Function at 0x406670
Capabilities:
Resolve function by parsing pe exports
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x431d50
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x43b040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [0x43b4a8]
mov edi, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov dword [ebp - 0x10], 6
mov eax, dword [ebx + 0x2c]
test eax, eax
je 0x40680d
cmp byte [ebx + 1], 0
je 0x40680d
mov byte [eax + 0x10], 0
mov esi, dword [ebx + 0x2c]
mov dword [ebp - 0x1c], esi
test esi, esi
je 0x40680d
mov ecx, esi
mov dword [ebp - 4], 0
call fcn.00426ea0
mov ecx, esi
call fcn.004270a0
lea ecx, [esi + 0x3c]
xor esi, esi
mov dword [ebp - 0x14], ecx
cmp dword [ecx], esi
jle 0x406782
mov eax, dword [ecx + 8]
mov edi, dword [eax + esi*4]
test edi, edi
je 0x406773
mov ecx, edi
call fcn.004298f0
mov ecx, dword [0x43b4a8]
test ecx, ecx
je 0x406762
movsx eax, word [ecx + 0x5f64]
mov edx, dword [ecx + 0x3f50]
add eax, 0xbed
mov dword [ebp - 0x18], edx
cmp dword [ecx + eax*8], edx
lea eax, [ecx + eax*8]
je 0x406758
movsx eax, word [ecx + 0x5f64]
inc eax
cdq
idiv dword [ebp - 0x10]
movzx eax, dx
mov edx, dword [ebp - 0x18]
mov word [ecx + 0x5f64], ax
cwde
add eax, 0xbed
lea eax, [ecx + eax*8]
mov dword [eax], edx
xor edx, edx
mov dword [eax + 4], edx
inc word [eax + 6]
inc dword [ecx + 0x5f60]
push edi
mov edi, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
call edi
mov ecx, dword [ebp - 0x14]
add esp, 4
jmp 0x406779
mov edi, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
inc esi
cmp esi, dword [ecx]
jl 0x4066f7
call fcn.00401d30
mov esi, dword [ebp - 0x1c]
lea ecx, [esi + 0x54]
mov byte [esi + 0x18], 0
call fcn.0041a7c0
lea ecx, [esi + 0x48]
call fcn.0041a7c0
mov ecx, dword [ebp - 0x14]
call fcn.0041a7c0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [0x43b4a8]
test ecx, ecx
je 0x406807
movsx eax, word [ecx + 0x5f64]
mov edx, dword [ecx + 0x3f50]
add eax, 0xbed
mov dword [ebp - 0x1c], edx
cmp dword [ecx + eax*8], edx
lea eax, [ecx + eax*8]
je 0x4067fd
movsx eax, word [ecx + 0x5f64]
inc eax
cdq
idiv dword [ebp - 0x10]
movzx eax, dx
mov edx, dword [ebp - 0x1c]
mov word [ecx + 0x5f64], ax
cwde
add eax, 0xbed
lea eax, [ecx + eax*8]
mov dword [eax], edx
xor edx, edx
mov dword [eax + 4], edx
inc word [eax + 6]
inc dword [ecx + 0x5f60]
push esi
call edi
add esp, 4
lea ecx, [ebx + 0x3d74]
mov dword [ebx + 0x2c], 0
call fcn.00401d30
cmp byte [ebx], 0
je 0x406ff9
cmp byte [ebx + 0x5e38], 0
je 0x406881
mov esi, dword [ebx + 0x20]
test esi, esi
je 0x406881
mov eax, dword [0x43b4a8]
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x14], 0
mov dword [eax + 0x5e3c], 0
call fcn.00419690
mov edx, 0x4340dc
mov ecx, esi
mov edi, eax
call fcn.004047d0
mov esi, eax
test esi, esi
je 0x406881
push esi
push dword [ebp - 0x14]
push 1
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 0x14
mov eax, dword [ebx + 0x5e70]
mov esi, dword [ebx + 0x5e78]
lea eax, [eax + eax*4]
lea edi, [esi + eax*4]
cmp esi, edi
je 0x4068ae
cmp dword [esi + 4], 6
jne 0x4068a7
mov eax, dword [esi + 0xc]
push esi
push ebx
call eax
add esp, 8
add esi, 0x14
cmp esi, edi
jne 0x406897
lea ecx, [ebx + 0x3f98]
xor esi, esi
cmp dword [ecx], esi
jle 0x406940
nop
mov eax, dword [ecx + 8]
mov edi, dword [eax + esi*4]
test edi, edi
je 0x40693b
mov ecx, edi
call fcn.00407810
mov ecx, dword [0x43b4a8]
test ecx, ecx
je 0x40692b
movsx eax, word [ecx + 0x5f64]
mov edx, dword [ecx + 0x3f50]
add eax, 0xbed
mov dword [ebp - 0x1c], edx
cmp dword [ecx + eax*8], edx
lea eax, [ecx + eax*8]
je 0x406921
movsx eax, word [ecx + 0x5f64]
inc eax
cdq
idiv dword [ebp - 0x10]
movzx eax, dx
mov edx, dword [ebp - 0x1c]
mov word [ecx + 0x5f64], ax
cwde
add eax, 0xbed
lea eax, [ecx + eax*8]
mov dword [eax], edx
xor edx, edx
mov dword [eax + 4], edx
inc word [eax + 6]
inc dword [ecx + 0x5f60]
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
lea ecx, [ebx + 0x3f98]
inc esi
cmp esi, dword [ecx]
jl 0x4068c0
call fcn.00401d30
lea ecx, [ebx + 0x3fa4]
call fcn.00401d30
lea ecx, [ebx + 0x3fb0]
call fcn.00401d30
mov dword [ebx + 0x3fe4], 0
mov esi, dword [ebx + 0x3fc4]
test esi, esi
je 0x4069ea
mov ecx, dword [0x43b4a8]
mov dword [ebx + 0x3fc0], 0
mov dword [ebx + 0x3fbc], 0
test ecx, ecx
je 0x4069d2
movsx edx, word [ecx + 0x5f64]
lea eax, [ecx + 0x5f68]
mov edi, dword [ecx + 0x3f50]
lea eax, [eax + edx*8]
cmp dword [eax], edi
je 0x4069c8
lea eax, [edx + 1]
cdq
idiv dword [ebp - 0x10]
movzx eax, dx
mov word [ecx + 0x5f64], ax
cwde
add eax, 0xbed
xor edx, edx
lea eax, [ecx + eax*8]
mov dword [eax], edi
mov dword [eax + 4], edx
inc word [eax + 6]
inc dword [ecx + 0x5f60]
push esi
mov esi, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
call esi
add esp, 4
mov dword [ebx + 0x3fc4], 0
jmp 0x4069f0
mov esi, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
lea ecx, [ebx + 0x3fc8]
call fcn.00401d30
or eax, 0xffffffff
mov dword [ebx + 0x4aa8], 0
mov dword [ebx + 0x3fec], 0
lea edi, [ebx + 0x47dc]
mov dword [ebx + 0x3fe8], 0
mov ecx, 0x4d
mov dword [ebx + 0x4068], 0
mov dword [ebx + 0x4058], 0
mov dword [ebx + 0x3ff4], 0
rep stosd dword es:[edi], eax
lea ecx, [ebx + 0x4910]
call fcn.00401d30
lea ecx, [ebx + 0x491c]
call fcn.00401d30
mov edi, dword [ebx + 0x4a38]
test edi, edi
je 0x406ae5
mov ecx, dword [0x43b4a8]
mov dword [ebx + 0x4a34], 0
mov dword [ebx + 0x4a30], 0
test ecx, ecx
je 0x406ad5
movsx eax, word [ecx + 0x5f64]
mov edx, dword [ecx + 0x3f50]
add eax, 0xbed
mov dword [ebp - 0x1c], edx
cmp dword [ecx + eax*8], edx
lea eax, [ecx + eax*8]
je 0x406acb
movsx eax, word [ecx + 0x5f64]
inc eax
cdq
idiv dword [ebp - 0x10]
movzx eax, dx
mov edx, dword [ebp - 0x1c]
mov word [ecx + 0x5f64], ax
cwde
add eax, 0xbed
lea eax, [ecx + eax*8]
mov dword [eax], edx
xor edx, edx
mov dword [eax + 4], edx
inc word [eax + 6]
inc dword [ecx + 0x5f60]
push edi
call esi
add esp, 4
mov dword [ebx + 0x4a38], 0
mov edi, dword [ebx + 0x4a44]
test edi, edi
je 0x406b6d
mov ecx, dword [0x43b4a8]
mov dword [ebx + 0x4a40], 0
mov dword [ebx + 0x4a3c], 0
test ecx, ecx
je 0x406b5d
movsx eax, word [ecx + 0x5f64]
mov edx, dword [ecx + 0x3f50]
add eax, 0xbed
mov dword [ebp - 0x1c], edx
cmp dword [ecx + eax*8], edx
lea eax, [ecx + eax*8]
je 0x406b53
movsx eax, word [ecx + 0x5f64]
inc eax
cdq
idiv dword [ebp - 0x10]
movzx eax, dx
mov edx, dword [ebp - 0x1c]
mov word [ecx + 0x5f64], ax
cwde
add eax, 0xbed
lea eax, [ecx + eax*8]
mov dword [eax], edx
xor edx, edx
mov dword [eax + 4], edx
inc word [eax + 6]
inc dword [ecx + 0x5f60]
push edi
call esi
add esp, 4
mov dword [ebx + 0x4a44], 0
lea ecx, [ebx + 0x4a48]
call fcn.00401d30
lea ecx, [ebx + 0x4a78]
call fcn.00401d30
lea ecx, [ebx + 0x4a84]
call fcn.00401d30
mov edi, dword [ebx + 0x4a98]
test edi, edi
je 0x406c16
mov ecx, dword [0x43b4a8]
mov dword [ebx + 0x4a94], 0
mov dword [ebx + 0x4a90], 0
test ecx, ecx
je 0x406c06
movsx eax, word [ecx + 0x5f64]
mov edx, dword [ecx + 0x3f50]
add eax, 0xbed
mov dword [ebp - 0x1c], edx
cmp dword [ecx + eax*8], edx
lea eax, [ecx + eax*8]
je 0x406bfc
movsx eax, word [ecx + 0x5f64]
inc eax
cdq
idiv dword [ebp - 0x10]
movzx eax, dx
mov edx, dword [ebp - 0x1c]
mov word [ecx + 0x5f64], ax
cwde
add eax, 0xbed
lea eax, [ecx + eax*8]
mov dword [eax], edx
xor edx, edx
mov dword [eax + 4], edx
inc word [eax + 6]
inc dword [ecx + 0x5f60]
push edi
call esi
add esp, 4
mov dword [ebx + 0x4a98], 0
lea ecx, [ebx + 0x4a9c]
call fcn.0041aab0
lea ecx, [ebx + 0x4da8]
call fcn.0041a860
mov edi, dword [ebx + 0x4dd0]
test edi, edi
je 0x406cb4
mov ecx, dword [0x43b4a8]
mov dword [ebx + 0x4dcc], 0
mov dword [ebx + 0x4dc8], 0
test ecx, ecx
je 0x406ca4
movsx eax, word [ecx + 0x5f64]
mov edx, dword [ecx + 0x3f50]
add eax, 0xbed
mov dword [ebp - 0x1c], edx
cmp dword [ecx + eax*8], edx
lea eax, [ecx + eax*8]
je 0x406c9a
movsx eax, word [ecx + 0x5f64]
inc eax
cdq
idiv dword [ebp - 0x10]
movzx eax, dx
mov edx, dword [ebp - 0x1c]
mov word [ecx + 0x5f64], ax
cwde
add eax, 0xbed
lea eax, [ecx + eax*8]
mov dword [eax], edx
xor edx, edx
mov dword [eax + 4], edx
inc word [eax + 6]
inc dword [ecx + 0x5f60]
push edi
call esi
add esp, 4
mov dword [ebx + 0x4dd0], 0
mov edi, dword [ebx + 0x4ddc]
test edi, edi
je 0x406d3c
mov ecx, dword [0x43b4a8]
mov dword [ebx + 0x4dd8], 0
mov dword [ebx + 0x4dd4], 0
test ecx, ecx
je 0x406d2c
movsx eax, word [ecx + 0x5f64]
mov edx, dword [ecx + 0x3f50]
add eax, 0xbed
mov dword [ebp - 0x1c], edx
cmp dword [ecx + eax*8], edx
lea eax, [ecx + eax*8]
je 0x406d22
movsx eax, word [ecx + 0x5f64]
inc eax
cdq
idiv dword [ebp - 0x10]
movzx eax, dx
mov edx, dword [ebp - 0x1c]
mov word [ecx + 0x5f64], ax
cwde
add eax, 0xbed
lea eax, [ecx + eax*8]
mov dword [eax], edx
xor edx, edx
mov dword [eax + 4], edx
inc word [eax + 6]
inc dword [ecx + 0x5f60]
push edi
call esi
add esp, 4
mov dword [ebx + 0x4ddc], 0
xor edi, edi
lea eax, [ebx + 0x4d50]
mov dword [ebp - 0x14], eax
cmp dword [ebx + 0x4d48], edi
jle 0x406d74
xor esi, esi
mov ecx, dword [eax]
add ecx, esi
call fcn.00402260
inc edi
lea eax, [ebx + 0x4d50]
add esi, 0x1c
cmp edi, dword [ebx + 0x4d48]
jl 0x406d51
lea eax, [ebx + 0x4d50]
jmp 0x406d77
mov dword [ebp - 0x14], eax
mov esi, dword [eax]
test esi, esi
je 0x406df3
mov ecx, dword [0x43b4a8]
mov dword [ebx + 0x4d4c], 0
mov dword [ebx + 0x4d48], 0
test ecx, ecx
je 0x406de0
movsx edx, word [ecx + 0x5f64]
lea eax, [ecx + 0x5f68]
mov edi, dword [ecx + 0x3f50]
lea eax, [eax + edx*8]
cmp dword [eax], edi
je 0x406dd6
lea eax, [edx + 1]
cdq
idiv dword [ebp - 0x10]
movzx eax, dx
mov word [ecx + 0x5f64], ax
cwde
add eax, 0xbed
xor edx, edx
lea eax, [ecx + eax*8]
mov dword [eax], edi
mov dword [eax + 4], edx
inc word [eax + 6]
inc dword [ecx + 0x5f60]
push esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov eax, dword [ebp - 0x14]
add esp, 4
mov dword [eax], 0
lea ecx, [ebx + 0x4d6c]
call fcn.0041a990
xor edi, edi
cmp dword [ebx + 0x4d60], edi
jle 0x406e29
xor esi, esi
nop word [eax + eax]
mov ecx, dword [ebx + 0x4d68]
add ecx, esi
call fcn.0041b5a0
inc edi
add esi, 0x78
cmp edi, dword [ebx + 0x4d60]
jl 0x406e10
mov esi, dword [ebx + 0x4d68]
test esi, esi
je 0x406eae
mov ecx, dword [0x43b4a8]
mov dword [ebx + 0x4d64], 0
mov dword [ebx + 0x4d60], 0
test ecx, ecx
je 0x406e96
movsx edx, word [ecx + 0x5f64]
lea eax, [ecx + 0x5f68]
mov edi, dword [ecx + 0x3f50]
lea eax, [eax + edx*8]
cmp dword [eax], edi
je 0x406e8c
lea eax, [edx + 1]
cdq
idiv dword [ebp - 0x10]
movzx eax, dx
mov word [ecx + 0x5f64], ax
cwde
add eax, 0xbed
xor edx, edx
lea eax, [ecx + eax*8]
mov dword [eax], edi
mov dword [eax + 4], edx
inc word [eax + 6]
inc dword [ecx + 0x5f60]
push esi
mov esi, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
call esi
add esp, 4
mov dword [ebx + 0x4d68], 0
jmp 0x406eb4
mov esi, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
lea ecx, [ebx + 0x4d98]
call fcn.00401d30
lea ecx, [ebx + 0x5da0]
call fcn.00401d30
lea ecx, [ebx + 0x5dac]
call fcn.00401d30
lea ecx, [ebx + 0x4e18]
call fcn.00401d30
lea ecx, [ebx + 0x4e24]
call fcn.00401d30
lea ecx, [ebx + 0x4e30]
call fcn.00401d30
lea ecx, [ebx + 0x5c90]
mov dword [ebx + 0x5c8c], 0
call fcn.00401d30
lea ecx, [ebx + 0x5e58]
call fcn.00401d30
mov eax, dword [ebx + 0x5e54]
mov dword [ebp - 0x1c], eax
test eax, eax
je 0x406f99
mov ecx, dword [0x43b4a8]
mov dword [ebx + 0x5e50], 0
mov dword [ebx + 0x5e4c], 0
test ecx, ecx
je 0x406f89
movsx edx, word [ecx + 0x5f64]
lea eax, [ecx + 0x5f68]
mov edi, dword [ecx + 0x3f50]
lea eax, [eax + edx*8]
cmp dword [eax], edi
je 0x406f7c
lea eax, [edx + 1]
cdq
idiv dword [ebp - 0x10]
movzx eax, dx
mov word [ecx + 0x5f64], ax
cwde
add eax, 0xbed
xor edx, edx
lea eax, [ecx + eax*8]
mov dword [eax], edi
mov dword [eax + 4], edx
inc word [eax + 6]
inc dword [ecx + 0x5f60]
mov eax, dword [ebp - 0x1c]
push eax
call esi
add esp, 4
mov dword [ebx + 0x5e54], 0
cmp dword [ebx + 0x5eac], 0
je 0x406fcb
mov esi, dword [ebx + 0x5eac]
push 1
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
cmp esi, eax
je 0x406fc1
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
mov dword [ebx + 0x5eac], 0
lea ecx, [ebx + 0x5eb0]
call fcn.00401d30
lea ecx, [ebx + 0x5edc]
call fcn.00401d30
lea ecx, [ebx + 0x5ee8]
call fcn.00401d30
mov dword [ebx + 0x5ef4], 0
mov byte [ebx], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret