Function at 0x469240
Capabilities:
Check os version
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x4d6d3b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x84
mov eax, dword [ecx + 0x80]
push ebx
xor edx, edx
push ebp
push esi
cmp eax, edx
push edi
mov dword [esp + 0x30], ecx
je 0x4698ed
mov dword [esp + 0x1c], edx
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], edx
mov bl, byte [ecx + 0x74]
mov dword [esp + 0x9c], edx
test bl, bl
mov dword [esp + 0x14], edx
je 0x4695c9
mov dword [esp + 0x18], eax
mov dword [esp + 0x28], edx
movsx eax, word [ecx + 0x84]
dec eax
test eax, eax
jle 0x4698ed
mov esi, dword [esp + 0xa4]
mov edi, dword [sym.imp.MSVCRT.dll_fwrite]
movsx eax, word [ecx + 0x86]
mov dword [esp + 0x2c], edx
lea ebx, [eax - 1]
test ebx, ebx
jle 0x469592
mov ecx, dword [esp + 0x18]
lea ebx, [ecx + 0x18]
jmp 0x4692db
xor edx, edx
lea ecx, [ebx - 0x18]
lea eax, [eax + eax*2]
mov dword [esp + 0x10], edx
lea ebp, [ecx + eax*8]
mov al, byte [ebx - 0xc]
cmp al, 6
jbe 0x46937c
cmp byte [ebp + 0xc], 6
jbe 0x46941d
cmp byte [ebx + 0xc], 6
jbe 0x46937c
push ebx
push ebp
push ecx
lea ecx, [esp + 0x40]
push ecx
call fcn.00473480
add esp, 0x10
lea edx, [esp + 0x4c]
push eax
push edx
lea ecx, [esp + 0x24]
mov byte [esp + 0xa4], 1
call fcn.004051b0
push esi
push 1
lea eax, [esp + 0x24]
push 0xc
push eax
mov byte [esp + 0xac], 0
call edi
push esi
push 1
lea eax, [ebx - 0x18]
push 0xc
push eax
call edi
push esi
push 1
push 0xc
push ebp
call edi
push esi
push 1
push 0xc
push ebx
call edi
add esp, 0x40
lea ecx, [esp + 0x14]
push esi
push 1
push 2
push ecx
call edi
mov eax, dword [esp + 0xb8]
add esp, 0x10
mov dword [esp + 0x10], 1
inc dword [eax]
cmp byte [ebp + 0xc], 6
jbe 0x46941d
cmp byte [ebp + 0x24], 6
jbe 0x46941d
cmp byte [ebx + 0xc], 6
jbe 0x46941d
lea eax, [ebp + 0x18]
push ebx
push eax
lea edx, [esp + 0x84]
push ebp
push edx
call fcn.00473480
add esp, 0x10
push eax
lea eax, [esp + 0x68]
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0xa4], 2
call fcn.004051b0
push esi
push 1
lea ecx, [esp + 0x24]
push 0xc
push ecx
mov byte [esp + 0xac], 0
call edi
push esi
push 1
push 0xc
push ebp
call edi
push esi
push 1
lea eax, [ebp + 0x18]
push 0xc
push eax
call edi
push esi
push 1
push 0xc
push ebx
call edi
add esp, 0x40
lea edx, [esp + 0x14]
push esi
push 1
push 2
push edx
call edi
mov eax, dword [esp + 0xb8]
mov edx, dword [esp + 0x20]
add esp, 0x10
inc edx
mov ecx, dword [eax]
mov dword [esp + 0x10], edx
inc ecx
mov dword [eax], ecx
cmp dword [esp + 0x10], 2
jge 0x46956b
cmp byte [ebx - 0xc], 6
jbe 0x4694cc
cmp byte [ebp + 0xc], 6
jbe 0x4694cc
cmp byte [ebp + 0x24], 6
jbe 0x4694cc
lea eax, [ebp + 0x18]
push eax
lea eax, [ebx - 0x18]
push ebp
push eax
lea eax, [esp + 0x4c]
push eax
call fcn.00473480
add esp, 0x10
lea ecx, [esp + 0x58]
push eax
push ecx
lea ecx, [esp + 0x24]
mov byte [esp + 0xa4], 3
call fcn.004051b0
push esi
push 1
lea edx, [esp + 0x24]
push 0xc
push edx
mov byte [esp + 0xac], 0
call edi
push esi
push 1
lea eax, [ebx - 0x18]
push 0xc
push eax
call edi
push esi
push 1
push 0xc
push ebp
call edi
push esi
push 1
lea eax, [ebp + 0x18]
push 0xc
push eax
call edi
add esp, 0x40
lea eax, [esp + 0x14]
push esi
push 1
push 2
push eax
call edi
mov eax, dword [esp + 0xb8]
mov edx, dword [esp + 0x20]
add esp, 0x10
inc edx
mov ecx, dword [eax]
mov dword [esp + 0x10], edx
inc ecx
mov dword [eax], ecx
cmp dword [esp + 0x10], 2
jge 0x46956b
cmp byte [ebx - 0xc], 6
jbe 0x46956b
cmp byte [ebp + 0x24], 6
jbe 0x46956b
cmp byte [ebx + 0xc], 6
jbe 0x46956b
add ebp, 0x18
push ebx
lea eax, [ebx - 0x18]
push ebp
lea ecx, [esp + 0x78]
push eax
push ecx
call fcn.00473480
add esp, 0x10
lea edx, [esp + 0x88]
push eax
push edx
lea ecx, [esp + 0x24]
mov byte [esp + 0xa4], 4
call fcn.004051b0
push esi
push 1
lea eax, [esp + 0x24]
push 0xc
push eax
mov byte [esp + 0xac], 0
call edi
push esi
push 1
lea eax, [ebx - 0x18]
push 0xc
push eax
call edi
push esi
push 1
push 0xc
push ebp
call edi
push esi
push 1
push 0xc
push ebx
call edi
add esp, 0x40
lea ecx, [esp + 0x14]
push esi
push 1
push 2
push ecx
call edi
mov eax, dword [esp + 0xb8]
add esp, 0x10
inc dword [eax]
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
inc edx
add ebx, 0x18
movsx eax, word [ecx + 0x86]
mov dword [esp + 0x2c], edx
movsx edx, dx
lea ebp, [eax - 1]
cmp edx, ebp
jl 0x4692d9
xor edx, edx
movsx eax, word [ecx + 0x86]
mov ebp, dword [esp + 0x18]
mov ebx, dword [esp + 0x28]
lea eax, [eax + eax*2]
inc ebx
mov dword [esp + 0x28], ebx
lea eax, [ebp + eax*8]
mov dword [esp + 0x18], eax
movsx eax, word [ecx + 0x84]
movsx ebx, bx
dec eax
cmp ebx, eax
jl 0x4692ba
jmp 0x4698ed
mov ebx, eax
mov dword [esp + 0x28], edx
movsx eax, word [ecx + 0x84]
dec eax
mov dword [esp + 0x18], ebx
test eax, eax
jle 0x4698ed
mov esi, dword [esp + 0xa4]
mov edi, dword [sym.imp.MSVCRT.dll_fwrite]
movsx ebp, word [ecx + 0x86]
mov dword [esp + 0x2c], edx
lea eax, [ebp - 1]
test eax, eax
jle 0x4698bd
add ebx, 0x10
jmp 0x46960d
xor edx, edx
mov cl, byte [ebx - 4]
lea eax, [ebx - 0x10]
shl ebp, 4
add ebp, eax
cmp cl, 6
mov dword [esp + 0x10], edx
jbe 0x4696b1
cmp byte [ebp + 0xc], 6
jbe 0x4696b1
cmp byte [ebx + 0xc], 6
jbe 0x4696b1
push ebx
push ebp
lea ecx, [esp + 0x90]
push eax
push ecx
call fcn.00473330
add esp, 0x10
lea edx, [esp + 0x70]
push eax
push edx
lea ecx, [esp + 0x24]
mov byte [esp + 0xa4], 5
call fcn.004051b0
push esi
push 1
lea eax, [esp + 0x24]
push 0xc
push eax
mov byte [esp + 0xac], 0
call edi
push esi
push 1
lea eax, [ebx - 0x10]
push 0xc
push eax
call edi
push esi
push 1
push 0xc
push ebp
call edi
push esi
push 1
push 0xc
push ebx
call edi
add esp, 0x40
lea ecx, [esp + 0x14]
push esi
push 1
push 2
push ecx
call edi
mov eax, dword [esp + 0xb8]
add esp, 0x10
mov dword [esp + 0x10], 1
inc dword [eax]
cmp byte [ebp + 0xc], 6
jbe 0x46974f
cmp byte [ebp + 0x1c], 6
jbe 0x46974f
cmp byte [ebx + 0xc], 6
jbe 0x46974f
lea eax, [ebp + 0x10]
push ebx
push eax
lea edx, [esp + 0x60]
push ebp
push edx
call fcn.00473330
add esp, 0x10
push eax
lea eax, [esp + 0x44]
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0xa4], 6
call fcn.004051b0
push esi
push 1
lea ecx, [esp + 0x24]
push 0xc
push ecx
mov byte [esp + 0xac], 0
call edi
push esi
push 1
push 0xc
push ebp
call edi
push esi
push 1
lea eax, [ebp + 0x10]
push 0xc
push eax
call edi
push esi
push 1
push 0xc
push ebx
call edi
add esp, 0x40
lea edx, [esp + 0x14]
push esi
push 1
push 2
push edx
call edi
mov eax, dword [esp + 0xb8]
mov edx, dword [esp + 0x20]
add esp, 0x10
inc edx
mov ecx, dword [eax]
mov dword [esp + 0x10], edx
inc ecx
mov dword [eax], ecx
cmp dword [esp + 0x10], 2
jge 0x469896
cmp byte [ebx - 4], 6
jbe 0x4697fe
cmp byte [ebp + 0xc], 6
jbe 0x4697fe
cmp byte [ebp + 0x1c], 6
jbe 0x4697fe
lea eax, [ebp + 0x10]
push eax
lea eax, [ebx - 0x10]
push ebp
push eax
lea eax, [esp + 0x70]
push eax
call fcn.00473330
add esp, 0x10
lea ecx, [esp + 0x7c]
push eax
push ecx
lea ecx, [esp + 0x24]
mov byte [esp + 0xa4], 7
call fcn.004051b0
push esi
push 1
lea edx, [esp + 0x24]
push 0xc
push edx
mov byte [esp + 0xac], 0
call edi
push esi
push 1
lea eax, [ebx - 0x10]
push 0xc
push eax
call edi
push esi
push 1
push 0xc
push ebp
call edi
push esi
push 1
lea eax, [ebp + 0x10]
push 0xc
push eax
call edi
add esp, 0x40
lea eax, [esp + 0x14]
push esi
push 1
push 2
push eax
call edi
mov eax, dword [esp + 0xb8]
mov edx, dword [esp + 0x20]
add esp, 0x10
inc edx
mov ecx, dword [eax]
mov dword [esp + 0x10], edx
inc ecx
mov dword [eax], ecx
cmp dword [esp + 0x10], 2
jge 0x469896
cmp byte [ebx - 4], 6
jbe 0x469896
cmp byte [ebp + 0x1c], 6
jbe 0x469896
cmp byte [ebx + 0xc], 6
jbe 0x469896
add ebp, 0x10
push ebx
lea eax, [ebx - 0x10]
push ebp
lea ecx, [esp + 0x54]
push eax
push ecx
call fcn.00473330
add esp, 0x10
lea edx, [esp + 0x34]
push eax
push edx
lea ecx, [esp + 0x24]
mov byte [esp + 0xa4], 8
call fcn.004051b0
push esi
push 1
lea eax, [esp + 0x24]
push 0xc
push eax
mov byte [esp + 0xac], 0
call edi
push esi
push 1
lea eax, [ebx - 0x10]
push 0xc
push eax
call edi
push esi
push 1
push 0xc
push ebp
call edi
push esi
push 1
push 0xc
push ebx
call edi
add esp, 0x40
lea ecx, [esp + 0x14]
push esi
push 1
push 2
push ecx
call edi
mov eax, dword [esp + 0xb8]
add esp, 0x10
inc dword [eax]
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x2c]
inc eax
add ebx, 0x10
movsx ebp, word [ecx + 0x86]
mov dword [esp + 0x2c], eax
movsx eax, ax
lea edx, [ebp - 1]
cmp eax, edx
jl 0x46960b
xor edx, edx
movsx ebp, word [ecx + 0x86]
mov eax, dword [esp + 0x28]
mov ebx, dword [esp + 0x18]
shl ebp, 4
inc eax
add ebx, ebp
movsx ebp, word [ecx + 0x84]
mov dword [esp + 0x28], eax
dec ebp
movsx eax, ax
cmp eax, ebp
mov dword [esp + 0x18], ebx
jl 0x4695f0
mov ecx, dword [esp + 0x94]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x90
ret 8