Function at 0x428870
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x4340
call fcn.0040f260
mov eax, dword [0x4424f8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, ecx
mov dword [ebp - 0x4340], edi
cmp eax, 3
je 0x4288c7
cmp eax, 2
je 0x428982
cmp eax, 1
je 0x428982
pop edi
pop esi
mov eax, 0x10000
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040f12c
mov esp, ebp
pop ebp
ret 0x10
mov eax, dword [ebx + 4]
mov esi, dword [ebp + 8]
cmp esi, eax
je 0x428924
cmp eax, 0xffffffff
je 0x4288e1
mov eax, dword [ebx]
push eax
call fcn.00426810
add esp, 4
mov eax, dword [ebx]
mov dword [ebx + 4], 0xffffffff
cmp esi, dword [eax + 4]
jge 0x4288af
cmp esi, dword [eax + 0x10]
jge 0x4288fd
push eax
call fcn.00426580
add esp, 4
mov ecx, dword [ebx]
cmp dword [ecx + 0x10], esi
jge 0x428916
mov edx, dword [ebx]
push edx
call fcn.004265d0
mov eax, dword [ebx]
add esp, 4
cmp dword [eax + 0x10], esi
jl 0x428904
mov ecx, dword [ebx]
push ecx
call fcn.00428510
add esp, 4
mov dword [ebx + 4], esi
mov edx, dword [ebp + 0x10]
mov eax, dword [ebx]
push edx
push edi
push eax
call fcn.00428630
mov esi, eax
add esp, 0xc
test esi, esi
jle 0x428952
pop edi
pop esi
mov eax, 0x600
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040f12c
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [ebx]
push ecx
call fcn.00426810
add esp, 4
mov eax, esi
neg eax
pop edi
sbb eax, eax
pop esi
mov dword [ebx + 4], 0xffffffff
and eax, 0x5000000
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040f12c
mov esp, ebp
pop ebp
ret 0x10
or esi, 0xffffffff
cmp dword [ebx + 4], esi
je 0x428995
mov edx, dword [ebx]
push edx
call fcn.00426810
add esp, 4
mov eax, dword [ebx]
mov dword [ebx + 4], esi
mov esi, dword [ebp + 8]
cmp esi, dword [eax + 4]
jge 0x4288af
cmp esi, dword [eax + 0x10]
jge 0x4289b4
push eax
call fcn.00426580
add esp, 4
mov eax, dword [ebx]
cmp dword [eax + 0x10], esi
jge 0x4289d2
jmp 0x4289c0
mov ecx, dword [ebx]
push ecx
call fcn.004265d0
mov edx, dword [ebx]
add esp, 4
cmp dword [edx + 0x10], esi
jl 0x4289c0
lea eax, [ebp - 0x4338]
push eax
push esi
mov ecx, ebx
call fcn.004268d0
test byte [ebp - 0x4230], 0x10
je 0x428a2e
cmp dword [ebp + 0x14], 1
je 0x428a19
lea ecx, [ebp - 0x4334]
push ecx
mov esi, 0x103
lea edi, [ebp - 0x20c]
call fcn.00425c90
mov edx, edi
push edx
add ebx, 0x138
push ebx
call fcn.00426d40
add esp, 0xc
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040f12c
mov esp, ebp
pop ebp
ret 0x10
cmp dword [ebp + 0x14], 1
mov esi, edi
je 0x428b30
movzx eax, word [edi]
mov ecx, edi
test ax, ax
je 0x428b13
cmp ax, 0x2f
je 0x428a54
cmp ax, 0x5c
jne 0x428a57
lea esi, [ecx + 2]
movzx eax, word [ecx + 2]
add ecx, 2
test ax, ax
jne 0x428a48
cmp esi, edi
je 0x428b13
lea edx, [ebp - 0x20c]
mov eax, edi
sub edx, edi
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x428a75
sub esi, edi
xor eax, eax
sar esi, 1
mov word [ebp + esi*2 - 0x20e], ax
mov ax, word [ebp - 0x20c]
cmp ax, 0x2f
je 0x428ab5
cmp ax, 0x5c
je 0x428ab5
cmp word [ebp - 0x20a], 0x3a
mov byte [ebp - 0x4339], cl
jne 0x428abc
mov byte [ebp - 0x4339], 1
mov esi, dword [sym.imp.MSVCR100.dll_wcsstr]
lea ecx, [ebp - 0x20c]
push 0x438e74
push ecx
call esi
lea edx, [ebp - 0x20c]
push 0x438e6c
push edx
mov edi, eax
call esi
add esp, 0x10
test eax, eax
setne al
test edi, edi
setne cl
or al, cl
or al, byte [ebp - 0x4339]
jne 0x428b0d
lea edx, [ebp - 0x20c]
push edx
lea eax, [ebx + 0x138]
push eax
call fcn.00426d40
add esp, 8
mov edi, dword [ebp - 0x4340]
mov ecx, dword [ebp - 0x4230]
push 0
push ecx
push 2
push 0
push 0
push 0x40000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x428b4d
pop edi
pop esi
mov eax, 0x200
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040f12c
mov esp, ebp
pop ebp
ret 0x10
mov edx, dword [ebx]
push edx
call fcn.00428510
mov ecx, dword [ebx]
push 0x4000
lea eax, [ebp - 0x420c]
push eax
push ecx
mov byte [ebp - 0x4339], 0
call fcn.00428630
add esp, 0x10
test eax, eax
js 0x428bb2
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
je 0x428bb9
push 0
lea edx, [ebp - 0x4340]
push edx
push eax
lea eax, [ebp - 0x420c]
push eax
push esi
call edi
test eax, eax
je 0x428bb2
mov edx, dword [ebx]
push 0x4000
lea ecx, [ebp - 0x420c]
push ecx
push edx
call fcn.00428630
add esp, 0xc
test eax, eax
jns 0x428b7d
mov byte [ebp - 0x4339], 1
push esi
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 1
jne 0x428bea
cmp byte [ebp - 0x4339], 0
jne 0x428bea
lea eax, [ebp - 0x421c]
push eax
lea ecx, [ebp - 0x422c]
push ecx
lea edx, [ebp - 0x4224]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
cmp dword [ebp + 0x14], 1
je 0x428bf7
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebx]
push eax
call fcn.00426810
movzx eax, byte [ebp - 0x4339]
mov ecx, dword [ebp - 4]
add esp, 4
neg eax
pop edi
sbb eax, eax
pop esi
xor ecx, ebp
and eax, 0x400
pop ebx
call fcn.0040f12c
mov esp, ebp
pop ebp
ret 0x10