Function at 0x46cd90
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xd9c
mov esi, dword [ebp + 0x14]
cmp dword [ebp + 0x1c], 3
jg 0x46d50e
mov ebx, 0x10000
mov esi, esi
mov dword [esi + ebx*4], 0
dec ebx
jns 0x46cdb0
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x18]
movzx edi, byte [eax]
dec ebx
mov dword [ebp - 0xd54], ebx
shl edi, 8
cmp ebx, 2
jle 0x46ce3a
mov edx, dword [ebp + 0x10]
sar edi, 8
mov ecx, dword [ebp + 0xc]
mov word [edx + ebx*2], 0
movzx eax, byte [ebx + ecx]
mov word [edx + ebx*2 - 2], 0
shl eax, 8
or edi, eax
inc dword [esi + edi*4]
sar edi, 8
movzx eax, byte [ebx + ecx - 1]
mov word [edx + ebx*2 - 4], 0
shl eax, 8
or edi, eax
inc dword [esi + edi*4]
sar edi, 8
movzx eax, byte [ebx + ecx - 2]
mov word [edx + ebx*2 - 6], 0
shl eax, 8
or edi, eax
inc dword [esi + edi*4]
sar edi, 8
movzx eax, byte [ebx + ecx - 3]
sub ebx, 4
shl eax, 8
or edi, eax
inc dword [esi + edi*4]
cmp ebx, 2
jg 0x46cdd2
test ebx, ebx
js 0x46ce5c
mov eax, dword [ebp + 0x10]
sar edi, 8
mov edx, dword [ebp + 0xc]
mov word [eax + ebx*2], 0
movzx eax, byte [ebx + edx]
shl eax, 8
or edi, eax
inc dword [esi + edi*4]
dec ebx
jns 0x46ce3e
xor ebx, ebx
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x18]
movzx eax, byte [ebx + ecx]
add edx, ebx
inc ebx
cmp ebx, 0x21
mov byte [edx + ecx], al
mov eax, dword [ebp + 0x10]
mov word [eax + edx*2], 0
jle 0x46ce5e
cmp dword [ebp + 0x1c], 3
jg 0x46d4e1
mov ebx, 1
mov eax, dword [esi + ebx*4 - 4]
add dword [esi + ebx*4], eax
inc ebx
cmp ebx, 0x10000
jle 0x46ce8b
mov edx, dword [ebp + 0xc]
mov ebx, dword [ebp - 0xd54]
movzx ax, byte [edx]
shl eax, 8
cmp ebx, 2
movzx edx, ax
jle 0x46cf3c
mov ecx, dword [ebp + 0xc]
shr edx, 8
movzx eax, byte [ebx + ecx]
shl eax, 8
or edx, eax
mov edi, dword [esi + edx*4]
mov eax, dword [ebp + 8]
dec edi
mov dword [esi + edx*4], edi
shr edx, 8
mov dword [eax + edi*4], ebx
movzx eax, byte [ebx + ecx - 1]
mov ecx, dword [ebp + 8]
shl eax, 8
or edx, eax
mov edi, dword [esi + edx*4]
lea eax, [ebx - 1]
dec edi
mov dword [esi + edx*4], edi
shr edx, 8
mov dword [ecx + edi*4], eax
mov ecx, dword [ebp + 0xc]
movzx eax, byte [ebx + ecx - 2]
mov ecx, dword [ebp + 8]
shl eax, 8
or edx, eax
mov edi, dword [esi + edx*4]
lea eax, [ebx - 2]
dec edi
mov dword [esi + edx*4], edi
shr edx, 8
mov dword [ecx + edi*4], eax
mov ecx, dword [ebp + 0xc]
movzx eax, byte [ebx + ecx - 3]
mov ecx, dword [ebp + 8]
shl eax, 8
or edx, eax
mov edi, dword [esi + edx*4]
lea eax, [ebx - 3]
sub ebx, 4
dec edi
cmp ebx, 2
mov dword [esi + edx*4], edi
mov dword [ecx + edi*4], eax
jg 0x46ceb7
test ebx, ebx
js 0x46cf5f
mov ecx, dword [ebp + 0xc]
shr edx, 8
movzx eax, byte [ebx + ecx]
shl eax, 8
or edx, eax
mov edi, dword [esi + edx*4]
mov eax, dword [ebp + 8]
dec edi
mov dword [esi + edx*4], edi
mov dword [eax + edi*4], ebx
dec ebx
jns 0x46cf40
xor ebx, ebx
mov dword [ebp + ebx*4 - 0x418], ebx
xor ecx, ecx
mov byte [ebx + ebp - 0x518], cl
inc ebx
cmp ebx, 0xff
jle 0x46cf61
mov ecx, 1
lea ecx, [ecx + ecx*2 + 1]
cmp ecx, 0x100
jle 0x46cf7f
mov eax, 0x55555556
imul ecx
mov eax, ecx
sar eax, 0x1f
sub edx, eax
cmp edx, 0xff
mov ebx, edx
mov dword [ebp - 0xd2c], edx
mov ecx, edx
jg 0x46d063
lea eax, [edx - 1]
mov dword [ebp - 0xd40], eax
mov edx, dword [ebp + ebx*4 - 0x418]
mov edi, ebx
mov eax, edx
mov dword [ebp - 0xd28], edx
shl eax, 0xa
add eax, esi
mov dword [ebp - 0xd38], eax
mov eax, dword [eax]
mov dword [ebp - 0xd3c], eax
mov edx, dword [ebp - 0xd2c]
mov eax, edi
sub eax, edx
mov dword [ebp - 0xd30], eax
mov edx, dword [ebp + eax*4 - 0x418]
mov eax, edx
mov dword [ebp - 0xd34], edx
shl eax, 0xa
mov edx, dword [esi + eax + 0x400]
sub edx, dword [esi + eax]
mov eax, dword [ebp - 0xd38]
mov eax, dword [eax + 0x400]
mov dword [ebp - 0xd6c], eax
mov eax, dword [ebp - 0xd3c]
sub dword [ebp - 0xd6c], eax
cmp edx, dword [ebp - 0xd6c]
jbe 0x46d049
mov edx, dword [ebp - 0xd34]
mov dword [ebp + edi*4 - 0x418], edx
mov edi, dword [ebp - 0xd30]
cmp edi, dword [ebp - 0xd40]
jg 0x46cfdc
mov edx, dword [ebp - 0xd28]
inc ebx
cmp ebx, 0xff
mov dword [ebp + edi*4 - 0x418], edx
jle 0x46cfb8
cmp dword [ebp - 0xd2c], 1
jne 0x46cf8b
xor eax, eax
xor ebx, ebx
mov dword [ebp - 0xd24], eax
mov ecx, dword [ebp + ebx*4 - 0x418]
xor edi, edi
mov dword [ebp - 0xd1c], ecx
cmp edi, dword [ebp - 0xd1c]
je 0x46d17a
mov eax, dword [ebp - 0xd1c]
shl eax, 8
add eax, edi
mov dword [ebp - 0xd20], eax
mov edx, dword [esi + eax*4]
test edx, 0x200000
jne 0x46d16b
mov ecx, dword [ebp - 0xd20]
mov eax, edx
and eax, 0xffdfffff
mov dword [ebp - 0xd44], eax
mov eax, dword [esi + ecx*4 + 4]
mov ecx, dword [ebp - 0xd44]
and eax, 0xffdfffff
dec eax
cmp eax, ecx
mov dword [ebp - 0xd48], eax
jle 0x46d16b
cmp dword [ebp + 0x1c], 3
jg 0x46d4a5
mov dword [esp + 0x18], 2
mov ecx, dword [ebp + 0x20]
mov eax, dword [ebp - 0xd48]
mov edx, dword [ebp - 0xd44]
mov dword [esp + 0x1c], ecx
mov ecx, dword [ebp + 0x18]
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 0x10], edx
mov edx, dword [ebp + 0xc]
mov dword [esp + 0xc], ecx
mov ecx, dword [ebp + 8]
mov dword [esp + 8], eax
mov dword [esp + 4], edx
mov dword [esp], ecx
call fcn.0046c710
mov eax, dword [ebp - 0xd44]
mov edx, dword [ebp - 0xd24]
sub dword [ebp - 0xd48], eax
mov eax, dword [ebp + 0x20]
mov ecx, dword [ebp - 0xd48]
mov eax, dword [eax]
lea edx, [ecx + edx + 1]
test eax, eax
mov dword [ebp - 0xd24], edx
js 0x46d42d
mov ecx, dword [ebp - 0xd20]
mov edx, dword [esi + ecx*4]
mov eax, dword [ebp - 0xd20]
or edx, 0x200000
mov dword [esi + eax*4], edx
inc edi
cmp edi, 0xff
jle 0x46d089
mov edx, dword [ebp - 0xd1c]
cmp byte [edx + ebp - 0x518], 0
jne 0x46d494
mov edx, dword [ebp - 0xd1c]
xor edi, edi
mov eax, dword [esi + edx*4]
and eax, 0xffdfffff
mov dword [ebp + edi*4 - 0x918], eax
mov eax, dword [esi + edx*4 + 4]
add edx, 0x100
and eax, 0xffdfffff
dec eax
mov dword [ebp + edi*4 - 0xd18], eax
inc edi
cmp edi, 0xff
jle 0x46d1a3
mov eax, dword [ebp - 0xd1c]
mov ecx, dword [ebp - 0xd1c]
shl eax, 0xa
mov edi, dword [esi + eax]
mov ecx, dword [ebp + ecx*4 - 0x918]
and edi, 0xffdfffff
mov dword [ebp - 0xd5c], ecx
cmp edi, ecx
jge 0x46d25c
mov eax, dword [ebp + 8]
mov edx, dword [eax + edi*4]
dec edx
js 0x46d48a
mov ecx, dword [ebp + 0xc]
movzx ecx, byte [edx + ecx]
mov dword [ebp - 0xd70], ecx
cmp byte [ecx + ebp - 0x518], 0
jne 0x46d253
mov eax, dword [ebp + ecx*4 - 0x918]
mov ecx, dword [ebp + 8]
mov dword [ebp - 0xd7c], eax
mov dword [ecx + eax*4], edx
mov edx, dword [ebp - 0xd70]
inc eax
mov ecx, dword [ebp - 0xd1c]
mov dword [ebp + edx*4 - 0x918], eax
mov ecx, dword [ebp + ecx*4 - 0x918]
mov dword [ebp - 0xd5c], ecx
inc edi
cmp edi, dword [ebp - 0xd5c]
jl 0x46d1fb
mov eax, dword [ebp - 0xd1c]
shl eax, 0xa
mov eax, dword [esi + eax + 0x400]
and eax, 0xffdfffff
lea edi, [eax - 1]
mov eax, dword [ebp - 0xd1c]
mov eax, dword [ebp + eax*4 - 0xd18]
cmp edi, eax
mov dword [ebp - 0xd60], eax
jle 0x46d2e8
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + edi*4]
dec edx
js 0x46d480
mov eax, dword [ebp + 0xc]
movzx eax, byte [edx + eax]
mov dword [ebp - 0xd70], eax
cmp byte [eax + ebp - 0x518], 0
jne 0x46d2df
mov ecx, dword [ebp + eax*4 - 0xd18]
mov eax, dword [ebp + 8]
mov dword [eax + ecx*4], edx
mov edx, dword [ebp - 0xd70]
mov eax, ecx
mov ecx, dword [ebp - 0xd1c]
dec eax
mov dword [ebp + edx*4 - 0xd18], eax
mov ecx, dword [ebp + ecx*4 - 0xd18]
mov dword [ebp - 0xd60], ecx
dec edi
cmp edi, dword [ebp - 0xd60]
jg 0x46d28b
mov eax, dword [ebp - 0xd5c]
dec eax
cmp eax, dword [ebp - 0xd60]
je 0x46d31b
mov eax, dword [ebp - 0xd5c]
test eax, eax
jne 0x46d30f
mov eax, dword [ebp - 0xd54]
cmp dword [ebp - 0xd60], eax
je 0x46d31b
mov dword [esp], 0x3ef
call fcn.00462970
mov eax, dword [ebp - 0xd1c]
mov edi, 0xff
or dword [esi + eax*4], 0x200000
add eax, 0x100
dec edi
jns 0x46d326
mov edx, dword [ebp - 0xd1c]
mov al, 1
cmp ebx, 0xfe
mov byte [edx + ebp - 0x518], al
jg 0x46d41a
mov eax, edx
shl eax, 0xa
mov ecx, dword [esi + eax]
mov edx, dword [esi + eax + 0x400]
and ecx, 0xffdfffff
and edx, 0xffdfffff
mov dword [ebp - 0xd70], ecx
sub edx, ecx
xor ecx, ecx
mov dword [ebp - 0xd4c], ecx
cmp edx, 0xfffe
jle 0x46d39b
inc dword [ebp - 0xd4c]
mov eax, edx
movzx ecx, byte [ebp - 0xd4c]
sar eax, cl
cmp eax, 0xfffe
jg 0x46d383
lea edi, [edx - 1]
test edi, edi
mov dword [ebp - 0xd58], edi
js 0x46d401
mov eax, dword [ebp - 0xd70]
mov edx, dword [ebp + 8]
add eax, edi
lea eax, [edx + eax*4]
mov dword [ebp - 0xd70], eax
mov ecx, dword [ebp - 0xd70]
mov eax, edi
mov edx, dword [ecx]
movzx ecx, byte [ebp - 0xd4c]
sar eax, cl
mov ecx, dword [ebp + 0x10]
movzx eax, ax
cmp edx, 0x21
mov dword [ebp - 0xd50], eax
mov word [ecx + edx*2], ax
jg 0x46d3f7
mov ecx, dword [ebp + 0x18]
lea eax, [ecx + edx]
mov ecx, dword [ebp - 0xd50]
mov edx, dword [ebp + 0x10]
mov word [edx + eax*2], cx
sub dword [ebp - 0xd70], 4
dec edi
jns 0x46d3bc
movzx ecx, byte [ebp - 0xd4c]
sar dword [ebp - 0xd58], cl
cmp dword [ebp - 0xd58], 0xffff
jg 0x46d472
inc ebx
cmp ebx, 0xff
jle 0x46d07a
cmp dword [ebp + 0x1c], 3
jg 0x46d438
add esp, 0xd9c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 4], 0x46cce0
mov edx, dword [ebp - 0xd24]
mov eax, dword [ebp + 0x18]
sub eax, edx
mov edx, dword [ebp + 0x18]
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0xd24]
mov dword [esp + 8], edx
mov dword [esp + 0xc], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call fcn.00413ea0
jmp 0x46d42d
mov dword [esp], 0x3ea
call fcn.00462970
jmp 0x46d41a
mov eax, dword [ebp + 0x18]
add edx, eax
jmp 0x46d298
mov eax, dword [ebp + 0x18]
add edx, eax
jmp 0x46d208
mov dword [esp], 0x3ee
call fcn.00462970
jmp 0x46d19b
mov dword [esp + 0xc], edi
sub eax, ecx
mov edx, dword [ebp - 0xd1c]
mov dword [esp + 4], 0x46cd20
inc eax
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0xd24]
mov dword [esp + 8], edx
mov dword [esp + 0x10], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call fcn.00413ea0
jmp 0x46d0f0
mov dword [esp + 8], 0x1b
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 4], 1
mov dword [esp], 0x46bf71
add eax, 0x40
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
jmp 0x46ce86
mov dword [esp + 8], 0x21
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 4], 1
mov dword [esp], 0x46cd60
add eax, 0x40
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
jmp 0x46cda9