Function at 0x424c02
Capabilities:
Write file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov dword [esp], 0xd84d8ba6
mov ebx, dword [esp + 0x24]
xor edi, edi
mov ebp, dword [sym.imp.KERNEL32.dll_WriteFile]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp]
cmp eax, 0x21397d2
jg 0x424c68
cmp eax, 0xc477d7be
jle 0x424ce8
cmp eax, 0xcb21ae9b
jle 0x424d58
cmp eax, 0xee355f58
jg 0x424e5b
cmp eax, 0xcb21ae9c
je 0x424f33
cmp eax, 0xd84d8ba6
jne 0x424c22
mov dword [esp], 0xfceca297
jmp 0x424c22
cmp eax, 0x27e595f8
jle 0x424d20
cmp eax, 0x3e942281
jle 0x424d85
cmp eax, 0x5d07fa1c
jg 0x424e85
cmp eax, 0x3e942282
je 0x424f4b
cmp eax, 0x5ac41d5c
jne 0x424c22
imul ebx, ebx, 0x6a14000
add ebx, 0x569eff8f
push ebx
push 0x4146
push 0x2d5d
push 0x5449
push 0x3dbc
call fcn.0041eb27
add esp, 0x14
push ebx
call fcn.0041b5cc
add esp, 4
mov eax, 0xbe5659cb
cmp ebx, 0x89
jl 0x425110
mov eax, 0x7e19442
jmp 0x425110
cmp eax, 0x9e8b0306
jg 0x424dc3
cmp eax, 0x8b644bae
jle 0x424ec2
cmp eax, 0x8b644baf
je 0x424f57
cmp eax, 0x99b67fbc
jne 0x424c22
mov dword [esp], 0x27e595f9
jmp 0x424c22
cmp eax, 0x15aeb713
jg 0x424e0a
cmp eax, 0x21397d3
je 0x424f78
cmp eax, 0xeffc43e
je 0x424fc1
cmp eax, 0x10c0eff8
jne 0x424c22
mov dword [esp], 0x17b292b1
jmp 0x424c22
cmp eax, 0xc477d7bf
je 0x425008
cmp eax, 0xca5ed588
je 0x425042
cmp eax, 0xcb0f2970
jne 0x424c22
mov dword [esp], 0xbe5659cb
jmp 0x424c22
cmp eax, 0x27e595f9
je 0x425056
cmp eax, 0x2a72de9c
je 0x42506a
cmp eax, 0x3c1bbca1
jne 0x424c22
imul eax, dword [esp + 4], 0x500c000
and eax, 0xfc000000
mov dword [esp + 4], eax
mov dword [esp], 0x3e942282
jmp 0x424c22
cmp eax, 0x9e8b0307
je 0x425085
cmp eax, 0xb4122fa0
je 0x4250a2
cmp eax, 0xbe5659cb
jne 0x424c22
cmp dword [esp + 0x1c], 0
mov eax, 0x3c1bbca1
jg 0x424df5
mov eax, 0xb4122fa0
cmp byte [esp + 0xb], 0
jne 0x425110
mov eax, 0xb4122fa0
jmp 0x425110
cmp eax, 0x15aeb714
je 0x4250ae
cmp eax, 0x17b292b1
je 0x4250d7
cmp eax, 0x198ecc9f
jne 0x424c22
imul ebx, ebx, 0x17c
add ebx, 0xffffff25
shr ebx, 0xb
push ebx
call fcn.0041d834
add esp, 4
mov eax, 0xeffc43e
cmp ebx, 0x43
je 0x425110
mov eax, 0xa80953d8
jmp 0x425110
cmp eax, 0xee355f59
je 0x4250e3
cmp eax, 0xfceca297
jne 0x424c22
mov dword [esp + 0x18], 0
mov dword [esp], 0x2a72de9c
jmp 0x424c22
cmp eax, 0x5d07fa1d
je 0x4250f6
cmp eax, 0x76530f7b
jne 0x424c22
push 0
lea eax, [esp + 0x24]
push eax
push dword [esp + 0x24]
push dword [esp + 0x18]
push dword [esp + 0x20]
call ebp
push dword [esp + 0x10]
call esi
mov dword [esp], 0xcb21ae9c
jmp 0x424c22
cmp eax, 0x802ad5a3
jne 0x425118
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x1c]
push eax
push dword [esp + 0x44]
call fcn.00422f88
add esp, 0xc
push edi
push 0x80
push 2
push edi
push edi
push 0x40000000
push dword [esp + 0x58]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
cmp eax, 0xffffffff
setne al
mov ecx, dword [esp + 0x18]
mov dword [esp + 0xc], ecx
cmp dword [esp + 0xc], edi
setne cl
and cl, al
mov byte [esp + 0xb], cl
mov eax, dword [esp + 0x14]
mov dword [esp + 0x1c], eax
mov dword [esp], 0x15aeb714
jmp 0x424c22
push dword [esp + 0xc]
call fcn.00460b1c
add esp, 4
mov dword [esp], 0x9e8b0307
jmp 0x424c22
mov dword [esp], 0xca5ed588
jmp 0x424c22
mov eax, dword [esp + 4]
shl eax, 5
add eax, 0x1ffffee
and eax, 0x1ffffec
mov dword [esp + 4], eax
mov dword [esp], 0xcb21ae9c
jmp 0x424c22
imul ebx, ebx, 0x8c
add ebx, 0xffffdb5c
push 0xcb4
push 0x4468
push 0x49d9
push ebx
push 0x1e10
push 0x32ef
call fcn.00417bc7
add esp, 0x18
mov eax, 0xcb21ae9c
cmp ebx, 0x89
jge 0x425110
mov eax, 0xfceca297
jmp 0x425110
shr ebx, 4
mov eax, ebx
shl eax, 8
sub eax, ebx
sub eax, ebx
mov ebx, eax
add ebx, 0xffff8fac
push ebx
push 0x3403
push 0x148b
push 0xa40
call fcn.00420909
add esp, 0x10
mov eax, 0x27e595f9
cmp ebx, 0x97
jge 0x425110
mov eax, 0xcb21ae9c
jmp 0x425110
imul ebx, ebx, 0xff000
push 0x14a5
push 0x31fd
push ebx
push 0x25eb
push 0x39b
call fcn.0041eb27
add esp, 0x14
mov eax, 0x21397d3
test ebx, ebx
je 0x425110
mov eax, 0x802ad5a3
jmp 0x425110
mov dword [esp + 0x20], 0
mov dword [esp], 0x10c0eff8
jmp 0x424c22
mov dword [esp + 0x14], 0
mov dword [esp], 0x802ad5a3
jmp 0x424c22
imul eax, dword [esp + 4], 0x4830000
add eax, 0xffffffc9
mov dword [esp + 4], eax
mov dword [esp], 0x99b67fbc
jmp 0x424c22
imul eax, dword [esp + 4], 0x1f01800
add eax, 0x5577c000
mov dword [esp + 4], eax
mov dword [esp], 0x82a9b641
jmp 0x424c22
mov dword [esp], 0xee355f59
jmp 0x424c22
imul eax, dword [esp + 4], 0x230
add eax, 0xbf
shr eax, 3
imul eax, eax, 0x8c
add eax, 0xffffff8b
mov dword [esp + 4], eax
mov dword [esp], 0xcb0f2970
jmp 0x424c22
mov dword [esp], 0x76530f7b
jmp 0x424c22
cmp dword [esp + 0xc], 0
mov eax, 0x82a9b641
je 0x425110
mov eax, 0x8b644baf
jmp 0x425110
add ebx, 0x45
call fcn.00427792
mov eax, 0xc477d7bf
cmp ebx, 0xfa
jl 0x425110
mov eax, 0x198ecc9f
mov dword [esp], eax
jmp 0x424c22
cmp eax, 0x82a9b641
jne 0x424c22
mov dword [esp + 0x24], ebx
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret