Function at 0x422260
Capabilities:
Terminate process
Write file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1c
test ecx, ecx
je 0x4222f6
mov esi, ecx
mov dword [esp + 0x14], edx
mov ecx, dword [esp + 0x30]
test ecx, ecx
mov edx, 0x80000000
cmovns edx, ecx
test edx, edx
mov ebx, 0xf4240
cmovne ebx, edx
test ebx, ebx
jle 0x422303
xor edx, edx
xor edi, edi
xor ebp, ebp
jmp 0x4222a4
cmp edx, ebx
jge 0x422309
movzx ecx, byte [esi + ebp]
cmp cl, 0x20
jb 0x4222d0
nop dword [eax]
inc edi
movzx ecx, byte [esi + ebp + 1]
inc ebp
and cl, 0xc0
cmp cl, 0x80
je 0x4222b0
inc edx
jmp 0x4222a0
cmp cl, 9
jne 0x422309
lea ecx, [edx + 1]
cmp ebx, ecx
cmovg ecx, ebx
mov eax, edx
not edx
add ecx, edx
and edx, 7
cmp ecx, edx
cmovb edx, ecx
add eax, edx
inc eax
add edi, edx
inc edi
mov edx, eax
inc ebp
jmp 0x4222a0
mov dword [edx], 0
xor edi, edi
jmp 0x4224e7
xor ebp, ebp
xor edi, edi
xor edx, edx
cmp byte [esp + 0x34], 0
mov dword [esp + 8], esi
mov dword [esp + 0x10], ebx
je 0x42235c
cmp edx, ebx
jl 0x42235c
mov dword [esp + 0xc], edx
mov eax, ebp
shr eax, 0x1f
add eax, ebp
sar eax, 1
mov dword [esp + 4], eax
mov esi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isspace]
mov ebx, ebp
nop word cs:[eax + eax]
cmp ebx, dword [esp + 4]
jle 0x422364
mov eax, dword [esp + 8]
movzx eax, byte [eax + ebx - 1]
dec ebx
push eax
call esi
add esp, 4
test eax, eax
je 0x422340
jmp 0x4223b9
mov dword [esp], ebp
jmp 0x4223ea
mov ecx, ebp
nop word cs:[eax + eax]
cmp ecx, dword [esp + 4]
jle 0x4223df
lea ebx, [ecx - 1]
mov esi, dword [esp + 8]
movzx eax, byte [esi + ecx - 1]
push eax
mov dword [esp + 0x1c], ecx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isalnum]
add esp, 4
mov dword [esp], eax
mov eax, dword [esp + 0x18]
movzx esi, byte [esi + eax]
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isalnum]
add esp, 4
mov ecx, ebx
cmp dword [esp], eax
je 0x422370
and esi, 0xffffffc0
mov ecx, ebx
cmp esi, 0x80
je 0x422370
inc ebx
mov edx, dword [esp + 0xc]
mov dword [esp], ebp
cmp ebx, dword [esp + 4]
mov esi, dword [esp + 8]
jle 0x4223ea
lea ebp, [ebx - 1]
nop
cmp byte [esi + ebp + 1], 0x20
lea ebp, [ebp + 1]
je 0x4223d0
mov dword [esp], ebx
jmp 0x4223ea
mov dword [esp], ebp
mov esi, dword [esp + 8]
mov edx, dword [esp + 0xc]
movzx eax, byte [esi + ebp]
cmp edx, dword [esp + 0x10]
jl 0x4223f8
cmp al, 0x1f
ja 0x42242c
movzx ecx, al
xor eax, eax
test ecx, ecx
je 0x422430
cmp ecx, 0xd
jne 0x422422
movzx ecx, byte [esi + ebp + 1]
cmp cl, 0xa
jne 0x422427
lea ecx, [esi + ebp]
add ecx, 2
xor eax, eax
cmp byte [ebp + esi + 2], 0
cmovne eax, ecx
jmp 0x422430
movzx ecx, byte [esi + ebp + 1]
inc ebp
test cl, cl
je 0x422430
add ebp, esi
mov eax, ebp
mov ecx, dword [esp + 0x14]
mov dword [ecx], eax
inc edi
push edi
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
add esp, 4
test eax, eax
je 0x4224f1
mov edi, eax
mov edx, dword [esp]
test edx, edx
jle 0x4224e1
xor ecx, ecx
xor ebx, ebx
xor ebp, ebp
mov dword [esp], edx
nop
movzx eax, byte [esi + ebp]
cmp al, 0x20
jb 0x422490
mov edx, ecx
nop word [eax + eax]
mov byte [edi + ebx], al
inc ebx
movzx eax, byte [esi + ebp + 1]
inc ebp
mov ecx, eax
and cl, 0xc0
cmp cl, 0x80
je 0x422470
mov ecx, edx
inc ecx
mov edx, dword [esp]
cmp ebp, edx
jl 0x422460
jmp 0x4224e3
cmp al, 9
jne 0x4224e3
lea eax, [edi + ebx]
mov dword [esp + 4], ecx
mov ecx, dword [esp + 4]
inc ecx
mov edx, dword [esp + 0x10]
cmp edx, ecx
cmovg ecx, edx
mov esi, dword [esp + 4]
not esi
add ecx, esi
and esi, 7
cmp ecx, esi
cmovb esi, ecx
lea ecx, [esi + 1]
push ecx
push 0x20
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
add esp, 0xc
add ecx, esi
inc ecx
add ebx, esi
inc ebx
mov esi, dword [esp + 8]
inc ebp
cmp ebp, edx
jl 0x422460
jmp 0x4224e3
xor ebx, ebx
mov byte [edi + ebx], 0
mov eax, edi
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push eax
push 1
push 0x15
push str.Error:_out_of_memory_n
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
add esp, 0x10
push 1
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
nop word cs:[eax + eax]