Function at 0x406a30
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x570073
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x5e1da0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov esi, ecx
mov dword [ebp - 0x38], eax
lea ecx, [esi + 0x138]
push ecx
mov dword [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
movzx edx, word [ebp + 0x28]
movzx eax, word [ebp + 0x2a]
xor ebx, ebx
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x24], eax
cmp dword [esi + 0x14], ebx
jne 0x407175
mov eax, dword [esi + 0x78]
cmp eax, ebx
je 0x406aa3
push eax
call fcn.004575de
add esp, 4
mov dword [esi + 0x78], ebx
mov eax, dword [esi + 0x124]
cmp eax, ebx
je 0x406abc
push eax
call fcn.004575de
add esp, 4
mov dword [esi + 0x124], ebx
mov eax, dword [ebp + 0x4b4]
add eax, 0xfffffff0
push eax
call fcn.004023c0
lea edi, [eax + 0x10]
mov dword [ebp - 0x34], edi
push 0x2e
push edi
mov byte [ebp - 4], 2
call fcn.00553b37
add esp, 0xc
cmp eax, ebx
jne 0x406ae9
or eax, 0xffffffff
jmp 0x406aeb
sub eax, edi
push eax
lea ecx, [ebp - 0x2c]
push ecx
lea ecx, [ebp - 0x34]
call fcn.004056b0
push eax
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 3
call fcn.00402660
mov eax, dword [ebp - 0x2c]
add eax, 0xfffffff0
mov byte [ebp - 4], 2
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x406b28
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [ebp - 0x54]
call fcn.0045855e
mov dword [ebp - 0x54], vtable.CFileException.0
call fcn.004587ad
xor ecx, ecx
cmp eax, ebx
setne cl
cmp ecx, ebx
jne 0x406b51
push 0x80004005
call fcn.00401000
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x44], eax
lea ecx, [ebp - 0x44]
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x48], 0xffffffff
call fcn.00401250
push ebx
mov byte [ebp - 4], 5
call fcn.00553f94
add esp, 4
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], edx
call fcn.004587ad
xor ecx, ecx
cmp eax, ebx
setne cl
cmp ecx, ebx
jne 0x406b9f
push 0x80004005
call fcn.00401000
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea edi, [eax + 0x10]
mov dword [ebp - 0x2c], edi
lea ecx, [ebp + 0x58]
push ecx
lea edx, [esi + 0x60]
push 0x58a764
push edx
mov byte [ebp - 4], 6
call fcn.004026d0
mov eax, dword [ebp + 0x54]
mov ecx, dword [ebp + 0x458]
mov edx, dword [ebp + 0x3c]
add esp, 0xc
push 1
sub esp, 0x10
mov dword [esi + 0x64], eax
mov eax, esp
mov dword [eax], edx
mov edx, dword [ebp + 0x44]
mov dword [esi + 0x68], ecx
mov ecx, dword [ebp + 0x40]
mov dword [eax + 4], ecx
mov ecx, dword [ebp + 0x48]
mov dword [eax + 8], edx
mov edx, dword [ebp - 0x24]
mov dword [eax + 0xc], ecx
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp + 0xc]
push edx
mov edx, dword [ebp - 0x38]
push eax
push ecx
mov ecx, dword [esi + 0x11c]
push edx
call fcn.0040b7f0
cmp eax, ebx
jne 0x406c9e
mov eax, dword [esi + 0x130]
mov edx, dword [eax + 0x14]
lea ecx, [esi + 0x130]
call edx
lea eax, [edi - 0x10]
mov byte [ebp - 4], 5
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x406c48
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x44]
add eax, 0xfffffff0
mov byte [ebp - 4], 2
mov dword [ebp - 0x54], vtable.CFileException.0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x406c72
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x34]
add eax, 0xfffffff0
mov byte [ebp - 4], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x406c95
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0
jmp 0x407189
mov eax, dword [esi + 0x11c]
movzx ecx, word [eax + 0x14]
movzx eax, word [eax + 0x16]
mov edx, 0x2c0
mov dword [ebp - 0x3c], ecx
cmp cx, dx
je 0x406d03
mov edx, 0x2d0
cmp cx, dx
je 0x406d03
mov edx, 0x500
cmp cx, dx
jne 0x406cd4
mov edx, 0x160
jmp 0x406d12
mov edx, 0x780
cmp cx, dx
jne 0x406cef
mov edx, 0x210
cmp ax, dx
je 0x406d17
mov edx, 0x21c
jmp 0x406d12
mov edx, 0x3c0
cmp cx, dx
je 0x406d03
mov edx, 0x3b0
cmp cx, dx
jne 0x406d21
mov edx, 0xf0
cmp ax, dx
je 0x406d17
mov edx, 0x120
cmp ax, dx
jne 0x406d21
add eax, eax
movzx edx, ax
mov dword [ebp - 0x24], edx
jmp 0x406d27
movzx eax, ax
mov dword [ebp - 0x24], eax
movzx ebx, word [ebp - 0x24]
movzx edi, cx
mov dword [ebp - 0x28], edi
imul edi, ebx
lea ecx, [edi + edi]
push ecx
call fcn.004575d3
push edi
mov dword [esi + 0x78], eax
call fcn.004575d3
add esp, 8
mov dword [esi + 0x124], eax
mov dword [esi + 0x14], 1
call sub.MSVFW32.dll_DrawDibOpen
cmp dword [esi + 0x10], 0
mov dword [esi + 0x7c], eax
jne 0x406d6c
lea ecx, [esi + 4]
call fcn.0040c1a0
mov edi, dword [ebp - 0x28]
push 0
push ebx
push edi
lea ecx, [esi + 4]
call fcn.0040ca70
mov ecx, dword [esi + 0x120]
push 5
push 1
push ebx
push edi
call fcn.0040be20
call fcn.004587ad
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x406da6
push 0x80004005
call fcn.00401000
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x28], eax
mov byte [ebp - 4], 7
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebp - 0x58]
mov edx, dword [ebp - 0x5c]
push eax
push ecx
push edx
lea eax, [ebp - 0x28]
push str._d__d
push eax
call fcn.004026d0
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x34]
push ecx
push edx
lea edi, [esi + 0x58]
push str._s_TMP_STREAM__s
push edi
call fcn.004026d0
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x34]
push eax
push ecx
lea ebx, [esi + 0x5c]
push str._s_TMP_IDX__s
push ebx
call fcn.004026d0
mov eax, dword [edi]
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileA]
add esp, 0x34
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
push eax
call edi
mov dword [esi + 0x8c], eax
mov eax, dword [ebx]
xor ebx, ebx
push ebx
push 0x80
push 2
push ebx
push ebx
push 0xc0000000
push eax
call edi
mov dword [esi + 0x90], eax
cmp dword [esi + 0x8c], ebx
je 0x4070cf
cmp eax, ebx
je 0x4070cf
mov ax, word [ebp - 0x24]
mov dx, word [ebp - 0x3c]
mov word [esi + 0x76], ax
mov eax, dword [ebp - 0x28]
add eax, 0xfffffff0
mov word [esi + 0x74], dx
mov byte [ebp - 4], 6
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x406e8b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x2c]
add eax, 0xfffffff0
mov byte [ebp - 4], 5
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x406eae
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], 2
call fcn.00405160
mov eax, dword [ebp - 0x34]
add eax, 0xfffffff0
mov byte [ebp - 4], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x406edd
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
movzx ecx, word [esi + 0x76]
movzx edx, word [esi + 0x74]
imul ecx, edx
add ecx, ecx
push ecx
call fcn.004575d3
sub esp, 0x4a0
mov edi, eax
lea eax, [ebp + 0x10]
mov ecx, esp
mov dword [ebp - 0x28], esp
push eax
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x2c], ebx
call fcn.00405910
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x2c]
push ecx
mov ecx, dword [ebp - 0x38]
lea edx, [ebp - 0x24]
push edx
push edi
push eax
push ecx
mov ecx, esi
call fcn.00406160
cmp eax, ebx
jne 0x406f61
cmp edi, ebx
je 0x406f38
push edi
call fcn.004575de
add esp, 4
mov edx, dword [esi + 0x130]
mov eax, dword [edx + 0x14]
lea ecx, [esi + 0x130]
call eax
lea ecx, [ebp + 0x10]
call fcn.004057b0
lea ecx, [ebp + 0x4b4]
call fcn.004011c0
jmp 0x4071c7
mov ebx, dword [ebp - 0x24]
lea eax, [ebx + 1]
shr eax, 1
lea ecx, [eax + eax]
lea edi, [esi + 0x84]
push 0x2892
mov dword [ebp - 0x2c], eax
mov dword [edi], ecx
mov dword [esi + 0x6c], 1
call fcn.004575d3
push 0x2892
push 0
push eax
mov dword [ebp - 0x38], eax
call fcn.00552060
mov eax, dword [ebp - 0x38]
mov ecx, dword [esi + 0x8c]
add esp, 0x10
push 0
lea edx, [ebp - 0x40]
push edx
push 0x2892
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 0x38]
test eax, eax
je 0x406fc7
push eax
call fcn.004575de
add esp, 4
mov eax, dword [esi + 0x8c]
push 0
lea edx, [ebp - 0x40]
push edx
push 4
push 0x5d9e58
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [esi + 0x8c]
push 0
lea ecx, [ebp - 0x40]
push ecx
push 4
push edi
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
add dword [edi], 8
mov edi, dword [ebp - 0x3c]
mov ecx, dword [esi + 0x8c]
push 0
lea eax, [ebp - 0x40]
push eax
push ebx
push edi
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test bl, 1
je 0x407034
mov ecx, dword [esi + 0x8c]
push 0
lea edx, [ebp - 0x40]
push edx
push 1
lea eax, [ebp - 0x2d]
push eax
push ecx
mov byte [ebp - 0x2d], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [0x5d9e58]
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], 0x10
mov dword [ebp - 0x18], 4
cmp byte [ebx + edi - 1], 0
jne 0x40706b
cmp byte [ebx + edi - 2], 0
je 0x40705c
dec ebx
jmp 0x40706b
cmp byte [ebx + edi - 3], 0
je 0x407068
add ebx, 0xfffffffe
jmp 0x40706b
add ebx, 0xfffffffd
mov eax, dword [ebp - 0x2c]
push 0
lea edx, [ebp - 0x40]
push edx
lea ecx, [eax + eax + 0xc]
push 0x10
lea eax, [ebp - 0x20]
mov dword [esi + 0x88], ecx
mov ecx, dword [esi + 0x90]
push eax
push ecx
mov dword [ebp - 0x14], ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test edi, edi
je 0x4070a1
push edi
call fcn.004575de
add esp, 4
mov edx, dword [esi + 0x130]
mov eax, dword [edx + 0x14]
lea ecx, [esi + 0x130]
call eax
lea ecx, [ebp + 0x10]
call fcn.004057b0
lea ecx, [ebp + 0x4b4]
call fcn.004011c0
mov eax, 1
jmp 0x4071c9
mov edx, dword [esi + 0x130]
mov eax, dword [edx + 0x14]
lea ecx, [esi + 0x130]
call eax
mov eax, dword [ebp - 0x28]
add eax, 0xfffffff0
mov byte [ebp - 4], 6
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x407103
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x2c]
add eax, 0xfffffff0
mov byte [ebp - 4], 5
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x407126
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x44]
add eax, 0xfffffff0
mov byte [ebp - 4], 2
mov dword [ebp - 0x54], vtable.CFileException.0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x407150
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x34]
add eax, 0xfffffff0
mov byte [ebp - 4], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x407186
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x407186
mov edx, dword [esi + 0x130]
mov eax, dword [edx + 0x14]
lea ecx, [esi + 0x130]
call eax
mov byte [ebp - 4], bl
push fcn.004011c0
push 0x12
push 4
lea ecx, [ebp + 0x45c]
push ecx
call fcn.00552a95
mov eax, dword [ebp + 0x4b4]
add eax, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4071c7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005520da
mov esp, ebp
pop ebp
ret 0x4b0