Function at 0x43dc90
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8c
mov eax, dword [0x4cf06c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
add eax, 0xffff7f9c
mov esi, ecx
push edi
mov edi, dword [ebp + 0x10]
cmp eax, 0x28
ja case.0x43dcc3.32878
movzx eax, byte [eax + 0x43e1c0]
jmp dword [eax*4 + 0x43e16c]
mov eax, dword [ebp + 0xc]
cmp eax, 2
jne 0x43dcf7
push edi
push 1
push 0x8082
call fcn.004646e0
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047d39f
mov esp, ebp
pop ebp
ret 0xc
cmp eax, 1
jne case.0x43de81.515
push edi
call fcn.0043b7e0
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047d39f
mov esp, ebp
pop ebp
ret 0xc
push 0x13
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
call fcn.00464820
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047d39f
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebp + 0xc]
sub eax, 0
je 0x43de4d
sub eax, 1
je 0x43dd96
sub eax, 2
jne case.0x43de81.515
push dword [esi + 0x2614]
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, esi
call fcn.004301e0
test eax, eax
je 0x43dd83
call fcn.00437a90
push dword [esi + 0x2614]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp case.0x43de81.515
call fcn.0043fbd0
push dword [esi + 0x2614]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp case.0x43de81.515
mov ebx, dword [sym.imp.KERNEL32.dll_SetThreadExecutionState]
push 0x80000000
call ebx
cmp dword [esi + 0x22cc], 0
je 0x43ddbd
mov ecx, dword [edi]
call fcn.0045d280
push eax
mov ecx, esi
call fcn.0043ff20
jmp 0x43de2d
push 0
push 0x938
lea ecx, [ebp - 0x88]
call fcn.00465810
push esi
push dword [edi + 4]
lea ecx, [ebp - 0x88]
mov dword [ebp - 0x88], 0x4c3498
push dword [edi]
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
call fcn.00444ec0
lea ecx, [ebp - 0x88]
mov ebx, eax
call fcn.00465860
sub ebx, 2
je 0x43de27
sub ebx, 3
mov ebx, dword [sym.imp.KERNEL32.dll_SetThreadExecutionState]
je 0x43de1e
mov dword [edi + 0x10], 2
jmp 0x43de34
mov dword [edi + 0x10], 1
jmp 0x43de34
mov ebx, dword [sym.imp.KERNEL32.dll_SetThreadExecutionState]
mov dword [edi + 0x10], 0
cmp dword [esi + 0x1a0c], 0
je case.0x43de81.515
push 0x80000001
call ebx
jmp case.0x43de81.515
call fcn.00435f50
jmp case.0x43de81.515
test byte [esi + 0x1c54], 8
jne case.0x43de81.515
cmp edi, 0x405
jg case.0x43de81.515
je 0x43de9d
add edi, 0xfffffdff
cmp edi, 4
ja case.0x43de81.515
jmp dword [edi*4 + 0x43e1ec]
push 0
call fcn.00464880
push 0xa
mov ecx, esi
call fcn.004376b0
jmp case.0x43de81.515
push 0
call fcn.00464880
push 0xa
mov ecx, esi
call fcn.004376b0
cmp dword [esi + 0x2324], 0
je 0x43ded6
mov eax, dword [esi + 0x2608]
test eax, eax
je 0x43dec6
cmp dword [eax + 8], 0
jne 0x43decf
cmp dword [esi + 0x230c], 0
je 0x43ded6
mov ecx, esi
call fcn.00431250
test byte [esi + 0x1c54], 4
je case.0x43de81.515
push 0
push 0
push 0
push 2
mov ecx, esi
call fcn.004376f0
jmp case.0x43de81.515
push 0
call fcn.00458e60
push eax
push dword [esi + 0x2328]
push 0
call fcn.004376f0
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047d39f
mov esp, ebp
pop ebp
ret 0xc
test edi, edi
je case.0x43de81.515
cmp edi, 0xffffffff
je 0x43df57
push 0
lea eax, [ebp - 0x8c]
mov dword [ebp - 0x8c], 0x6a4
push eax
push 0x6a4
lea eax, [esi + 0x1c50]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test edi, edi
je case.0x43de81.515
cmp edi, 0xffffffff
je case.0x43de81.515
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp case.0x43de81.515
lea ecx, [esi + 0x80]
call fcn.004128d0
test eax, eax
jne case.0x43de81.515
mov eax, dword [esi + 0x232c]
neg eax
pop edi
sbb eax, eax
pop esi
and eax, 2
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047d39f
mov esp, ebp
pop ebp
ret 0xc
call fcn.00436da0
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047d39f
mov esp, ebp
pop ebp
ret 0xc
push dword [ebp + 0xc]
push 2
call fcn.0043e440
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047d39f
mov esp, ebp
pop ebp
ret 0xc
push dword [ebp + 0xc]
push 2
call fcn.0043e4d0
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047d39f
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [esi + 0x1c10]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047d39f
mov esp, ebp
pop ebp
ret 0xc
pop edi
pop esi
mov eax, 2
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047d39f
mov esp, ebp
pop ebp
ret 0xc
test edi, edi
je case.0x43de81.515
push edi
call fcn.00442520
jmp case.0x43de81.515
test edi, edi
je case.0x43de81.515
push edi
call fcn.00442b80
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047d39f
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [esi + 0x78]
sub edi, dword [eax + 0x54]
push edi
call fcn.00432a00
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047d39f
mov esp, ebp
pop ebp
ret 0xc
push edi
lea ecx, [esi + 0x3984]
call fcn.004489f0
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047d39f
mov esp, ebp
pop ebp
ret 0xc
push edi
call fcn.004379b0
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047d39f
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebp + 0xc]
lea ecx, [esi + 0x36ec]
mov dword [esi + 0x3770], eax
mov eax, dword [ecx]
push 0
call dword [eax + 0x208]
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047d39f
mov esp, ebp
pop ebp
ret 0xc
call fcn.004321e0
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047d39f
mov esp, ebp
pop ebp
ret 0xc
xor ecx, ecx
cmp dword [esi + 0x14f8], 1
sete cl
call fcn.00458da0
mov ecx, esi
call fcn.004395e0
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047d39f
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0047d39f
mov esp, ebp
pop ebp
ret 0xc