Function at 0x428bc1
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x42d00c]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 0x10]
mov esi, ecx
mov dword [ebp - 0x28], eax
xor ebx, ebx
test esi, esi
push edi
setne al
movzx eax, al
push eax
push 0x411c34
push 0x2dd
push 1
push 3
mov ecx, 0x411de0
mov dword [ebp - 0x24], esi
call fcn.0042ba80
xor eax, eax
mov dword [ebp - 0x3c], ebx
lea edi, [ebp - 0x38]
stosd dword es:[edi], eax
mov eax, dword [esi]
push esi
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x40], ebx
call dword [eax + 0x90]
cmp eax, 4
sete al
movzx eax, al
push eax
push 0x40429c
push ebx
push ebx
push ebx
mov ecx, 0x411ea8
call fcn.0042ba80
mov eax, dword [esi]
lea ecx, [ebp - 0x40]
push ecx
lea ecx, [ebp - 0x3c]
push ecx
lea ecx, [ebp - 0x30]
push ecx
push esi
call dword [eax + 0xb8]
mov eax, dword [esi]
push ebx
push ebx
lea ecx, [ebp - 0x34]
push ecx
push ebx
push esi
call dword [eax + 0xc0]
mov edi, eax
test edi, edi
jns 0x428cc0
mov eax, dword [0x42d05c]
cmp eax, 0x42d05c
je 0x428cac
test dword [eax + 0xbc], reloc.ADVAPI32.dll_EventActivityIdControl
je 0x428cac
cmp byte [eax + 0xb9], 2
jb 0x428cac
push edi
push 0x412614
push 0x12
push dword [eax + 0xb4]
push dword [eax + 0xb0]
call fcn.0041722a
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 8]
mov ecx, dword [eax]
push ebx
push edi
push esi
push eax
call dword [ecx + 0xc]
jmp 0x428e4e
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x28]
mov dword [ecx + 8], eax
mov eax, dword [ebp - 0x38]
mov dword [ecx + 0xc], eax
mov eax, dword [esi]
push esi
mov dword [ebp - 0x2c], ebx
call dword [eax + 0xf8]
test eax, eax
je 0x428d49
mov eax, dword [esi]
push esi
call dword [eax + 0xfc]
mov esi, eax
lea edi, [ebp - 0x18]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x18]
push eax
push 4
movsd dword es:[edi], dword [esi]
call dword [sym.imp.ADVAPI32.dll_EventActivityIdControl]
mov ecx, eax
test ecx, ecx
je 0x428d42
mov eax, dword [0x42d05c]
cmp eax, 0x42d05c
je 0x428d49
test dword [eax + 0xbc], reloc.ADVAPI32.dll_EventActivityIdControl
je 0x428d49
cmp byte [eax + 0xb9], 3
jb 0x428d49
push ecx
push dword [ebp - 0x24]
push 0x4010a0
push reloc.ADVAPI32.dll_EventRegister
push dword [eax + 0xb4]
push dword [eax + 0xb0]
call fcn.0041c5ec
jmp 0x428d49
mov dword [ebp - 0x2c], 1
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 8]
mov esi, dword [ebp - 0x30]
mov edi, dword [ebp - 0x34]
lea edx, [ebp - 0x20]
push edx
push dword [ebp - 0x24]
mov dword [ebp - 0x20], ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x10]
push dword [ebp - 0x28]
push ebx
push esi
push edi
push dword [ebp - 0x44]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edi, dword [ebp - 0x1c]
mov esi, eax
cmp dword [ebp - 0x20], ebx
je 0x428d8a
mov eax, dword [edi + 8]
push dword [ebp - 0x20]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
cmp dword [ebp - 0x2c], ebx
je 0x428ddb
lea eax, [ebp - 0x18]
push eax
push 2
call dword [sym.imp.ADVAPI32.dll_EventActivityIdControl]
mov ecx, eax
test ecx, ecx
je 0x428ddb
mov eax, dword [0x42d05c]
cmp eax, 0x42d05c
je 0x428ddb
test dword [eax + 0xbc], reloc.ADVAPI32.dll_EventActivityIdControl
je 0x428ddb
cmp byte [eax + 0xb9], 3
jb 0x428ddb
push ecx
push 0x4010a0
push reloc.ADVAPI32.dll_EventWrite
push dword [eax + 0xb4]
push dword [eax + 0xb0]
call fcn.0041722a
test esi, esi
jne 0x428def
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
cmp ecx, 0x3e5
jne 0x428df4
xor ebx, ebx
inc ebx
jmp 0x428e4e
mov esi, ecx
test ecx, ecx
jle 0x428e06
and esi, 0xffff
or esi, 0x80070000
mov eax, dword [0x42d05c]
cmp eax, 0x42d05c
je 0x428e40
test dword [eax + 0xbc], reloc.ADVAPI32.dll_EventActivityIdControl
je 0x428e40
cmp byte [eax + 0xb9], 2
jb 0x428e40
push ecx
push 0x412614
push 0x13
push dword [eax + 0xb4]
push dword [eax + 0xb0]
call fcn.0041722a
mov ecx, dword [edi + 8]
mov edx, dword [ecx]
push ebx
push esi
push dword [ebp - 0x24]
push ecx
call dword [edx + 0xc]
mov ecx, dword [ebp - 8]
pop edi
pop esi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.0042bdaf
leave
ret 0xc