Function at 0x406870
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4152b0
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
push esi
push edi
mov eax, dword [0x41b050]
xor eax, esp
push eax
lea eax, [esp + 0x58]
mov dword fs:[0], eax
mov eax, dword [ebx + 0x104c]
xor esi, esi
cmp eax, esi
je 0x406be1
mov ecx, dword [ebx + 0x1050]
sub ecx, eax
mov eax, 0x9ad70599
imul ecx
add edx, ecx
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x406be1
cmp byte [ebx + 0x1058], 0
je 0x406be1
lea eax, [ebx + 0xc20]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, si
jne 0x4068e2
sub eax, edx
sar eax, 1
je 0x406be1
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], esi
mov dword [esp + 0x60], esi
lea ecx, [esp + 0x14]
push ecx
lea eax, [ebx + 0xc20]
push eax
call fcn.00406610
xor edi, edi
mov dword [esp + 0xc], esi
mov edi, edi
mov eax, dword [ebx + 0x104c]
cmp eax, esi
je 0x4069e4
mov ecx, dword [ebx + 0x1050]
sub ecx, eax
mov eax, 0x9ad70599
imul ecx
add edx, ecx
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp edi, eax
jae 0x4069e4
mov eax, dword [ebx + 0x104c]
cmp eax, esi
je 0x40697a
mov ecx, dword [ebx + 0x1050]
sub ecx, eax
mov eax, 0x9ad70599
imul ecx
add edx, ecx
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp edi, eax
jb 0x40697f
call fcn.0040a917
mov edx, dword [ebx + 0x104c]
add edx, dword [esp + 0xc]
lea esi, [edx + 0x280]
mov eax, esi
lea ecx, [eax + 2]
mov dword [esp + 0x10], ecx
jmp 0x4069a0
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4069a0
sub eax, dword [esp + 0x10]
sar eax, 1
cmp byte [edx + 0x69c], cl
setne cl
add eax, 1
push ecx
push eax
push edx
mov edx, dword [edx + 0x698]
push edx
lea edx, [esp + 0x24]
mov ecx, esi
call fcn.004061a0
add dword [esp + 0xc], 0x69d
add edi, 1
xor esi, esi
jmp 0x406920
mov eax, dword [esp + 0x18]
cmp eax, esi
je 0x406a95
mov ecx, dword [esp + 0x1c]
sub ecx, eax
mov eax, 0x9ad70599
imul ecx
add edx, ecx
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x406a95
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], esi
mov byte [esp + 0x60], 1
lea eax, [esp + 0x34]
call fcn.004081e0
mov edi, dword [esp + 0x18]
cmp edi, esi
je 0x406a4c
mov ecx, dword [esp + 0x1c]
sub ecx, edi
mov eax, 0x9ad70599
imul ecx
add edx, ecx
sar edx, 0xa
mov esi, edx
shr esi, 0x1f
add esi, edx
jne 0x406a55
call fcn.0040a917
mov edi, dword [esp + 0x18]
lea ecx, [esp + 0x24]
push ecx
mov ecx, esi
imul ecx, ecx, 0x69d
lea edx, [esp + 0x38]
push edx
mov edx, edi
call fcn.00408260
test al, al
jne 0x406acc
mov byte [esp + 0x60], al
mov eax, dword [esp + 0x28]
xor esi, esi
cmp eax, esi
je 0x406a89
push eax
call fcn.0040a31e
add esp, 4
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], esi
mov dword [esp + 0x60], 0xffffffff
mov eax, dword [esp + 0x18]
cmp eax, esi
je 0x406aae
push eax
call fcn.0040a31e
add esp, 4
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], esi
mov ecx, dword [esp + 0x58]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x28]
xor edi, edi
cmp eax, edi
je 0x406ade
mov ecx, dword [esp + 0x2c]
sub ecx, eax
jne 0x406b37
mov byte [esp + 0x60], 0
mov eax, dword [esp + 0x28]
cmp eax, edi
je 0x406af4
push eax
call fcn.0040a31e
add esp, 4
mov dword [esp + 0x28], edi
mov dword [esp + 0x2c], edi
mov dword [esp + 0x30], edi
mov dword [esp + 0x60], 0xffffffff
mov eax, dword [esp + 0x18]
cmp eax, edi
je 0x406b19
push eax
call fcn.0040a31e
add esp, 4
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], edi
mov ecx, dword [esp + 0x58]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push edi
push 0x80
push 4
push edi
push edi
push 0x40000000
lea eax, [ebx + 0xc20]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
mov dword [esp + 0xc], esi
je 0x406bc2
push edi
push edi
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [esp + 0x24]
call fcn.00407890
test al, al
jne 0x406bad
mov ecx, dword [esp + 0x28]
cmp ecx, edi
mov dword [esp + 0x10], edi
jne 0x406b85
xor eax, eax
jmp 0x406b8b
mov eax, dword [esp + 0x2c]
sub eax, ecx
push edi
lea edx, [esp + 0x14]
push edx
push eax
xor edi, edi
lea esi, [esp + 0x30]
call fcn.00403480
push eax
mov eax, dword [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov esi, dword [esp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebx + 0x1058], 0
mov byte [esp + 0x60], 0
lea esi, [esp + 0x24]
call fcn.004033a0
mov dword [esp + 0x60], 0xffffffff
lea esi, [esp + 0x14]
call fcn.004033a0
mov ecx, dword [esp + 0x58]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret