Function at 0x421d0b
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x28
mov dword [ebp - 0x10], 0xd84d8ba6
mov esi, dword [ebp - 0x34]
xor edi, edi
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 0x10]
cmp eax, 0x21397d2
jg 0x421d74
cmp eax, 0xc477d7be
jg 0x421ddf
cmp eax, 0x9e8b0306
jle 0x421e6a
cmp eax, 0xb4122f9f
jle 0x421f4d
cmp eax, 0xb4122fa0
je 0x42210e
cmp eax, 0xbdef6eaf
je 0x422122
cmp eax, 0xbe5659cb
je 0x4222fc
jmp 0x421d26
cmp eax, 0x27e595f8
jg 0x421e22
cmp eax, 0x14912e0e
jle 0x421e97
cmp eax, 0x17b292b0
jle 0x421fa7
cmp eax, 0x17b292b1
je 0x42213b
cmp eax, 0x198ecc9f
je 0x422158
cmp eax, 0x244fd0dd
jne 0x421d26
mov eax, esi
shr eax, 8
add eax, 0x18c
mov ecx, 0x10c0eff8
cmp esi, 0x16b400
jae 0x421dd2
mov ecx, 0x3c1bbca1
shr eax, 5
mov dword [ebp - 0x10], ecx
mov esi, eax
jmp 0x421d26
cmp eax, 0xce3864f6
jle 0x421ec4
cmp eax, 0xee355f58
jle 0x421ff1
cmp eax, 0xee355f59
je 0x42218c
cmp eax, 0xfc5c6eb7
je 0x4221b1
cmp eax, 0xfceca297
jne 0x421d26
mov dword [ebp - 0x10], 0x2a72de9c
jmp 0x421d26
cmp eax, 0x46bb92a0
jle 0x421f19
cmp eax, 0x5d07fa1c
jle 0x422019
cmp eax, 0x76530f7b
je 0x4221cf
cmp eax, 0x7983cfac
jne 0x422341
push 0
push dword [ebp - 0x1c]
push dword [ebp - 0x30]
push dword [ebp - 0x20]
push dword [ebp - 0x24]
call ebx
mov dword [ebp - 0x10], 0x5ac41d5c
jmp 0x421d26
cmp eax, 0x8b644bae
jg 0x422047
cmp eax, 0x802ad5a3
je 0x4221db
cmp eax, 0x82a9b641
jne 0x421d26
mov dword [ebp - 0x10], 0x7983cfac
jmp 0x421d26
cmp eax, 0xeffc43d
jg 0x422088
cmp eax, 0x21397d3
je 0x422201
cmp eax, 0x7e19442
jne 0x421d26
mov dword [ebp - 0x10], 0xbdef6eaf
jmp 0x421d26
cmp eax, 0xcb0f296f
jg 0x4220bd
cmp eax, 0xc477d7bf
je 0x422214
cmp eax, 0xca5ed588
jne 0x421d26
mov eax, dword [ebp - 0x14]
add eax, 0x7c
shr eax, 0xe
mov ecx, eax
imul ecx, eax
add eax, 0xffffff69
imul edx, ecx, 0x49c3
dec edx
mov dword [ebp - 0x14], eax
mov eax, 0x2a72de9c
cmp ecx, edx
je 0x4222c5
mov eax, 0x3c1bbca1
jmp 0x4222c5
cmp eax, 0x3c1bbca0
jg 0x4220e2
cmp eax, 0x27e595f9
je 0x422235
cmp eax, 0x2a72de9c
jne 0x421d26
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x10], 0x27e595f9
jmp 0x421d26
cmp eax, 0x9e8b0307
je 0x422241
cmp eax, 0xa80953d8
jne 0x421d26
imul esi, esi, 0x22ac0cb8
add esi, 0xc1b31b58
call fcn.00426974
push 0x51a9
push esi
push 0x5269
push 0x2398
call fcn.0041acc2
add esp, 0x10
mov eax, 0x3c1bbca1
cmp esi, 0x90
je 0x4222c5
mov eax, 0xeffc43e
jmp 0x4222c5
cmp eax, 0x14912e0f
je 0x422264
cmp eax, 0x15aeb714
jne 0x421d26
mov eax, dword [ebp - 0x14]
shr eax, 0xf
mov ecx, eax
shl ecx, 8
imul eax, eax
imul edx, eax, 0x6e67
dec edx
add ecx, 0xffffffb4
shr ecx, 0xe
mov dword [ebp - 0x14], ecx
mov ecx, 0xd84d8ba6
cmp edx, eax
je 0x421fe9
mov ecx, 0xcb0f2970
mov dword [ebp - 0x10], ecx
jmp 0x421d26
cmp eax, 0xce3864f7
je 0x42227e
cmp eax, 0xd84d8ba6
jne 0x421d26
push eax
mov eax, esp
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x10], 0x99b67fbc
jmp 0x421d26
cmp eax, 0x46bb92a1
je 0x422295
cmp eax, 0x5ac41d5c
jne 0x421d26
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x10], 0xce3864f7
jmp 0x421d26
cmp eax, 0x8b644baf
je 0x4222cd
cmp eax, 0x99b67fbc
jne 0x421d26
mov eax, dword [ebp - 0x14]
and eax, 0xffffff80
shl eax, 5
lea ecx, [eax + eax*4]
lea ecx, [eax + ecx*4]
add eax, ecx
add eax, 0xffffff52
shr eax, 4
and eax, 0xffffffe0
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 0xfceca297
jmp 0x421d26
cmp eax, 0xeffc43e
je 0x4222e2
cmp eax, 0x10c0eff8
jne 0x421d26
cmp dword [ebp - 0x20], 0
setne al
and al, byte [ebp - 0x15]
mov byte [ebp - 0x16], al
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x10], 0x76530f7b
jmp 0x421d26
cmp eax, 0xcb0f2970
je 0x422308
cmp eax, 0xcb21ae9c
jne 0x421d26
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x10], 0x8b644baf
jmp 0x421d26
cmp eax, 0x3c1bbca1
je 0x42232f
cmp eax, 0x3e942282
jne 0x421d26
mov eax, dword [ebp - 0x24]
cmp eax, 0xffffffff
setne byte [ebp - 0x15]
mov dword [ebp - 0x10], 0xca5ed588
jmp 0x421d26
cmp dword [ebp - 0x30], 0
setg byte [ebp - 0x17]
mov dword [ebp - 0x10], 0xee355f59
jmp 0x421d26
cmp dword [ebp - 0x20], 0
mov eax, 0x21397d3
je 0x4222c5
mov eax, 0xce3864f7
jmp 0x4222c5
mov eax, dword [ebp - 0x14]
shl eax, 0xb
add eax, 0xfff9c000
shr eax, 0xe
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 0x10c0eff8
jmp 0x421d26
imul esi, esi, 0x3f80
push 0x4375
push esi
push 0x2664
call fcn.0041b445
add esp, 0xc
mov eax, 0xa80953d8
cmp esi, 0xd5
jge 0x4222c5
mov eax, 0x46bb92a1
jmp 0x4222c5
mov cl, byte [ebp - 0x16]
cmp byte [ebp - 0x17], 0
mov eax, 0xcb21ae9c
jne 0x42219f
mov eax, 0x7e19442
test cl, cl
jne 0x4222c5
mov eax, 0x7e19442
jmp 0x4222c5
add esi, 0xfffffef3
mov eax, 0x10c0eff8
cmp esi, 0x5b
je 0x4222c5
mov eax, 0x802ad5a3
jmp 0x4222c5
mov dword [ebp - 0x10], 0xb4122fa0
jmp 0x421d26
mov dword [ebp - 0x28], 0
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x2c]
push eax
push dword [ebp + 8]
call fcn.004201c4
add esp, 0xc
mov dword [ebp - 0x10], 0x15aeb714
jmp 0x421d26
mov eax, dword [ebp - 0x14]
lea eax, [eax + eax*4]
shl eax, 0x11
add eax, 0x7800000
shr eax, 0xb
jmp 0x422226
mov eax, dword [ebp - 0x14]
shl eax, 0xe
add eax, 0xffffffc6
shr eax, 3
imul eax, eax, 0xc5
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 0x5d07fa1d
jmp 0x421d26
mov dword [ebp - 0x10], 0x802ad5a3
jmp 0x421d26
mov eax, dword [ebp - 0x14]
shr eax, 9
imul eax, eax, 0x4c000
add eax, 0xfb604000
shr eax, 2
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 0x82a9b641
jmp 0x421d26
add esi, 0x138
mov eax, 0x2a390ed0
cmp esi, 0x8c
je 0x4222c5
mov eax, 0xee355f59
jmp 0x4222c5
push dword [ebp - 0x20]
call fcn.0045d1bc
add esp, 4
mov dword [ebp - 0x10], 0xc477d7bf
jmp 0x421d26
shr esi, 8
add esi, 0xffffffec
push 0x430e
push 0x25e8
push 0x516a
push esi
call fcn.0041600f
add esp, 0x10
mov eax, 0xfc5c6eb7
cmp esi, 0xb9
jae 0x4222c5
mov eax, 0x244fd0dd
mov dword [ebp - 0x10], eax
jmp 0x421d26
mov eax, dword [ebp - 0x1c]
mov dword [eax], 0
mov dword [ebp - 0x10], 0x9e8b0307
jmp 0x421d26
imul esi, esi, 0x84e400
add esi, 0x695c
push 0x752
push esi
call fcn.00421d0b
add esp, 8
mov dword [ebp - 0x10], 0x3e942282
jmp 0x421d26
push edi
push 0x80
push 2
push edi
push edi
push 0x40000000
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x10], 0xbe5659cb
jmp 0x421d26
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x10], 0x17b292b1
jmp 0x421d26
cmp eax, 0x5d07fa1d
jne 0x421d26
mov dword [ebp - 0x34], esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret