Function at 0x4439d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57eca0
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
push esi
push edi
mov eax, dword [0x634384]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
push 0
push dword [ebx + 0x28]
push dword [ebx + 0x54]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
cmp eax, 0x102
jne 0x443d0f
lea edi, [ebx + 0x38]
jmp 0x443a20
lea eax, [ebp - 0x34]
mov dword [ebp - 0x34], 0
push 8
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
call fcn.00539040
push eax
push 8
mov dword [ebp - 0x34], eax
call fcn.00410470
lea ecx, [ebp - 0x34]
add esp, 0xc
mov dword [eax], 0
mov dword [eax + 4], 0
mov eax, dword [ebp - 0x34]
mov dword [eax], ecx
mov dword [ebp - 4], 2
push edi
mov dword [ebp - 0x18], edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [ebp - 4], 3
cmp dword [ebx + 0x90], 0
je 0x443b5e
mov eax, dword [ebx + 0x80]
test eax, eax
je 0x443aa1
mov eax, dword [eax]
mov ecx, dword [eax + 8]
mov eax, dword [eax + 4]
dec ecx
and ecx, dword [ebx + 0x8c]
mov edx, dword [ebp - 0x24]
mov eax, dword [eax + ecx*4]
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x10], eax
lea eax, [edx + 1]
cmp ecx, eax
ja 0x443ad1
push 1
lea ecx, [ebp - 0x34]
call fcn.004442f0
mov edx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x28]
dec ecx
and eax, ecx
mov dword [ebp - 0x28], eax
add eax, edx
and ecx, eax
mov eax, dword [ebp - 0x30]
lea esi, [ecx*4]
cmp dword [esi + eax], 0
jne 0x443b01
push 0x18
call fcn.00539040
mov ecx, dword [ebp - 0x30]
add esp, 4
mov dword [esi + ecx], eax
mov eax, dword [ebp - 0x30]
push dword [esi + eax]
push 0x18
call fcn.00410470
add esp, 8
mov ecx, eax
push dword [ebp - 0x10]
call fcn.00432a90
mov ecx, dword [ebx + 0x88]
mov eax, dword [ebx + 0x84]
dec ecx
and ecx, dword [ebx + 0x8c]
inc dword [ebp - 0x24]
mov ecx, dword [eax + ecx*4]
call fcn.0041ba60
add dword [ebx + 0x90], 0xffffffff
jne 0x443b4b
mov dword [ebx + 0x8c], 0
jmp 0x443b51
inc dword [ebx + 0x8c]
cmp dword [ebx + 0x90], 0
jne 0x443a95
mov byte [ebp - 4], 2
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [ebp - 0x24], 0
je 0x443c29
lea esi, [ebx + 0x5c]
push esi
mov dword [ebp - 0x1c], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x34]
test eax, eax
je 0x443b8d
mov eax, dword [eax]
mov ecx, dword [eax + 8]
mov eax, dword [eax + 4]
dec ecx
and ecx, dword [ebp - 0x28]
mov eax, dword [eax + ecx*4]
mov ecx, ebx
mov dword [ebp - 0x10], eax
call fcn.00443870
mov ecx, dword [ebp - 0x10]
call fcn.0041bbd0
mov ecx, dword [ebp - 0x10]
add eax, eax
mov dword [ebp - 0x14], eax
call fcn.0041ba50
mov ecx, dword [ebx + 0x2c]
mov dword [ebp - 0x10], eax
mov edx, dword [ecx + 4]
cmp ecx, vtable.Utils::Primitives::CDwFile.0
jne 0x444006
mov ecx, dword [ebx + 0x30]
test ecx, ecx
je 0x443bed
cmp ecx, 0xffffffff
je 0x443bed
push 0
lea ecx, [ebp - 0x20]
push ecx
push dword [ebp - 0x14]
push eax
push dword [ebx + 0x30]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x30]
dec ecx
and ecx, dword [ebp - 0x28]
mov ecx, dword [eax + ecx*4]
call fcn.0041ba60
sub dword [ebp - 0x24], 1
jne 0x443c0e
mov dword [ebp - 0x28], 0
jmp 0x443c11
inc dword [ebp - 0x28]
mov byte [ebp - 4], 2
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [ebp - 0x24], 0
jne 0x443b76
lea edi, [ebx + 0x38]
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x34]
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 6
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x443c76
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x2c]
dec eax
add ecx, eax
dec edx
mov eax, dword [ebp - 0x30]
and edx, ecx
mov ecx, dword [eax + edx*4]
call fcn.0041ba60
mov eax, dword [ebp - 0x24]
mov edx, 0
sub eax, 1
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x28]
cmove ecx, edx
mov dword [ebp - 0x28], ecx
test eax, eax
jne 0x443c47
mov esi, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x30]
test esi, esi
je 0x443c9e
mov eax, dword [ecx + esi*4 - 4]
dec esi
test eax, eax
je 0x443c97
push 0x18
push eax
call fcn.00539070
mov ecx, dword [ebp - 0x30]
add esp, 8
test esi, esi
jne 0x443c80
mov esi, dword [ebp - 0x2c]
test ecx, ecx
je 0x443ccd
shl esi, 2
mov eax, ecx
cmp esi, 0x1000
jb 0x443cc3
mov ecx, dword [ecx - 4]
add esi, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x444030
push esi
push ecx
call fcn.00539070
add esp, 8
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 4], 0xffffffff
push 8
push dword [ebp - 0x34]
call fcn.00539070
add esp, 8
mov dword [ebp - 0x34], 0
push 0
push dword [ebx + 0x28]
push dword [ebx + 0x54]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
cmp eax, 0x102
je 0x443a20
lea eax, [ebp - 0x34]
mov dword [ebp - 0x34], 0
push 8
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
call fcn.00539040
push eax
push 8
mov dword [ebp - 0x34], eax
call fcn.00410470
lea ecx, [ebp - 0x34]
add esp, 0xc
mov dword [eax], 0
mov dword [eax + 4], 0
mov eax, dword [ebp - 0x34]
mov dword [eax], ecx
mov dword [ebp - 4], 9
lea esi, [ebx + 0x38]
mov dword [ebp - 0x1c], esi
mov edi, dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push esi
call edi
mov byte [ebp - 4], 0xa
cmp dword [ebx + 0x90], 0
je 0x443e5f
lea esp, [esp]
mov eax, dword [ebx + 0x80]
test eax, eax
je 0x443d9c
mov eax, dword [eax]
mov ecx, dword [eax + 8]
mov eax, dword [eax + 4]
dec ecx
and ecx, dword [ebx + 0x8c]
mov edx, dword [ebp - 0x24]
mov eax, dword [eax + ecx*4]
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x14], eax
lea eax, [edx + 1]
cmp ecx, eax
ja 0x443dcc
push 1
lea ecx, [ebp - 0x34]
call fcn.004442f0
mov edx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x28]
dec ecx
and eax, ecx
mov dword [ebp - 0x28], eax
add eax, edx
and eax, ecx
lea edi, [eax*4]
mov eax, dword [ebp - 0x30]
cmp dword [eax + edi], 0
jne 0x443dfc
push 0x18
call fcn.00539040
mov ecx, dword [ebp - 0x30]
add esp, 4
mov dword [ecx + edi], eax
mov eax, dword [ebp - 0x30]
push dword [eax + edi]
push 0x18
call fcn.00410470
add esp, 8
mov ecx, eax
push dword [ebp - 0x14]
call fcn.00432a90
mov ecx, dword [ebx + 0x88]
mov eax, dword [ebx + 0x84]
dec ecx
and ecx, dword [ebx + 0x8c]
inc dword [ebp - 0x24]
mov ecx, dword [eax + ecx*4]
call fcn.0041ba60
add dword [ebx + 0x90], 0xffffffff
jne 0x443e46
mov dword [ebx + 0x8c], 0
jmp 0x443e4c
inc dword [ebx + 0x8c]
cmp dword [ebx + 0x90], 0
jne 0x443d90
mov edi, dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [ebp - 4], 9
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [ebp - 0x24], 0
je 0x443f24
lea esi, [ebx + 0x5c]
push esi
mov dword [ebp - 0x20], esi
call edi
mov byte [ebp - 4], 0xb
mov eax, dword [ebp - 0x34]
test eax, eax
je 0x443e8a
mov eax, dword [eax]
mov ecx, dword [eax + 8]
mov eax, dword [eax + 4]
dec ecx
and ecx, dword [ebp - 0x28]
mov edi, dword [eax + ecx*4]
mov ecx, ebx
call fcn.00443870
mov ecx, edi
call fcn.0041bbd0
add eax, eax
mov ecx, edi
mov dword [ebp - 0x10], eax
call fcn.0041ba50
mov ecx, dword [ebx + 0x2c]
mov dword [ebp - 0x14], eax
mov edx, dword [ecx + 4]
cmp ecx, vtable.Utils::Primitives::CDwFile.0
jne 0x44401b
mov ecx, dword [ebx + 0x30]
test ecx, ecx
je 0x443ee5
cmp ecx, 0xffffffff
je 0x443ee5
push 0
lea ecx, [ebp - 0x1c]
push ecx
push dword [ebp - 0x10]
push eax
push dword [ebx + 0x30]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x30]
dec ecx
and ecx, dword [ebp - 0x28]
mov ecx, dword [eax + ecx*4]
call fcn.0041ba60
sub dword [ebp - 0x24], 1
jne 0x443f06
mov dword [ebp - 0x28], 0
jmp 0x443f09
inc dword [ebp - 0x28]
mov byte [ebp - 4], 9
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [ebp - 0x24], 0
mov edi, dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
jne 0x443e77
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x34]
mov dword [ebp - 0x20], eax
mov dword [ebp - 4], 0xd
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x443f71
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x2c]
dec eax
add ecx, eax
dec edx
mov eax, dword [ebp - 0x30]
and edx, ecx
mov ecx, dword [eax + edx*4]
call fcn.0041ba60
mov eax, dword [ebp - 0x24]
mov edx, 0
sub eax, 1
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x28]
cmove ecx, edx
mov dword [ebp - 0x28], ecx
test eax, eax
jne 0x443f42
mov esi, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x30]
test esi, esi
je 0x443f9e
jmp 0x443f80
mov eax, dword [ecx + esi*4 - 4]
dec esi
test eax, eax
je 0x443f97
push 0x18
push eax
call fcn.00539070
mov ecx, dword [ebp - 0x30]
add esp, 8
test esi, esi
jne 0x443f80
mov esi, dword [ebp - 0x2c]
test ecx, ecx
je 0x443fc9
shl esi, 2
mov eax, ecx
cmp esi, 0x1000
jb 0x443fbf
mov ecx, dword [ecx - 4]
add esi, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x444030
push esi
push ecx
call fcn.00539070
add esp, 8
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 4], 0xffffffff
push 8
push dword [ebp - 0x34]
call fcn.00539070
add esp, 8
mov dword [ebp - 0x34], 0
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebx + 0x2c]
call edx
test al, al
je 0x443bed
mov eax, dword [ebp - 0x10]
jmp 0x443bda
lea ecx, [ebx + 0x2c]
call edx
test al, al
je 0x443ee5
mov eax, dword [ebp - 0x14]
jmp 0x443ed2
call fcn.00555b08
int3