Function at 0x424785
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push esi
push edi
push 0x19000
push 0x40
call fcn.00401030
mov dword [ebp - 0x104], eax
push dword [ebp - 0x104]
call sub.kernel32.dll_GlobalLock
mov esi, dword [0x451a51]
mov edi, dword [ebp - 0x104]
lea eax, [esi + 0x20]
push eax
lea eax, [esi]
push eax
call fcn.0042459c
add esi, 0x28
mov eax, dword [esi]
or eax, eax
je 0x4247e5
cmp eax, 0xffffffff
je 0x4247e0
lea eax, [esi + 0x24]
push eax
lea eax, [esi + 4]
push eax
call fcn.0042459c
add esi, 0x78
jmp 0x4247c8
mov esi, dword [0x451a51]
mov al, byte [esi]
or al, al
je 0x4247fe
lea eax, [esi]
push eax
push edi
call fcn.00420b04
add edi, eax
jmp 0x42480a
movzx edx, word [esi + 0x20]
push 0
push edx
call fcn.00420acc
mov al, 0x20
stosb byte es:[edi], al
push str.MENUEX
push edi
call fcn.00420b04
add edi, eax
mov ax, 0xa0d
stosw word es:[edi], ax
push str.BEGIN
push edi
call fcn.00420b04
add edi, eax
mov ax, 0xa0d
stosw word es:[edi], ax
mov dword [ebp - 0x10c], 0
add esi, 0x28
mov eax, dword [esi]
or eax, eax
je 0x424971
cmp eax, 0xffffffff
je 0x424971
mov eax, dword [esi + 0x68]
cmp eax, dword [ebp - 0x10c]
je 0x42487e
push edi
push 0x10
push 0x44f25f
push 0x44e638
push dword [ebp + 8]
call sub.user32.dll_MessageBoxA
pop edi
mov eax, 1
jmp 0x424ac0
push esi
add esi, 0x78
mov eax, dword [esi]
or eax, eax
je 0x424892
cmp eax, 0xffffffff
jne 0x42488f
jmp 0x42487f
mov eax, dword [esi + 0x68]
mov dword [ebp - 0x108], eax
pop esi
push dword [ebp - 0x10c]
call fcn.004245f7
cmp eax, dword [ebp - 0x10c]
jbe 0x4248bb
push str.POPUP
push dword [ebp + 8]
call fcn.0042460e
jmp 0x4248c8
push str.MENUITEM
push dword [ebp + 8]
call fcn.0042460e
mov eax, dword [ebp - 0x108]
cmp eax, dword [ebp - 0x10c]
jbe 0x42492d
sub eax, dword [ebp - 0x10c]
cmp eax, 1
je 0x424901
push edi
push 0x10
push 0x44f25f
push 0x44e638
push dword [ebp + 8]
call sub.user32.dll_MessageBoxA
pop edi
mov eax, 1
jmp 0x424ac0
push dword [ebp - 0x10c]
call fcn.004245f7
push dword [ebp - 0x108]
pop dword [ebp - 0x10c]
push str.BEGIN
push edi
call fcn.00420b04
add edi, eax
mov ax, 0xa0d
stosw word es:[edi], ax
jmp 0x424969
cmp eax, dword [ebp - 0x10c]
jae 0x424969
mov eax, dword [ebp - 0x108]
cmp eax, dword [ebp - 0x10c]
je 0x424969
dec dword [ebp - 0x10c]
push dword [ebp - 0x10c]
call fcn.004245f7
push 0x44f092
push edi
call fcn.00420b04
add edi, eax
mov ax, 0xa0d
stosw word es:[edi], ax
jmp 0x424935
add esi, 0x78
jmp 0x424840
push 0x44f092
push edi
call fcn.00420b04
add edi, eax
mov ax, 0xa0d
stosw word es:[edi], ax
cmp dword [ebp + 0xc], 0
je 0x424aa4
push 0x45de5e
lea eax, [ebp - 0x100]
push eax
call fcn.004010a7
lea eax, [ebp - 0x100]
push eax
call fcn.004010ef
lea edi, [ebp - 0x100]
add edi, eax
mov al, 0x52
stosb byte es:[edi], al
mov al, 0x65
stosb byte es:[edi], al
mov al, 0x73
stosb byte es:[edi], al
mov al, 0x5c
stosb byte es:[edi], al
push 0x45cf22
call fcn.004010ef
mov esi, 0x45cf22
add esi, eax
dec esi
mov al, byte [esi]
cmp al, 0x5c
jne 0x4249d0
inc esi
mov al, byte [esi]
cmp al, 0x2e
je 0x4249e8
or al, al
je 0x4249e8
mov byte [edi], al
inc esi
inc edi
jmp 0x4249d8
mov al, 0x4d
stosb byte es:[edi], al
mov al, 0x6e
stosb byte es:[edi], al
mov al, 0x75
stosb byte es:[edi], al
mov al, 0x2e
stosb byte es:[edi], al
mov al, 0x52
stosb byte es:[edi], al
mov al, 0x63
stosb byte es:[edi], al
mov al, 0
stosb byte es:[edi], al
push 0
push 0x80
push 2
push 0
push 1
push 0x40000000
lea eax, [ebp - 0x100]
push eax
call sub.kernel32.dll_CreateFileA
cmp eax, 0xffffffff
je 0x424a69
mov dword [ebp - 0x110], eax
push dword [ebp - 0x104]
call fcn.004010ef
mov dword [ebp - 0x114], eax
push 0
lea eax, [ebp - 0x114]
push eax
push dword [ebp - 0x114]
push dword [ebp - 0x104]
push dword [ebp - 0x110]
call sub.kernel32.dll_WriteFile
push dword [ebp - 0x110]
call sub.kernel32.dll_CloseHandle
mov eax, 0
jmp 0x424ac0
push 0x44ece9
push 0x467936
call fcn.004010a7
lea eax, [ebp - 0x100]
push eax
push 0x467936
call fcn.004010c5
push 0x10
push 0x44f25f
push 0x467936
push dword [ebp + 8]
call sub.user32.dll_MessageBoxA
mov eax, 1
jmp 0x424ac0
push 2
call fcn.0042ec60
call fcn.004305a1
push dword [ebp - 0x104]
call fcn.00430605
mov eax, 0
push eax
push dword [ebp - 0x104]
call sub.kernel32.dll_GlobalUnlock
push dword [ebp - 0x104]
call sub.kernel32.dll_GlobalFree
pop eax
pop edi
pop esi
leave
ret 8