Function at 0x467ffd
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x348
mov eax, dword [0x530630]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 0x14], 3
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov esi, ecx
je 0x46803c
cmp dword [ebp + 0x14], 2
je 0x4680e8
cmp dword [ebp + 0x14], 1
je 0x4680e8
mov eax, 0x10000
jmp 0x468372
mov eax, dword [esi + 4]
mov edi, dword [ebp + 8]
cmp edi, eax
je 0x46808b
cmp eax, 0xffffffff
je 0x468053
push dword [esi]
call fcn.004723be
pop ecx
mov eax, dword [esi]
or dword [esi + 4], 0xffffffff
cmp edi, dword [eax + 4]
jge 0x468032
cmp edi, dword [eax + 0x10]
jge 0x468073
push eax
call fcn.00466088
jmp 0x468072
push dword [esi]
call fcn.004660c9
pop ecx
mov eax, dword [esi]
cmp dword [eax + 0x10], edi
jl 0x46806b
push dword [esi + 0x138]
push eax
call fcn.00467bc2
pop ecx
pop ecx
mov dword [esi + 4], edi
lea eax, [ebp - 0x339]
push eax
push dword [ebp + 0x10]
push ebx
push dword [esi]
call fcn.00467d21
mov edi, eax
add esp, 0x10
test edi, edi
jg 0x4680b2
push dword [esi]
call fcn.004723be
or dword [esi + 4], 0xffffffff
pop ecx
cmp byte [ebp - 0x339], 0
je 0x4680c2
xor eax, eax
jmp 0x468372
test edi, edi
jle 0x4680d0
mov eax, 0x600
jmp 0x468372
xor eax, eax
cmp edi, 0xffffff96
setne al
dec eax
and eax, 0xfb001000
add eax, 0x5000000
jmp 0x468372
cmp dword [esi + 4], 0xffffffff
je 0x4680f6
push dword [esi]
call fcn.004723be
pop ecx
mov eax, dword [esi]
mov edi, dword [ebp + 8]
or dword [esi + 4], 0xffffffff
cmp edi, dword [eax + 4]
jge 0x468032
cmp edi, dword [eax + 0x10]
jge 0x46811d
push eax
call fcn.00466088
jmp 0x46811c
push dword [esi]
call fcn.004660c9
pop ecx
mov eax, dword [esi]
cmp dword [eax + 0x10], edi
jl 0x468115
lea eax, [ebp - 0x338]
push eax
push edi
mov ecx, esi
call fcn.004663f9
test byte [ebp - 0x230], 0x10
je 0x468174
cmp dword [ebp + 0x14], 1
je 0x4680bb
mov al, byte [ebx]
cmp al, 0x2f
je 0x46815a
cmp al, 0x5c
je 0x46815a
test al, al
je 0x46815f
cmp byte [ebx + 1], 0x3a
jne 0x46815f
push ebx
push 0
jmp 0x468167
push ebx
add esi, 0x140
push esi
call fcn.004668db
pop ecx
xor eax, eax
jmp 0x468371
cmp dword [ebp + 0x14], 1
jne 0x468185
mov dword [ebp - 0x344], ebx
jmp 0x46820f
mov al, byte [ebx]
mov edi, ebx
mov ecx, ebx
jmp 0x46819b
cmp al, 0x2f
je 0x468195
cmp al, 0x5c
jne 0x468198
lea edi, [ecx + 1]
inc ecx
mov al, byte [ecx]
test al, al
jne 0x46818d
lea eax, [ebp - 0x108]
push ebx
push eax
call fcn.004cc060
pop ecx
pop ecx
cmp edi, ebx
jne 0x468222
mov byte [ebp - 0x108], 0
push edi
lea eax, [ebp - 0x108]
push eax
lea ebx, [esi + 0x140]
push ebx
lea eax, [ebp - 0x20c]
push 0x4f82b4
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [ebp - 0x108]
push eax
push ebx
call fcn.004668db
add esp, 0x1c
xor eax, eax
push eax
push dword [ebp - 0x230]
push 2
push eax
push eax
push 0x40000000
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x344], eax
cmp dword [ebp - 0x344], 0xffffffff
jne 0x46828a
mov eax, 0x200
jmp 0x468372
mov eax, edi
sub eax, ebx
mov byte [ebp + eax - 0x108], 0
cmp byte [ebp - 0x108], 0x2f
je 0x46825a
cmp byte [ebp - 0x108], 0x5c
je 0x46825a
cmp byte [ebp - 0x108], 0
je 0x4681b9
cmp byte [ebp - 0x107], 0x3a
jne 0x4681b9
push edi
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x20c]
push str._s_s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [ebp - 0x108]
push eax
push 0
call fcn.004668db
add esp, 0x18
jmp 0x4681ea
push dword [esi + 0x138]
push dword [esi]
call fcn.00467bc2
cmp dword [esi + 0x13c], 0
pop ecx
pop ecx
mov ebx, 0x4000
jne 0x4682b4
push ebx
call fcn.00468dae
pop ecx
mov dword [esi + 0x13c], eax
and dword [ebp - 0x340], 0
lea eax, [ebp - 0x339]
push eax
push ebx
push dword [esi + 0x13c]
push dword [esi]
call fcn.00467d21
mov edi, eax
add esp, 0x10
cmp edi, 0xffffff96
je 0x468319
test edi, edi
js 0x46830d
jle 0x468300
push 0
lea eax, [ebp - 0x348]
push eax
push edi
push dword [esi + 0x13c]
push dword [ebp - 0x344]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x468325
cmp byte [ebp - 0x339], 0
jne 0x468331
test edi, edi
jne 0x4682bb
mov dword [ebp - 0x340], 0x5000000
jmp 0x468352
mov dword [ebp - 0x340], 0x1000
jmp 0x468352
mov dword [ebp - 0x340], 0x400
jmp 0x468352
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x22c]
push eax
lea eax, [ebp - 0x224]
push eax
push dword [ebp - 0x344]
call dword [sym.imp.KERNEL32.dll_SetFileTime]
cmp dword [ebp + 0x14], 1
je 0x468364
push dword [ebp - 0x344]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esi]
call fcn.004723be
mov eax, dword [ebp - 0x340]
pop ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004cab85
leave
ret 0x10