Function at 0x4265a0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x658
mov eax, dword [0x473564]
xor eax, esp
mov dword [esp + 0x654], eax
mov eax, dword [esp + 0x65c]
test eax, eax
push ebx
mov ebx, dword [esp + 0x668]
push ebp
push esi
push edi
je 0x4265fe
cmp dword [eax], 1
je 0x4265d9
mov eax, 0x80000
jmp 0x4268c2
mov ebp, dword [eax + 4]
or esi, 0xffffffff
cmp dword [ebp + 4], esi
je 0x4265ec
mov edi, dword [ebp]
call fcn.00425800
mov edi, dword [esp + 0x670]
mov dword [ebp + 4], esi
mov esi, dword [ebp]
cmp edi, dword [esi + 4]
jl 0x426608
mov eax, 0x10000
jmp 0x4268c2
cmp edi, dword [esi + 0x10]
jge 0x426612
call fcn.00425170
mov eax, dword [ebp]
cmp dword [eax + 0x10], edi
jge 0x426672
lea ebx, [ebx]
mov esi, dword [ebp]
test esi, esi
je 0x42666a
cmp dword [esi + 0x18], 0
je 0x42666a
mov eax, dword [esi + 0x10]
add eax, 1
cmp eax, dword [esi + 4]
je 0x42666a
mov ecx, dword [esi + 0x50]
add ecx, dword [esi + 0x4c]
mov edx, dword [esi + 0x48]
lea ecx, [ecx + edx + 0x2e]
add dword [esi + 0x14], ecx
push 0
lea edx, [esi + 0x78]
push 0
push edx
lea edx, [esi + 0x28]
mov ecx, esi
mov dword [esi + 0x10], eax
call fcn.00424e60
add esp, 0xc
neg eax
sbb eax, eax
add eax, 1
mov dword [esi + 0x18], eax
mov eax, dword [ebp]
cmp dword [eax + 0x10], edi
jl 0x426620
lea ecx, [esp + 0x20]
push ecx
push edi
push ebp
call fcn.00425930
mov edx, dword [esp + 0x22c]
movzx eax, word [ebx]
shr edx, 4
test dl, 1
je 0x4266d1
cmp ax, 0x2f
je 0x4266a8
cmp ax, 0x5c
je 0x4266a8
test ax, ax
je 0x4266ba
cmp word [ebx + 2], 0x3a
jne 0x4266ba
push ebx
push 0
call fcn.00425e90
add esp, 8
xor eax, eax
jmp 0x4268c2
push ebx
add ebp, 0x244
push ebp
call fcn.00425e90
add esp, 8
xor eax, eax
jmp 0x4268c2
xor edi, edi
cmp ax, di
mov word [esp + 0x458], 0
mov esi, ebx
mov ecx, ebx
je 0x42670b
movzx eax, ax
lea esp, [esp]
cmp ax, 0x2f
je 0x4266fc
cmp ax, 0x5c
jne 0x4266ff
lea esi, [ecx + 2]
movzx eax, word [ecx + 2]
add ecx, 2
cmp ax, di
jne 0x4266f0
push 0x104
lea eax, [esp + 0x254]
push ebx
push eax
call fcn.0043a53d
add esp, 0xc
cmp esi, ebx
jne 0x426790
mov word [esp + 0x250], di
push esi
lea ecx, [esp + 0x254]
push ecx
lea ebx, [ebp + 0x244]
push ebx
push str._s_s_s
lea edx, [esp + 0x468]
call fcn.00422110
lea edx, [esp + 0x260]
push edx
push ebx
call fcn.00425e90
add esp, 0x18
mov eax, dword [esp + 0x22c]
push edi
push eax
push 2
push edi
push edi
push 0x40000000
lea ecx, [esp + 0x470]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4267fd
mov eax, 0x200
jmp 0x4268c2
mov ecx, esi
sub ecx, ebx
sar ecx, 1
mov word [esp + ecx*2 + 0x250], di
mov ax, word [esp + 0x250]
cmp ax, 0x2f
je 0x4267ca
cmp ax, 0x5c
je 0x4267ca
cmp ax, di
je 0x42672d
cmp word [esp + 0x252], 0x3a
jne 0x42672d
push esi
lea edx, [esp + 0x254]
push edx
push str._s_s
lea edx, [esp + 0x464]
call fcn.00422110
add esp, 0xc
lea eax, [esp + 0x250]
push eax
push edi
call fcn.00425e90
add esp, 8
jmp 0x42675f
mov edx, dword [ebp + 0x23c]
mov eax, dword [ebp]
push edx
call fcn.004253f0
add esp, 4
cmp dword [ebp + 0x240], edi
jne 0x42682a
push 0x4000
call fcn.004387fc
add esp, 4
mov dword [ebp + 0x240], eax
mov dword [esp + 0x18], edi
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp + 0x240]
lea eax, [esp + 0x17]
push eax
mov eax, dword [ebp]
push ecx
mov ecx, 0x4000
call fcn.00425570
mov esi, eax
add esp, 8
cmp esi, 0xffffff96
je 0x4268e0
test esi, esi
jl 0x426882
jle 0x426877
mov eax, dword [ebp + 0x240]
push 0
lea edx, [esp + 0x20]
push edx
push esi
push eax
push ebx
call edi
test eax, eax
je 0x4268ea
cmp byte [esp + 0x17], 0
jne 0x42688a
test esi, esi
jne 0x426834
mov dword [esp + 0x18], 0x5000000
mov edi, dword [ebp]
call fcn.00425800
mov esi, dword [esp + 0x18]
test esi, esi
jne 0x4268b9
lea ecx, [esp + 0x240]
push ecx
lea edx, [esp + 0x234]
push edx
lea eax, [esp + 0x240]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
mov ecx, dword [esp + 0x664]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
mov dword [0x478e28], eax
call fcn.00438866
add esp, 0x658
ret
mov dword [esp + 0x18], 0x1000
jmp 0x42688a
mov dword [esp + 0x18], 0x400
jmp 0x42688a