Function at 0x405f77
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd94
push esi
push edi
push ebx
mov edx, edi
mov ecx, ebp
lea edi, [ebp - 0x26c]
sub ecx, edi
xor eax, eax
shr ecx, 2
rep stosd dword es:[edi], eax
mov edi, edx
mov dword [ebp - 0x26c], 0
lea eax, [ebp - 0x3c]
push eax
push esi
call fcn.00407634
or eax, eax
jne 0x405fb5
jmp 0x406227
mov esi, dword [ebp + 0xc]
add esi, dword [0x40b235]
inc esi
push str.Archive
lea eax, [ebp - 0x250]
push eax
call sub.KERNEL32.dll_lstrcpyA
push 0x40b239
lea eax, [ebp - 0x250]
push eax
call sub.KERNEL32.dll_lstrcatA
push esi
lea eax, [ebp - 0x250]
push eax
call sub.KERNEL32.dll_lstrcatA
mov esi, dword [ebp - 0x38]
mov edx, dword [ebp - 0x34]
or edx, edx
jne 0x406007
mov dword [ebp - 0x26c], 1
jmp 0x406227
mov dword [ebp - 0x264], 0
mov ecx, dword [ebp - 0x34]
cmp ecx, 0x3e8
jbe 0x406023
mov ecx, 0x3e8
jmp 0x406037
dec ecx
or ecx, ecx
jne 0x406037
mov dword [ebp - 0x26c], 1
jmp 0x406227
cmp byte [esi], 0
je 0x40605c
cmp byte [esi], 0x7f
jb 0x40604b
cmp byte [esi], 0x90
ja 0x40604b
jmp 0x406113
cmp byte [esi], 0x93
jb 0x406061
cmp byte [esi], 0x9f
ja 0x406061
jmp 0x406113
jmp 0x406113
dec ecx
or ecx, ecx
je 0x406069
inc esi
jmp 0x406037
mov esi, dword [ebp - 0x38]
cmp word [esi], 0x5a4d
jne 0x40607d
jmp 0x406113
cmp word [esi], 0x694d
jne 0x406097
push str.Microsoft
push esi
call sub.KERNEL32.dll_lstrcmpiA
or eax, eax
jne 0x406109
jmp 0x406113
cmp word [esi], 0xd8ff
jne 0x4060a2
jmp 0x406113
cmp word [esi], 0x4947
jne 0x4060ad
jmp 0x406113
cmp word [esi], 0xbbef
jne 0x4060b8
jmp 0x406113
cmp word [esi], 0x4d42
jne 0x4060c3
jmp 0x406113
cmp byte [esi], 0x20
jae 0x406109
cmp byte [esi + 1], 0x20
jae 0x406109
mov eax, 0
cmp byte [esi], 0xd
jne 0x4060db
inc eax
jmp 0x4060e9
cmp byte [esi], 0xa
jne 0x4060e3
inc eax
jmp 0x4060e9
cmp byte [esi], 9
jne 0x4060e9
inc eax
cmp byte [esi + 1], 0xd
jne 0x4060f2
inc eax
jmp 0x406102
cmp byte [esi + 1], 0xa
jne 0x4060fb
inc eax
jmp 0x406102
cmp byte [esi + 1], 9
jne 0x406102
inc eax
cmp eax, 2
je 0x406109
jmp 0x406113
mov dword [ebp - 0x264], 1
cmp dword [ebp - 0x264], 0
jbe 0x40612f
push 0x40b232
lea eax, [ebp - 0x250]
push eax
call sub.KERNEL32.dll_lstrcatA
jmp 0x406162
push 0x40b239
lea eax, [ebp - 0x250]
push eax
call sub.KERNEL32.dll_lstrcatA
push str.BINAIRE
lea eax, [ebp - 0x250]
push eax
call sub.KERNEL32.dll_lstrcatA
push 0x40b232
lea eax, [ebp - 0x250]
push eax
call sub.KERNEL32.dll_lstrcatA
lea eax, [ebp - 0x250]
push eax
call sub.KERNEL32.dll_lstrlenA
mov edx, eax
push 0
lea eax, [ebp - 0x268]
push eax
push edx
lea eax, [ebp - 0x250]
push eax
push dword [ebp + 8]
call sub.KERNEL32.dll_WriteFile
cmp dword [ebp - 0x264], 0
jne 0x40619c
call fcn.00406276
jmp 0x406227
mov dword [ebp - 0x20], 1
lea eax, [ebp - 0x3c]
push eax
call fcn.004078d0
or eax, eax
jne 0x4061b2
jmp 0x406227
mov dword [ebp - 0x20], 3
mov dword [ebp - 0x1c], 1
lea eax, [ebp - 0x3c]
push eax
call fcn.004078d0
or eax, eax
jne 0x4061d9
mov dword [ebp - 0x26c], 1
jmp 0x406227
push ecx
push 0
lea eax, [ebp - 0x268]
push eax
push 1
push 0x40b239
push dword [ebp + 8]
call sub.KERNEL32.dll_WriteFile
pop ecx
or ecx, ecx
je 0x40620a
push 0
lea eax, [ebp - 0x268]
push eax
push ecx
push esi
push dword [ebp + 8]
call sub.KERNEL32.dll_WriteFile
push 0
lea eax, [ebp - 0x268]
push eax
push 2
push 0x40b232
push dword [ebp + 8]
call sub.KERNEL32.dll_WriteFile
inc dword [ebp - 0x1c]
jmp 0x4061c0
mov eax, dword [ebp - 0x26c]
pop ebx
pop edi
pop esi
leave
ret 8