
cmp dword [esi + 0x2304], 0
je 0x442649
mov ecx, dword [edi]
call fcn.00463750
push eax
mov ecx, esi
call fcn.004444e0
jmp 0x4426b6
push 0
push 0x938
lea ecx, [esp + 0x18]
call fcn.0046e6e0
mov eax, dword [edi]
lea ecx, [esp + 0x10]
mov dword [esp + 0x88], eax
mov eax, dword [edi + 4]
push 0
mov dword [esp + 0x14], vtable.TConfirmDlg.0
mov dword [esp + 0x58], esi
mov dword [esp + 0x88], eax
call fcn.0046e8a0
lea ecx, [esp + 0x10]
mov ebx, eax
call fcn.0046e720
sub ebx, 2
je 0x4426b0
sub ebx, 3
mov ebx, dword [sym.imp.KERNEL30.dll_SetThreadExecutionState]
je 0x4426a7
mov dword [edi + 0x10], 2
jmp 0x4426bd
mov dword [edi + 0x10], 1
jmp 0x4426bd
mov ebx, dword [sym.imp.KERNEL30.dll_SetThreadExecutionState]
mov dword [edi + 0x10], 0
cmp dword [esi + 0x1a3c], 0
je case.0x44270a.515
push SysReAllocString
call ebx
jmp case.0x44270a.515
call fcn.00439720
jmp case.0x44270a.515
test byte [esi + 0x1c8c], 8
jne case.0x44270a.515
cmp edi, 0x405
jg case.0x44270a.515
je 0x442729
add edi, 0xfffffdff
cmp edi, 4
ja case.0x44270a.515
jmp dword [edi*4 + 0x442bd4]
mov eax, dword [esi]
push 0
call dword [eax + pe_nt_image_headers32]
mov eax, dword [esi]
mov ecx, esi
push 0xa
call dword [eax + 0xc]
jmp case.0x44270a.515
mov eax, dword [esi]
push 0
call dword [eax + pe_nt_image_headers32]
mov eax, dword [esi]
mov ecx, esi
push 0xa
call dword [eax + 0xc]
cmp dword [esi + 0x235c], 0
je 0x442765
mov eax, dword [esi + 0x2640]
test eax, eax
je 0x442755
cmp dword [eax + 8], 0
jne 0x44275e
cmp dword [esi + 0x2344], 0
je 0x442765
mov ecx, esi
call fcn.00434ab0
test byte [esi + 0x1c8c], 4
je case.0x44270a.515
push 0
push 0
push 0
push 2
mov ecx, esi
call fcn.0043b4b0
jmp case.0x44270a.515
push 0
push dword [0x4e0940]
push dword [esi + 0x2360]
push 0
call fcn.0043b4b0
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x88]
xor ecx, esp
call fcn.00487555
mov esp, ebp
pop ebp
ret 0xc
test edi, edi
je case.0x44270a.515
cmp edi, 0xffffffff
je 0x4427e6
push 0
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x6a4
push eax
push 0x6a4
lea eax, [esi + 0x1c88]
push eax
push edi
call dword [sym.imp.KERNEL30.dll_WriteFile]
test edi, edi
je case.0x44270a.515
cmp edi, 0xffffffff
je case.0x44270a.515
push edi
call dword [sym.imp.KERNEL30.dll_CloseHandle]
jmp case.0x44270a.515
lea ecx, [esi + 0x78]
call fcn.00412e00
test eax, eax
jne case.0x44270a.515
mov eax, dword [esi + 0x2364]
neg eax
sbb eax, eax
and eax, 2
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x88]
xor ecx, esp
call fcn.00487555
mov esp, ebp
pop ebp
ret 0xc
call fcn.0043aac0
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x88]
xor ecx, esp
call fcn.00487555
mov esp, ebp
pop ebp
ret 0xc
push dword [ebp + 0xc]
push 2
call fcn.00442e60
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x88]
xor ecx, esp
call fcn.00487555
mov esp, ebp
pop ebp
ret 0xc
push dword [ebp + 0xc]
push 2
call fcn.00442f00
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x88]
xor ecx, esp
call fcn.00487555
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [esi + 0x1c48]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x88]
xor ecx, esp
call fcn.00487555
mov esp, ebp
pop ebp
ret 0xc
mov eax, 2
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x88]
xor ecx, esp
call fcn.00487555
mov esp, ebp
pop ebp
ret 0xc
test edi, edi
je case.0x44270a.515
push edi
call fcn.00447750
test eax, eax
jne 0x442908
cmp dword [esi + 0x1c88], 3
jne 0x442908
mov eax, dword [esi]
mov ecx, esi
push 0
push 0
push 0x10
call dword [eax + 0x140]
mov dword [0x4e02f4], 0
jmp case.0x44270a.515
test edi, edi
je case.0x44270a.515
push edi
call fcn.00447e30
test eax, eax
jne case.0x44270a.515
cmp dword [esi + 0x1c88], 3
jne case.0x44270a.515
push eax
push eax
mov eax, dword [esi]
mov ecx, esi
push 0x10
call dword [eax + 0x140]
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x88]
xor ecx, esp
call fcn.00487555
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [esi + 0x70]
sub edi, dword [eax + 0x54]
push edi
call fcn.00435f50
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x88]
xor ecx, esp
call fcn.00487555
mov esp, ebp
pop ebp
ret 0xc
push edi
lea ecx, [esi + 0x3a04]
call fcn.0044e330
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x88]
xor ecx, esp
call fcn.00487555
mov esp, ebp
pop ebp
ret 0xc
push edi
call fcn.0043b7a0
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x88]
xor ecx, esp
call fcn.00487555
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebp + 0xc]
lea ecx, [esi + 0x371c]
mov dword [esi + 0x3798], eax
mov eax, dword [ecx]
push 0
call dword [eax + 0x208]
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x88]
xor ecx, esp
call fcn.00487555
mov esp, ebp
pop ebp
ret 0xc
push 0
call fcn.00444ec0
mov eax, dword [esi + 0x1a48]
mov dword [esi + 0x22d8], eax
mov eax, dword [esi + 0x1a4c]
mov dword [esi + 0x22dc], eax
mov eax, dword [esi + 0x1a14]
mov dword [esi + 0x22e4], eax
mov eax, dword [esi + 0x1998]
mov dword [esi + 0x1cb8], eax
mov eax, dword [esi + 0x199c]
mov dword [esi + 0x1cbc], eax
mov eax, dword [esi + 0x1a6c]
mov dword [esi + 0x2308], eax
mov eax, dword [esi + 0x1958]
mov dword [esi + 0x2310], eax
mov eax, dword [esi + 0x195c]
mov dword [esi + 0x2314], eax
mov eax, dword [esi + 0x1a2c]
mov dword [esi + 0x22fc], eax
mov eax, dword [esi + 0x1a34]
mov dword [esi + 0x1c9c], eax
mov eax, dword [esi + 0x1a18]
mov dword [esi + 0x22e8], eax
mov eax, dword [esi + 0x1aa0]
mov dword [esi + 0x22ec], eax
mov eax, dword [esi + 0x19c8]
cmp dword [esi + 0x1c94], eax
je 0x442abf
push 0
mov ecx, esi
mov dword [esi + 0x1c94], eax
call fcn.0043ae40
mov ecx, esi
call fcn.0043bba0
mov ecx, esi
call fcn.0043d640
mov eax, dword [esi]
mov ecx, esi
push 1
push dword [esi + 0x1918]
push 0xbc1
call dword [eax + 0x104]
mov ecx, esi
call fcn.00436940
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x88]
xor ecx, esp
call fcn.00487555
mov esp, ebp
pop ebp
ret 0xc
xor ecx, ecx
cmp dword [esi + 0x150c], 1
sete cl
call fcn.0045e5d0
mov ecx, esi
call fcn.0043d640
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x88]
xor ecx, esp
call fcn.00487555
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [esp + 0x94]
xor eax, eax
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00487555
mov esp, ebp
pop ebp
ret 0xc