Function at 0x42843c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 4], ebx
mov dword [ebp - 8], edi
mov dword [ebp - 0xc], esi
mov edi, ecx
mov esi, edx
mov ebx, eax
test ebx, ebx
je 0x4288de
mov ecx, dword [ebx + 0xd4]
movzx eax, byte [ebx + 0x160]
movzx edx, byte [ebx + 0x161]
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebx + 0x130]
and eax, 0x80
shr eax, 7
mov dword [ebp - 0x18], eax
and edx, 1
xor eax, eax
mov dword [ebp - 0x1c], edx
mov dword [ebx + 0xc0], eax
mov dword [ebx + 0xc4], eax
mov dword [ebx + 0xe0], eax
test edi, edi
jne 0x428547
test ebx, ebx
je 0x4287f8
test byte [ebx + 0x15d], 4
jne 0x4284cc
xor eax, eax
mov dword [ebx + 0xa0], eax
mov dword [ebx + 0xa4], eax
mov ecx, 1
jmp 0x4287e9
lea eax, [ebp - 0x14]
push 0
push eax
mov edx, dword [ebx + 0x38]
mov esi, dword [ebx + 0x40]
sub esi, edx
push esi
push edx
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, eax
mov eax, dword [ebx + 0x38]
mov edx, dword [ebx + 0xe8]
and byte [ebx + 0x15d], 0xfb
xor edi, edi
test ecx, ecx
mov dword [ebx + 0x40], edi
mov dword [ebx + 0x3c], eax
mov dword [ebx + 0xa0], edi
mov dword [ebx + 0xa4], edi
jne 0x428514
mov ecx, 0xffffffff
add edx, eax
mov dword [ebx + 0x44], edx
mov eax, esi
cdq
mov eax, dword [ebx + 0xb8]
add esi, eax
adc edx, dword [ebx + 0xbc]
mov dword [ebx + 0xb8], esi
mov dword [ebx + 0xb0], esi
mov dword [ebx + 0xbc], edx
mov dword [ebx + 0xb4], edx
jmp 0x4287e9
test ebx, ebx
je 0x4285c3
mov eax, dword [ebx + 0x40]
mov dword [ebp - 0x20], eax
test eax, eax
je 0x4285c3
cmp esi, dword [ebp - 0x20]
je 0x4285c3
mov edx, eax
mov eax, dword [ebx + 0x38]
sub edx, eax
mov dword [ebp - 0x20], edx
je 0x4285c3
lea edx, [ebp - 0x14]
push 0
mov dword [ebp - 0x24], ecx
push edx
push dword [ebp - 0x20]
push eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 0x24]
test eax, eax
jne 0x42859b
xor eax, eax
mov dword [ebx + 0xa0], eax
mov dword [ebx + 0xa4], eax
mov ecx, 0xffffffff
jmp 0x4287e9
mov eax, dword [ebp - 0x20]
cdq
add eax, dword [ebx + 0xb8]
adc edx, dword [ebx + 0xbc]
mov dword [ebx + 0xb8], eax
mov dword [ebx + 0xb0], eax
mov dword [ebx + 0xbc], edx
mov dword [ebx + 0xb4], edx
cmp dword [0x53a7a0], 0
je 0x428666
test ecx, ecx
jne 0x4285db
mov ecx, 0xffffffff
jmp 0x42864b
cmp dword [ebp - 0x18], 0
je 0x4285ea
cmp ecx, 0xfffffffa
je 0x428889
cmp ecx, 2
je 0x4285f4
cmp ecx, 1
jne 0x42860e
call fcn.004bab10
mov dword [ebp - 0x24], eax
cmp dword [0x53a7a0], 0
je 0x428631
mov dword [ebp - 0x20], 1
jmp 0x428616
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x18], 0
je 0x42862b
cmp dword [ebp - 0x1c], 0
je 0x42862b
push dword [ebp - 0x24]
call fcn.004ba880
pop ecx
cmp dword [ebp - 0x20], 0
je 0x428666
push 0
push dword [ebp - 0x24]
push edi
push esi
call fcn.004ba8e0
add esp, 0x10
mov ecx, eax
cmp ecx, edi
je 0x42864b
mov ecx, 0xffffffff
test ebx, ebx
je 0x4287e9
xor edx, edx
mov dword [ebx + 0xa0], edx
mov dword [ebx + 0xa4], edx
jmp 0x4287e9
test ebx, ebx
je 0x4286cc
test byte [ebx + 0x161], 0x40
jne 0x428678
mov edx, dword [ebx + 0x40]
jmp 0x4286b7
test byte [ebx + 0x15f], 1
je 0x428686
mov edx, dword [ebx + 0x40]
jmp 0x4286b7
mov eax, dword [ebx + 0x38]
mov edx, dword [ebx + 0x40]
cmp esi, eax
je 0x428694
cmp esi, edx
jne 0x4286c2
add eax, dword [ebx + 0xdc]
mov ecx, dword [ebx + 0x3c]
mov dword [ebp - 0x1c], edi
mov edi, dword [ebx + 0xe8]
mov dword [ebp - 0x24], edi
lea ecx, [ecx + edi*2]
cmp eax, ecx
mov edi, dword [ebp - 0x1c]
ja 0x4287b5
cmp esi, edx
jne 0x4286c2
mov esi, dword [ebx + 0x38]
add edi, edx
sub edi, esi
mov eax, dword [ebx + 0x12c]
test eax, eax
jne 0x4286d1
mov eax, 0x20000
cmp edi, eax
jbe 0x428731
mov ecx, edi
test ebx, ebx
je 0x4286e5
mov edx, dword [ebx + 0x12c]
test edx, edx
jne 0x4286ea
mov edx, 0x20000
mov dword [ebp - 0x20], ecx
mov eax, esi
mov dword [ebp - 0x1c], edi
mov edi, dword [ebp - 0x10]
mov dword [ebp - 0x24], esi
mov esi, edx
mov dword [ebp - 0x18], ebx
mov ebx, eax
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
cmp edi, eax
je 0x428846
lea ecx, [ebp - 0x14]
push 0
push ecx
push esi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, eax
cmp ecx, 1
je 0x4287ff
mov edi, dword [ebp - 0x1c]
mov ebx, dword [ebp - 0x18]
jmp 0x428755
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
cmp eax, dword [ebp - 0x10]
je 0x42889b
lea eax, [ebp - 0x14]
push 0
push eax
push edi
push esi
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, eax
test ecx, ecx
jne 0x42875e
mov ecx, 0xffffffff
test ebx, ebx
je 0x4287e9
mov edx, dword [ebx + 0x38]
add edx, dword [ebx + 0xe8]
xor esi, esi
mov dword [ebx + 0x40], esi
mov dword [ebx + 0x44], edx
and byte [ebx + 0x15d], 0xfb
mov eax, edi
cdq
mov eax, dword [ebx + 0xb8]
add edi, eax
adc edx, dword [ebx + 0xbc]
mov dword [ebx + 0xb8], edi
mov dword [ebx + 0xb0], edi
mov dword [ebx + 0xbc], edx
mov dword [ebx + 0xb4], edx
mov dword [ebx + 0xa0], esi
mov dword [ebx + 0xa4], esi
jmp 0x4287e9
mov ecx, dword [ebp - 0x24]
or byte [ebx + 0x15d], 4
add esi, edi
mov dword [ebx + 0x40], esi
add dword [ebx + 0x44], ecx
mov eax, edi
cdq
add dword [ebx + 0xb0], edi
adc dword [ebx + 0xb4], edx
xor esi, esi
mov dword [ebx + 0xa0], esi
mov dword [ebx + 0xa4], esi
mov ecx, 1
mov ebx, dword [ebp - 4]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 8]
mov eax, ecx
mov esp, ebp
pop ebp
ret
mov ecx, 1
jmp 0x4287e9
mov eax, dword [ebp - 0x14]
sub dword [ebp - 0x20], eax
add ebx, eax
cmp dword [ebp - 0x18], 0
je 0x42881a
mov edx, dword [ebp - 0x18]
mov edx, dword [edx + 0x12c]
test edx, edx
jne 0x42881f
mov edx, 0x20000
cmp edx, dword [ebp - 0x20]
jb 0x42882d
mov esi, dword [ebp - 0x20]
test esi, esi
jne 0x428833
jmp 0x42883b
cmp dword [ebp - 0x20], 0
je 0x42883b
test eax, eax
ja 0x4286ff
mov edi, dword [ebp - 0x1c]
mov ebx, dword [ebp - 0x18]
jmp 0x42875e
push edi
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 2
jne 0x42870f
push esi
push ebx
push 1
call fcn.004645b0
add esp, 0xc
cmp eax, 0xffffffff
je 0x428871
mov dword [ebp - 0x14], eax
mov ecx, 1
jmp 0x428802
lea ecx, [ebp - 0x14]
push 0
push ecx
push dword [ebp - 0x1c]
push dword [ebp - 0x24]
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x42871e
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x24], eax
jmp 0x42861c
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 2
jne 0x428742
push edi
push esi
push 1
call fcn.004645b0
add esp, 0xc
cmp eax, 0xffffffff
je 0x4288c8
mov ecx, 1
jmp 0x42875e
lea eax, [ebp - 0x14]
push 0
push eax
push edi
push esi
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x428753
cmp dword [0x53a7a0], 0
jne 0x428907
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [ebp - 0x10], eax
mov eax, dword [0x53a7a0]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], eax
mov ecx, 1
jmp 0x42849b
call fcn.004bab10
jmp 0x4288ef