Function at 0x42f240
Capabilities:
Resolve function by parsing pe exports
Write file on windows

Disassembly:
push ebp
push edi
push esi
mov esi, edx
push ebx
mov ebx, ecx
sub esp, 0x4c
mov edi, dword [esp + 0x64]
mov ecx, dword [esp + 0x70]
mov edx, dword [esp + 0x6c]
mov ebp, dword [esp + 0x60]
mov dword [esp + 0x2c], edi
mov edi, dword [esp + 0x78]
mov dword [esp + 0x34], ecx
mov ecx, dword [esp + 0x74]
mov dword [esp + 0x30], edx
test ebx, ebx
je 0x42f310
cmp ebx, 1
je 0x42f431
mov esi, dword [fcn.004a1b90]
mov dword [esp], 2
call esi
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], str.exfat_block_stream_init
mov dword [esp + 0x10], 0x8a
mov dword [esp + 0xc], 0x536fa0
mov dword [esp + 8], 0x536faf
mov dword [esp + 4], str.__s___s:_d___s__Unexpected:_Unknown_exfat_stream_block_type_value:__d
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
mov dword [esp], 2
call esi
mov dword [esp + 8], 2
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], 0x536ffe
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call esi
mov dword [esp], eax
call sub.msvcrt.dll_fflush
add esp, 0x4c
mov eax, 6
xor edx, edx
pop ebx
pop esi
pop edi
pop ebp
ret
mov edx, dword [esi + 0x2c]
movzx ebx, byte [esi + 0x30]
mov dword [esp + 0x38], edx
mov byte [esp + 0x3f], bl
mov ebx, 1
cmp ecx, 0xffffffff
mov edx, edi
sbb edx, 0xffffffff
jl 0x42f520
mov dword [eax], esi
mov esi, dword [esp + 0x2c]
mov dword [eax + 4], ebx
mov edx, dword [esp + 0x68]
mov dword [eax + 0x14], esi
mov ebx, dword [esp + 0x30]
mov esi, dword [esp + 0x34]
mov dword [eax + 0x10], ebp
mov dword [eax + 0x18], edx
mov dword [eax + 0x20], ebx
mov dword [eax + 0x24], esi
mov dword [eax + 0x28], ecx
mov dword [eax + 0x2c], edi
test esi, esi
js 0x42f450
mov ecx, ebx
mov ebx, esi
mov esi, dword [esp + 0x38]
add ecx, 0xffffffff
adc ebx, 0xffffffff
xor edi, edi
add esi, ecx
movzx ecx, byte [esp + 0x3f]
adc edi, ebx
xor ebx, ebx
shrd esi, edi, cl
shr edi, cl
test cl, 0x20
cmovne esi, edi
cmovne edi, ebx
mov dword [eax + 0x30], esi
mov dword [eax + 0x34], edi
mov ecx, dword [esp + 0x2c]
and ecx, ebp
cmp ecx, 0xffffffff
je 0x42f3aa
mov edx, dword [esp + 0x68]
test edx, edx
je 0x42f474
mov dword [eax + 0xb8], 0
mov edi, dword [esp + 0x2c]
mov edx, dword [esp + 0x7c]
mov dword [eax + 0xc0], 0
mov dword [eax + 0xc4], 0
mov dword [eax + 8], edx
xor edx, edx
mov dword [eax + 0xc8], ebp
mov dword [eax + 0xcc], edi
mov dword [eax + 0xd0], 0
mov dword [eax + 0xd8], 0
mov dword [eax + 0xdc], 0
mov dword [eax + 0xe0], 0
mov dword [eax + 0xe4], 0
mov dword [eax + 0xe8], 0
mov dword [eax + 0xec], 0
add esp, 0x4c
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
movzx ebx, byte [esi + 0x28]
movzx edx, word [esi + 0x26]
mov byte [esp + 0x3f], bl
xor ebx, ebx
mov dword [esp + 0x38], edx
jmp 0x42f324
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x30]
mov edi, ecx
and edi, edx
cmp edi, 0xffffffff
jne 0x42f4a0
mov dword [eax + 0x30], 0xffffffff
mov dword [eax + 0x34], 0xffffffff
jmp 0x42f393
lea ecx, [ebp + 2]
mov dword [eax + 0x38], 0
mov dword [eax + 0x3c], ecx
mov ecx, dword [eax + 0x30]
mov dword [eax + 0x44], 0xffffffff
mov dword [eax + 0x40], ecx
mov dword [eax + 0xb8], 1
jmp 0x42f3b4
mov dword [esp], 2
mov ebx, dword [fcn.004a1b90]
call ebx
mov edi, dword [esp + 0x30]
mov ebp, dword [esp + 0x34]
mov dword [esp + 8], 0x537001
mov dword [esp + 4], 0x537038
mov dword [esp + 0xc], edi
mov dword [esp + 0x10], ebp
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
mov dword [esp], 2
call ebx
mov dword [esp + 8], 2
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], 0x536ffe
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call ebx
mov dword [esp], eax
call sub.msvcrt.dll_fflush
add esp, 0x4c
mov eax, 0x22
xor edx, edx
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0x2c], ecx
mov ebx, dword [fcn.004a1b90]
mov dword [esp], 2
call ebx
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x10], edi
mov dword [esp + 8], 0x537001
mov dword [esp + 0xc], ecx
mov dword [esp + 4], str.__s__Invalid_value_for_valid_data_length:__I64d
jmp 0x42f4cf