Function at 0x403260
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x413cd4
mov eax, dword fs:[0]
push eax
sub esp, 0x70
push ebx
push esi
push edi
mov eax, dword [0x41e130]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x2c], esi
mov eax, dword [esi + 0xdc]
neg eax
sbb eax, eax
add eax, 2
cmp dword [esi + 0x58], 0
movzx ecx, ax
jne 0x4032ae
cmp dword [esi + 0x5c], 0
mov eax, 2
je 0x4032b3
mov eax, 1
lea edx, [eax*4]
or edx, ecx
lea ecx, [ebp - 0x54]
movzx edi, dx
call dword [sym.imp.Common.dll_public:_void___thiscall_CTXCommPack::constructor_void_]
mov ebx, dword [sym.imp.Common.dll_public:_int___thiscall_CTXCommPack::AddByte_unsigned_char_]
push 1
lea ecx, [ebp - 0x54]
mov dword [ebp - 4], 0
call ebx
push 2
lea ecx, [ebp - 0x54]
call ebx
push 1
push edi
lea ecx, [ebp - 0x54]
call dword [sym.imp.Common.dll_public:_int___thiscall_CTXCommPack::AddWord_unsigned_short_int__int_]
mov eax, dword [esi + 0x110]
or eax, dword [esi + 0x114]
jne 0x403315
mov ecx, dword [esi + 0x118]
mov edx, dword [esi + 0x11c]
mov dword [esi + 0x110], ecx
mov dword [esi + 0x114], edx
mov eax, dword [esi + 0x108]
or eax, dword [esi + 0x10c]
jne 0x40333b
mov ecx, dword [esi + 0x110]
mov edx, dword [esi + 0x114]
mov dword [esi + 0x108], ecx
mov dword [esi + 0x10c], edx
mov eax, dword [esi + 0x100]
or eax, dword [esi + 0x104]
jne 0x403361
mov ecx, dword [esi + 0x108]
mov edx, dword [esi + 0x10c]
mov dword [esi + 0x100], ecx
mov dword [esi + 0x104], edx
mov ecx, dword [esi + 0xf8]
or ecx, dword [esi + 0xfc]
lea eax, [esi + 0xf8]
jne 0x403386
mov edx, dword [esi + 0x100]
mov ecx, dword [esi + 0x104]
mov dword [eax], edx
mov dword [eax + 4], ecx
mov esi, 2
mov dword [ebp - 0x18], eax
jmp 0x403393
mov eax, dword [ebp - 0x18]
mov edi, dword [eax + 8]
sub edi, dword [eax]
jns 0x40339c
xor edi, edi
push edi
lea edx, [esi - 1]
push edx
push 0x417178
push str.StorageTool
push 2
push str.func
push 0x169
push str.file
call fcn.00402c30
add esp, 0x20
push esi
lea ecx, [ebp - 0x54]
call ebx
push 2
lea ecx, [ebp - 0x54]
call ebx
push 1
push edi
lea ecx, [ebp - 0x54]
call dword [sym.imp.Common.dll_public:_int___thiscall_CTXCommPack::AddWord_unsigned_short_int__int_]
add dword [ebp - 0x18], 8
add esi, 1
cmp esi, 5
jle 0x403390
call dword [sym.imp.Common.dll_void___cdecl_TXLog::FlushLog_void_]
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], ebx
lea ecx, [ebp - 0x7c]
mov byte [ebp - 4], 2
call dword [sym.imp.Common.dll_public:_void___thiscall_CTXCommPack::constructor_void_]
mov esi, dword [sym.imp.Common.dll_public:_int___thiscall_CTXCommPack::GetBufferOut_class_CTXBuffer__]
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], 3
call esi
push 2
lea ecx, [ebp - 0x14]
push ecx
push 0x30005002
lea ecx, [ebp - 0x7c]
call dword [sym.imp.Common.dll_public:_int___thiscall_CTXCommPack::AddTLV_unsigned_long_int__class_CTXBuffer_const___enum_TXCommPackDataType_]
lea edx, [ebp - 0x10]
push edx
lea ecx, [ebp - 0x7c]
call esi
lea eax, [ebp - 0x24]
push eax
call fcn.00412740
push str.TencentQQDR8BEC1F8C_3230_4d11_BA13_922AF73D228B.dr
push eax
lea ecx, [ebp - 0x20]
push ecx
mov byte [ebp - 4], 4
call dword [sym.imp.Common.dll_class_CTXStringW___cdecl_operator_class_CTXStringW_const___wchar_t_const__]
add esp, 0x10
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 6
call dword [sym.imp.Common.dll_public:_void___thiscall_CTXStringW::destructor_void_]
push ebx
push 0x80
push 2
push ebx
push ebx
push 0xc0000000
lea ecx, [ebp - 0x20]
call dword [sym.imp.Common.dll_public:_wchar_t_const____thiscall_CTXStringW::operator_wchar_t_const__void_const]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x4034db
mov eax, dword [ebp - 0x10]
cmp eax, ebx
mov dword [ebp - 0x28], ebx
jne 0x403497
xor edi, edi
xor eax, eax
jmp 0x4034c6
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], ebx
mov edx, dword [eax]
mov edx, dword [edx + 0x34]
push ecx
push eax
call edx
mov eax, dword [ebp - 0x10]
cmp eax, ebx
mov edi, dword [ebp - 0x18]
jne 0x4034b4
xor eax, eax
jmp 0x4034c6
lea edx, [ebp - 0x1c]
mov dword [ebp - 0x1c], ebx
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x30]
call eax
mov eax, dword [ebp - 0x1c]
push ebx
lea ecx, [ebp - 0x28]
push ecx
push edi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x2c]
cmp dword [esi + 0x64], ebx
mov eax, 0x3f
je 0x4034ed
mov eax, 0x3e
cmp dword [esi + 0x68], ebx
je 0x4034f7
and eax, 0xfffd
cmp dword [esi + 0x58], ebx
je 0x403501
and eax, 0xfffb
cmp dword [esi + 0x6c], ebx
je 0x40352a
mov ecx, dword [esi + 0x54]
cmp ecx, 0xfffffffd
je 0x403525
cmp ecx, 0xffffffff
je 0x40351e
cmp ecx, ebx
jne 0x40352a
and eax, 0xffdf
jmp 0x40352a
and eax, 0xffef
jmp 0x40352a
and eax, 0xfff7
mov ecx, dword [esi + 0x54]
add ecx, 3
cmp ecx, 5
ja case.default.0x403535
jmp dword [ecx*4 + 0x4035e4]
or eax, 0x40
jmp case.default.0x403535
or eax, 0x80
jmp case.default.0x403535
or eax, 0xc0
jmp case.default.0x403535
or eax, 0x100
jmp case.default.0x403535
or eax, 0x140
push 0x8c004010
push eax
call fcn.00402fe0
movzx edx, word [esi + 0x120]
push 0x8c004012
push edx
call fcn.00402fe0
add esp, 0x10
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 3
call dword [sym.imp.Common.dll_public:_void___thiscall_CTXStringW::destructor_void_]
mov esi, dword [sym.imp.Common.dll_public_virtual:_void___thiscall_CTXCommPack::destructor_void_]
lea ecx, [ebp - 0x7c]
mov byte [ebp - 4], 2
call esi
mov eax, dword [ebp - 0x14]
cmp eax, ebx
mov byte [ebp - 4], 1
je 0x4035ad
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov dword [ebp - 0x14], ebx
mov eax, dword [ebp - 0x10]
cmp eax, ebx
mov byte [ebp - 4], 0
je 0x4035c3
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov dword [ebp - 0x10], ebx
lea ecx, [ebp - 0x54]
mov dword [ebp - 4], 0xffffffff
call esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret