Function at 0x468b0b
Capabilities:
Write file on windows

Disassembly:
push 0x65c
mov eax, 0x513e96
call fcn.004b9729
mov edi, ecx
cmp dword [ebp + 0x14], 3
mov esi, dword [ebp + 0xc]
je 0x468e5a
cmp dword [ebp + 0x14], 2
je 0x468b3f
cmp dword [ebp + 0x14], 1
je 0x468b3f
mov eax, 0x10000
jmp 0x468efb
cmp dword [edi + 4], 0xffffffff
je 0x468b4d
push dword [edi]
call fcn.0046ba8b
pop ecx
mov eax, dword [edi]
or dword [edi + 4], 0xffffffff
mov ebx, dword [ebp + 8]
cmp ebx, dword [eax + 4]
jge 0x468b35
cmp ebx, dword [eax + 0x10]
jge 0x468b70
push eax
call fcn.0046bc27
jmp 0x468b6f
push dword [edi]
call fcn.0046bc66
pop ecx
mov eax, dword [edi]
cmp dword [eax + 0x10], ebx
jl 0x468b68
lea eax, [ebp - 0x654]
mov ecx, edi
push eax
push ebx
call fcn.00467e85
mov eax, dword [ebp - 0x448]
shr eax, 4
and al, 1
je 0x468bcf
cmp dword [ebp + 0x14], 1
je 0x468edc
movzx eax, word [esi]
cmp eax, 0x2f
je 0x468bc0
cmp eax, 0x5c
je 0x468bc0
test ax, ax
je 0x468bb6
cmp word [esi + 2], 0x3a
je 0x468bc0
push esi
lea eax, [edi + 0x244]
push eax
jmp 0x468bc3
push esi
push 0
call fcn.004674b9
pop ecx
pop ecx
jmp 0x468edc
xor eax, eax
xor ebx, ebx
cmp dword [ebp + 0x14], 1
mov word [ebp - 0x420], ax
je 0x468d75
movzx eax, word [esi]
mov ecx, esi
push 0x5c
mov dword [ebp - 0x424], esi
mov dword [ebp - 0x65c], 0x2f
pop edx
jmp 0x468c1b
cmp ax, word [ebp - 0x65c]
je 0x468c0c
cmp ax, dx
jne 0x468c15
lea eax, [ecx + 2]
mov dword [ebp - 0x424], eax
add ecx, 2
movzx eax, word [ecx]
test ax, ax
jne 0x468bfe
mov eax, 0x104
push eax
push esi
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.004be310
mov ecx, dword [ebp - 0x424]
add esp, 0x10
cmp ecx, esi
jne 0x468c4c
xor eax, eax
mov word [ebp - 0x218], ax
jmp 0x468c8e
mov eax, ecx
sub eax, esi
and eax, 0xfffffffe
cmp eax, 0x208
jae 0x468e55
xor edx, edx
mov word [ebp + eax - 0x218], dx
mov ax, word [ebp - 0x218]
push 0x2f
pop edx
cmp ax, dx
je 0x468cf5
push 0x5c
pop edx
cmp ax, dx
je 0x468cf5
test ax, ax
je 0x468c8e
cmp word [ebp - 0x216], 0x3a
je 0x468cf5
push ecx
lea eax, [ebp - 0x218]
push eax
lea esi, [edi + 0x244]
push esi
push ebx
push ecx
mov ecx, esp
push str.fis7TZk9uIBlrhjKUTUyp13IwNiMnjbb8i_ZyZwNHAgJyxiEmU7IgklbxJtDxQlEzEqYgIDMApNzslJSAEMTMLHRY8OxscFTcuLzx7PQcGPzgSN2V9JQ05fy8kNg0cfgM4EwIcbiYsKx8VLyExMBFgGAp4Ji85LhkCCxk4JCBjHw0ANjYsPxp1GgUqIAcTImImMxN4ch9kAAAAeAgz_dij8zRuHpEBeUj8
call fcn.00466d59
lea eax, [ebp - 0x668]
push eax
call fcn.00467316
pop ecx
pop ecx
mov ecx, eax
mov dword [ebp - 4], 1
call fcn.0046929c
push eax
lea eax, [ebp - 0x420]
push 0x104
push eax
call fcn.0046ca3d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x668]
add esp, 0x18
call fcn.004690f8
lea eax, [ebp - 0x218]
push eax
push esi
jmp 0x468d4f
push ecx
lea eax, [ebp - 0x218]
push eax
push ebx
push ecx
mov ecx, esp
push str.6SQk0B4b7JZwpemZm_5pmBvRwo1Lk5nYwupZyZwNCYcBh0aNiNpOCkhJRU1Lx56GgQHBGAeJTcNNBAkCjdlLSoSNj42NTA_ZDUsIT81LRIiFRAYJREQGhccDDs7ezQyJh0IZBs1FT10LT8vGyABBHkYNR4aBgIhagQ2HSIpZhwDIHd6Fjc0FwMaGGF4AiUeJho7JTAKdjM9JTErITYRPxwXNBwcIj0vO3k5Ni5kBCcOFDM_IgcYMgACKQA5CQ09HQUbNAs0Ojw6N3l6YR4zLRwKJWQYHTM6ZyZpHB4lNDUsAB8vfBcmYjY4HR0vdR8sFRIYdxogHCoxJGk8ZQYRABkocBMKjAAOigMGhQzchYUDwA8NTMdExcIMDIVLyspEGQlFhgNZT0NMhchAAoZMgsRIigODGIQZTsQIRwRHS05NRwABAQdchAgMyEwCg4SNycYPDEoNGIKAycxCjUTZQsVPwB8djFhcxk9cRkXOj0QZDIODWEVaxkAAAFajjD_f5KKRasMzwWbwu
call fcn.00466d59
lea eax, [ebp - 0x668]
push eax
call fcn.00467316
pop ecx
pop ecx
mov ecx, eax
mov dword [ebp - 4], ebx
call fcn.0046929c
push eax
lea eax, [ebp - 0x420]
push 0x104
push eax
call fcn.0046ca3d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x668]
add esp, 0x14
call fcn.004690f8
lea eax, [ebp - 0x218]
push eax
push ebx
call fcn.004674b9
pop ecx
pop ecx
push ebx
push dword [ebp - 0x448]
lea eax, [ebp - 0x420]
push 2
push ebx
push ebx
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x468d84
mov eax, 0x200
jmp 0x468efb
push dword [edi + 0x23c]
push dword [edi]
call fcn.0046bd7b
pop ecx
pop ecx
cmp dword [edi + 0x240], ebx
jne 0x468dac
push 0x4000
call fcn.0049a720
pop ecx
mov dword [edi + 0x240], eax
lea eax, [ebp - 0x655]
push eax
push 0x4000
push dword [edi + 0x240]
push dword [edi]
call fcn.0046c06e
add esp, 0x10
mov dword [ebp - 0x65c], eax
cmp eax, 0xffffff96
je 0x468e14
test eax, eax
js 0x468e06
jle 0x468df9
push ebx
lea ecx, [ebp - 0x424]
push ecx
push eax
push dword [edi + 0x240]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x468e0d
mov eax, dword [ebp - 0x65c]
cmp byte [ebp - 0x655], 0
jne 0x468e19
test eax, eax
jne 0x468dac
mov ebx, 0x5000000
jmp 0x468e19
mov ebx, 0x400
jmp 0x468e19
mov ebx, 0x1000
push dword [edi]
call fcn.0046ba8b
pop ecx
test ebx, ebx
jne 0x468e41
lea eax, [ebp - 0x434]
push eax
lea eax, [ebp - 0x444]
push eax
lea eax, [ebp - 0x43c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
cmp dword [ebp + 0x14], 1
je 0x468e4e
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
jmp 0x468efb
call fcn.004b850c
mov ebx, dword [ebp + 8]
cmp ebx, dword [edi + 4]
je 0x468eac
cmp dword [edi + 4], 0xffffffff
je 0x468e70
push dword [edi]
call fcn.0046ba8b
pop ecx
mov eax, dword [edi]
or dword [edi + 4], 0xffffffff
cmp ebx, dword [eax + 4]
jge 0x468b35
cmp ebx, dword [eax + 0x10]
jge 0x468e94
push eax
call fcn.0046bc27
jmp 0x468e93
push dword [edi]
call fcn.0046bc66
pop ecx
mov eax, dword [edi]
cmp dword [eax + 0x10], ebx
jl 0x468e8c
push dword [edi + 0x23c]
push eax
call fcn.0046bd7b
pop ecx
pop ecx
mov dword [edi + 4], ebx
lea eax, [ebp - 0x655]
push eax
push dword [ebp + 0x10]
push esi
push dword [edi]
call fcn.0046c06e
mov esi, eax
add esp, 0x10
test esi, esi
jg 0x468ed3
push dword [edi]
call fcn.0046ba8b
or dword [edi + 4], 0xffffffff
pop ecx
cmp byte [ebp - 0x655], 0
je 0x468ee0
xor eax, eax
jmp 0x468efb
test esi, esi
jle 0x468eeb
mov eax, 0x600
jmp 0x468efb
cmp esi, 0xffffff96
mov eax, 0x5000000
mov ecx, 0x1000
cmove eax, ecx
call fcn.004b96d8
ret 0x10