Function at 0x427950
Capabilities:
Write file on windows

Disassembly:
sub esp, 0xc
mov dword [esp + 8], edx
push ebx
push esi
mov ebx, ecx
push edi
test ebx, ebx
push ebp
je 0x427b63
cmp ebx, 0xffffffff
je 0x427b63
push 0x45af50
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebx]
cmp eax, 0x1c
jne 0x427af8
mov esi, dword [ebx + 0xc]
mov eax, dword [ebx + 8]
shl esi, 5
add esi, dword [eax + 0x18]
cmp dword [esp + 0x24], 0
je 0x4279a1
mov eax, dword [esp + 0x24]
mov dword [eax], 0
test byte [ebx + 0x17], 0x40
jne 0x4279c8
mov ecx, 0xfffffffa
call fcn.00426570
push 0x45af50
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0xc
ret 0xc
mov edx, dword [ebx + 0x10]
mov eax, dword [esi + 0x10]
sub eax, edx
mov ecx, dword [esp + 0x20]
cmp ecx, eax
jbe 0x4279da
mov ecx, eax
mov dword [esp + 0x10], ecx
mov ecx, dword [esi + 0xc]
add ecx, edx
mov eax, ecx
cdq
xor eax, edx
sub eax, edx
and eax, 0x7fff
xor eax, edx
sub eax, edx
mov esi, eax
mov eax, ecx
cdq
and edx, 0x7fff
add eax, edx
sar eax, 0xf
cmp dword [esp + 0x10], 0
mov dword [esp + 0x14], eax
jle 0x427a9c
mov ebp, 0x8000
sub ebp, esi
cmp dword [esp + 0x10], ebp
jge 0x427a23
mov ebp, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [ebx + 8]
cmp ebp, 0x8000
jne 0x427a46
call fcn.00427510
mov ecx, dword [ebx + 8]
mov edx, dword [esp + 0x14]
mov dword [eax + 4], ecx
mov dword [eax + 8], edx
jmp 0x427a4f
call fcn.00427450
test eax, eax
je 0x427ab6
mov edi, dword [eax + 0xc]
mov ecx, ebp
shr ecx, 2
add edi, esi
mov esi, dword [esp + 0x18]
mov edx, eax
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebx + 8]
call fcn.00427b80
test eax, eax
je 0x427ad7
xor esi, esi
sub dword [esp + 0x10], ebp
inc dword [esp + 0x14]
add dword [ebx + 0x10], ebp
add dword [esp + 0x18], ebp
cmp dword [esp + 0x24], esi
je 0x427a91
mov eax, dword [esp + 0x24]
add dword [eax], ebp
cmp dword [esp + 0x10], 0
jg 0x427a12
push 0x45af50
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, 1
pop ebp
pop edi
pop esi
pop ebx
add esp, 0xc
ret 0xc
mov ecx, 0xfffffff7
call fcn.00426570
push 0x45af50
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0xc
ret 0xc
mov ecx, 0xfffffff7
call fcn.00426570
push 0x45af50
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0xc
ret 0xc
cmp eax, 0xc
jne 0x427b42
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
push eax
mov eax, dword [esp + 0x1c]
push ecx
push edx
mov ecx, dword [ebx + 8]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov esi, eax
test esi, esi
jne 0x427b2b
mov ecx, 0xfffffff7
call fcn.00426570
push 0x45af50
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, esi
pop ebp
pop edi
pop esi
pop ebx
add esp, 0xc
ret 0xc
mov ecx, 0xfffffffe
call fcn.00426570
push 0x45af50
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0xc
ret 0xc
mov ecx, 0xfffffffe
call fcn.00426570
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0xc
ret 0xc