Function at 0x4326c0
Capabilities:
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x5d29a0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x50
push ebx
push ebp
push esi
push edi
mov edi, ecx
lea ecx, [esp + 0x10]
mov dword [esp + 0x14], edi
lea eax, [edi + 0x20]
push eax
call fcn.005b44ce
mov ecx, dword [esp + 0x10]
xor ebx, ebx
mov dword [esp + 0x68], ebx
cmp dword [ecx - 8], ebx
jne 0x43270a
mov ecx, edi
call fcn.004329e0
jmp 0x43297f
mov ecx, 0x87f5b8
call fcn.00596130
push ebx
push ebx
mov ecx, 0x87f5b8
call fcn.00593890
mov esi, eax
push esi
call fcn.005b449a
mov ebp, eax
add esp, 4
cmp ebp, ebx
je 0x43297f
push esi
push ebp
mov ecx, 0x87f5b8
call fcn.00593890
mov ecx, 0x87f5b8
call fcn.00596140
lea ecx, [esp + 0x28]
call fcn.00419f90
lea ecx, [esp + 0x34]
mov byte [esp + 0x68], 1
call fcn.00419f90
mov dword [esp + 0x40], ebx
mov dword [esp + 0x44], 1
mov dword [esp + 0x48], ebx
mov dword [esp + 0x4c], ebx
push 0x20
lea ecx, [esp + 0x58]
mov byte [esp + 0x6c], 2
mov dword [esp + 0x5c], ebx
mov dword [esp + 0x60], ebx
mov dword [esp + 0x58], ebx
call fcn.0041b410
push str.UTF_8
lea ecx, [esp + 0x58]
mov byte [esp + 0x6c], 3
mov dword [esp + 0x48], ebx
mov dword [esp + 0x54], ebx
call fcn.0041a280
cmp esi, 4
mov byte [esp + 0x68], 4
jb 0x43285b
lea ecx, [esp + 0x28]
call fcn.0041ba00
push 0x190
call fcn.005b449a
add esp, 4
mov dword [esp + 0x24], eax
mov dword [esp + 0x1c], 0x64
mov dword [esp + 0x20], ebx
lea edx, [esp + 0x28]
lea ecx, [esp + 0x1c]
push edx
mov byte [esp + 0x6c], 5
call fcn.0041c350
mov ax, word [ebp]
xor edi, edi
and eax, 0xfefe
cmp eax, 0xfefe
jne 0x43280d
mov edi, 2
jmp 0x432824
cmp byte [ebp], 0xef
jne 0x432824
cmp byte [ebp + 1], 0xbb
jne 0x432824
cmp byte [ebp + 2], 0xbf
jne 0x432824
mov edi, 3
cmp edi, esi
jae 0x432845
mov edx, esi
lea ecx, [esp + 0x1c]
sub edx, edi
push ecx
lea eax, [edi + ebp]
push edx
push eax
lea ecx, [esp + 0x34]
call fcn.0041bbd0
add edi, eax
cmp edi, esi
jb 0x432828
mov ecx, dword [esp + 0x24]
mov byte [esp + 0x68], 4
push ecx
call fcn.005b44c3
mov edi, dword [esp + 0x18]
add esp, 4
push ebp
call fcn.005b44c3
add esp, 4
lea ebp, [edi + 0x58]
lea edx, [esp + 0x28]
mov ecx, ebp
push edx
call fcn.0054b410
mov ecx, ebp
call fcn.00557190
mov edi, eax
push edi
call fcn.005b449a
mov esi, eax
add esp, 4
cmp esi, ebx
jne 0x4328a8
lea ecx, [esp + 0x28]
mov byte [esp + 0x68], 7
call fcn.0041ba00
mov eax, dword [esp + 0x54]
mov byte [esp + 0x68], 6
push eax
jmp 0x43296a
push edi
push esi
mov ecx, ebp
call fcn.0055dd50
mov ecx, dword [esp + 0x10]
push ebx
push ebx
push 2
mov eax, dword [ecx - 8]
push ebx
push ebx
push 0xc0000000
push eax
lea ecx, [esp + 0x2c]
call fcn.005b4ba6
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebp, eax
cmp ebp, ebx
je 0x4328f4
lea edx, [esp + 0x18]
push ebx
push edx
push edi
push esi
push ebp
mov dword [esp + 0x2c], ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call fcn.005b44c3
mov eax, dword [esp + 0x18]
add esp, 4
mov dword [eax + 0x55c], ebx
mov ecx, dword [esp + 0x4c]
mov byte [esp + 0x68], 9
cmp ecx, ebx
je 0x43292b
call fcn.0049c460
cmp eax, ebx
je 0x43292b
push eax
lea ecx, [esp + 0x2c]
call fcn.0043e200
cmp eax, ebx
jne 0x43291d
lea ecx, [esp + 0x28]
call fcn.0043e280
cmp eax, ebx
je 0x432946
mov ecx, dword [esp + 0x48]
push eax
call fcn.0041e6a0
cmp eax, ebx
jne 0x432938
push str.UTF_8
lea ecx, [esp + 0x58]
mov dword [esp + 0x48], ebx
mov dword [esp + 0x54], 1
call fcn.0041a280
mov ecx, dword [esp + 0x54]
mov byte [esp + 0x68], 8
push ecx
call fcn.005b44c3
add esp, 4
lea ecx, [esp + 0x28]
mov byte [esp + 0x68], bl
call fcn.0041b790
lea ecx, [esp + 0x10]
mov dword [esp + 0x68], 0xffffffff
call fcn.005b4761
mov ecx, dword [esp + 0x60]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x5c
ret