Function at 0x6c22c68c
Capabilities:
Contain obfuscated stackstrings
Write file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov ebx, dword [esp + 0x40]
mov esi, dword [esp + 0x44]
mov edi, dword [esp + 0x48]
mov ebp, dword [esp + 0x50]
test ebx, ebx
je 0x6c22c9d8
mov eax, dword [esp + 0x4c]
mov dword [0x6c459068], eax
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 1
mov dword [esp + 4], 4
mov dword [esp], str.RIFF
call sub.msvcrt.dll_fwrite
mov dword [esp], ebx
call sub.msvcrt.dll_ftell
mov dword [0x6c45906c], eax
mov dword [esp + 4], ebx
mov dword [esp], 0
call fcn.6c22c3bc
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 1
mov dword [esp + 4], 4
mov dword [esp], str.AVI
call sub.msvcrt.dll_fwrite
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 1
mov dword [esp + 4], 4
mov dword [esp], str.LIST
call sub.msvcrt.dll_fwrite
mov dword [esp + 4], ebx
mov dword [esp], 0x1cc
call fcn.6c22c3bc
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 1
mov dword [esp + 4], 4
mov dword [esp], str.hdrl
call sub.msvcrt.dll_fwrite
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 1
mov dword [esp + 4], 4
mov dword [esp], str.avih
call sub.msvcrt.dll_fwrite
mov dword [esp + 4], ebx
mov dword [esp], 0x38
call fcn.6c22c3bc
mov dword [esp + 0xc], ebx
mov eax, dword [0x6c459068]
mov dword [esp + 8], eax
mov dword [esp + 4], edi
mov dword [esp], esi
call fcn.6c22c3f0
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 1
mov dword [esp + 4], 4
mov dword [esp], str.LIST
call sub.msvcrt.dll_fwrite
mov dword [esp + 4], ebx
mov dword [esp], 0x74
call fcn.6c22c3bc
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 1
mov dword [esp + 4], 4
mov dword [esp], str.strl
call sub.msvcrt.dll_fwrite
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 1
mov dword [esp + 4], 4
mov dword [esp], str.strh
call sub.msvcrt.dll_fwrite
mov dword [esp + 4], ebx
mov dword [esp], 0x38
call fcn.6c22c3bc
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], ebp
mov eax, dword [0x6c459068]
mov dword [esp + 8], eax
mov dword [esp + 4], edi
mov dword [esp], esi
call fcn.6c22c470
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 1
mov dword [esp + 4], 4
mov dword [esp], str.strf
call sub.msvcrt.dll_fwrite
mov dword [esp + 4], ebx
mov dword [esp], 0x28
call fcn.6c22c3bc
mov dword [esp + 0xc], ebx
mov dword [esp + 8], ebp
mov dword [esp + 4], edi
mov dword [esp], esi
call fcn.6c22c528
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 1
mov dword [esp + 4], 4
mov dword [esp], str.LIST
call sub.msvcrt.dll_fwrite
mov dword [esp + 4], ebx
mov dword [esp], 0x104
call fcn.6c22c3bc
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 1
mov dword [esp + 4], 4
mov dword [esp], str.odml
call sub.msvcrt.dll_fwrite
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 1
mov dword [esp + 4], 4
mov dword [esp], str.dmlh
call sub.msvcrt.dll_fwrite
mov dword [esp + 4], ebx
mov dword [esp], 0xf8
call fcn.6c22c3bc
mov dword [esp + 4], ebx
mov eax, dword [0x6c459068]
mov dword [esp], eax
call fcn.6c22c64c
mov dword [esp], ebx
call sub.msvcrt.dll_ftell
mov esi, eax
cmp eax, 0x7f7
jle 0x6c22c9e0
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 1
mov dword [esp + 4], 4
mov dword [esp], str.LIST
call sub.msvcrt.dll_fwrite
mov dword [esp], ebx
call sub.msvcrt.dll_ftell
mov dword [0x6c459070], eax
mov dword [esp + 4], ebx
mov dword [esp], 0
call fcn.6c22c3bc
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 1
mov dword [esp + 4], 4
mov dword [esp], str.movi
call sub.msvcrt.dll_fwrite
mov dword [0x6c459074], 4
mov dword [esp], 0x10
call fcn.6c2df72c
mov ebx, eax
mov dword [eax], 0x10
mov dword [eax + 4], 0
mov dword [eax + 8], 0x1f4
mov dword [esp], 0x1f53
call sub.msvcrt.dll_malloc
lea edx, [eax + 0x13]
and edx, 0xfffffff0
mov dword [edx - 4], eax
mov dword [ebx + 0xc], edx
mov dword [0x6c459078], ebx
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 1
mov dword [esp + 4], 4
mov dword [esp], str.JUNK
call sub.msvcrt.dll_fwrite
mov edi, 0x7f8
sub edi, esi
mov dword [esp + 4], ebx
mov dword [esp], edi
call fcn.6c22c3bc
mov dword [esp + 8], 1
mov dword [esp + 4], edi
mov dword [esp], ebx
call sub.msvcrt.dll_fseek
mov dword [esp], ebx
call sub.msvcrt.dll_ftell
mov edi, eax
mov dword [esp + 8], 0
mov eax, dword [0x6c45906c]
add eax, 0xc
mov dword [esp + 4], eax
mov dword [esp], ebx
call sub.msvcrt.dll_fseek
mov dword [esp + 4], ebx
mov eax, edi
sub eax, esi
add eax, 0x1cc
mov dword [esp], eax
call fcn.6c22c3bc
mov dword [esp + 8], 0
mov dword [esp + 4], edi
mov dword [esp], ebx
call sub.msvcrt.dll_fseek
jmp 0x6c22c931