Function at 0x422570
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 8
mov esi, dword [ebp + 8]
mov ebx, dword [sym.imp.ucrtbase.dll__stricmp]
mov dword [esp + 4], str.module_load_mismatched
mov dword [esp], esi
mov edi, dword [ebp + 0xc]
call ebx
test eax, eax
jne 0x4225f8
call dword [sym.imp.dbghelp.dll_SymGetOptions]
test edi, edi
mov esi, eax
je 0x4225c0
mov dword [esp + 4], str.true
mov dword [esp], edi
call ebx
test eax, eax
jne 0x422678
or esi, 0x40
jmp 0x4225e1
mov eax, str.true
test esi, 0x40
je 0x422668
mov dword [esp + 4], eax
mov dword [esp], str.Option:_module_load_mismatched__s_n
call fcn.004218d0
mov dword [esp], esi
call dword [sym.imp.dbghelp.dll_SymSetOptions]
push eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 4], str.symbol_picker
mov dword [esp], esi
call ebx
test eax, eax
jne 0x422698
test edi, edi
je 0x422638
mov dword [esp + 4], str.interactive
mov dword [esp], edi
call ebx
test eax, eax
jne 0x4226e8
mov dword [0x438760], 0x417800
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
cmp dword [0x438760], 0x417800
je 0x422760
mov eax, str.scoped
mov dword [ebp + 0xc], eax
mov dword [ebp + 8], str.Option:_symbol_picker__s_n
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.004218d0
mov eax, str.false
jmp 0x4225d1
mov dword [esp + 4], str.false
mov dword [esp], edi
call ebx
test eax, eax
jne 0x4227a8
and esi, 0xffffffbf
jmp 0x4225e1
mov dword [esp + 4], str.data_model
mov dword [esp], esi
call ebx
test eax, eax
jne 0x422708
mov eax, dword [0x4ab5d8]
test eax, eax
je 0x4227c0
test edi, edi
je 0x422770
mov dword [esp + 4], str.auto
mov dword [esp], edi
call ebx
test eax, eax
jne 0x422718
mov eax, dword [0x4ab5d8]
mov dword [eax + 0x1420], 0
jmp 0x4225eb
mov dword [esp + 4], str.scoped
mov dword [esp], edi
call ebx
test eax, eax
jne 0x422748
mov dword [0x438760], 0x418360
jmp 0x4225eb
mov dword [ebp + 0xc], esi
mov dword [ebp + 8], str.Unknown_option__s_n
jmp 0x422657
mov dword [esp + 4], str.ilp32
mov dword [esp], edi
call ebx
test eax, eax
jne 0x4227d7
mov eax, dword [0x4ab5d8]
mov dword [eax + 0x1420], 0x4409e0
jmp 0x4225eb
mov dword [ebp + 8], str.Syntax:_symbol_picker__interactivescoped__n
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.004218d0
mov eax, str.interactive
jmp 0x42264d
mov eax, dword [eax + 0x1420]
test eax, eax
je 0x4227b8
cmp eax, 0x4409e0
je 0x4227c9
cmp eax, 0x440900
je 0x4227d0
mov edx, 0x440c02
cmp eax, 0x440820
je 0x4227fc
mov dword [ebp + 0xc], edx
mov dword [ebp + 8], str.Option:_data_model__s_n
jmp 0x422657
mov dword [ebp + 8], str.Syntax:_module_load_mismatched__truefalse__n
jmp 0x42274f
mov edx, str.auto
jmp 0x422794
mov dword [ebp + 8], str.Not_attached_to_a_process_n
jmp 0x42274f
mov edx, str.ilp32
jmp 0x422794
mov edx, str.llp64
jmp 0x422794
mov dword [esp + 4], str.llp64
mov dword [esp], edi
call ebx
test eax, eax
jne 0x422803
mov eax, dword [0x4ab5d8]
mov dword [eax + 0x1420], 0x440900
jmp 0x4225eb
mov edx, str.lp64
jmp 0x422794
mov dword [esp + 4], str.lp64
mov dword [esp], edi
call ebx
test eax, eax
jne 0x422828
mov eax, dword [0x4ab5d8]
mov dword [eax + 0x1420], 0x440820
jmp 0x4225eb
mov dword [ebp + 0xc], edi
mov dword [ebp + 8], str.Unknown_data_model__s_n
jmp 0x422657