Function at 0x428af0
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0xc4c]
sub esp, 0xccc
mov eax, dword [0x488548]
xor eax, ebp
mov dword [ebp + 0xc48], eax
mov eax, dword [ebp + 0xc54]
push ebx
push esi
mov esi, dword [ebp + 0xc5c]
push edi
xor ebx, ebx
push eax
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x74], ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov edi, eax
mov dword [ebp - 0x70], edi
cmp edi, ebx
jne 0x428b45
push str.Save_error
xor edx, edx
mov ecx, esi
call fcn.00427caa
jmp 0x428d02
push dword [ebp - 0x7c]
call dword [sym.imp.KERNEL32.dll_GlobalSize]
push eax
mov dword [ebp - 0x6c], eax
push edi
lea eax, [ebp - 0x68]
push eax
push dword [ebp + 0xc58]
call fcn.00426670
lea eax, [ebp - 0x68]
push eax
lea eax, [esi + 0xa34]
push eax
lea eax, [ebp + 0x798]
push eax
call fcn.0042642d
cmp dword [ebp + 0xc58], 8
je 0x428b8b
cmp dword [ebp + 0xc58], 0x11
jne 0x428be7
cmp dword [0x48965c], ebx
je 0x428be7
push edi
call fcn.00456f7f
lea ecx, [ebp + 0x798]
push ecx
mov ecx, dword [ebp - 0x6c]
sub ecx, eax
push ecx
lea ecx, [eax + edi]
push ecx
push eax
push edi
call fcn.0042658e
test eax, eax
je 0x428bc1
push str.Save_error
xor edx, edx
jmp 0x428cf2
lea eax, [ebp + 0x798]
push eax
call fcn.004270bd
add esi, 0x3328
movzx ecx, word [eax]
inc eax
mov word [esi], cx
inc eax
inc esi
inc esi
cmp cx, bx
jne 0x428bd3
jmp 0x428cf9
push ebx
push 0x8000000
push 1
push ebx
push ebx
push 0x40000000
lea eax, [ebp + 0x798]
push eax
call dword [sym.imp.PPLIB32W.DLL__CreateFileL_28]
mov dword [ebp - 0x78], eax
cmp eax, 0xffffffff
je 0x428ce3
lea eax, [ebp + 0x798]
push eax
call fcn.004270bd
add esi, 0x3328
movzx ecx, word [eax]
inc eax
mov word [esi], cx
inc eax
inc esi
inc esi
cmp cx, bx
jne 0x428c21
mov eax, dword [ebp + 0xc58]
cmp eax, 8
je 0x428ca9
cmp eax, 0x11
je 0x428ca9
cmp dword [ebp - 0x6c], ebx
je 0x428cba
cmp eax, 1
jne 0x428c5d
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x428c4f
sub eax, edx
mov dword [ebp - 0x6c], eax
jmp 0x428cba
cmp eax, 0xd
jne 0x428cba
mov esi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push ebx
push ebx
push ebx
push ebx
push 0xffffffffffffffff
push edi
push ebx
mov edi, 0xfde9
push edi
call esi
mov ecx, eax
mov dword [ebp - 0x80], ecx
call fcn.00424f73
mov dword [ebp - 0x74], eax
cmp eax, ebx
je 0x428cb7
push ebx
push ebx
push dword [ebp - 0x80]
push eax
push 0xffffffffffffffff
push dword [ebp - 0x70]
push ebx
push edi
call esi
mov dword [ebp - 0x6c], eax
cmp eax, ebx
je 0x428ca2
dec dword [ebp - 0x6c]
mov eax, dword [ebp - 0x74]
mov edi, eax
jmp 0x428cba
push dword [ebp - 0x6c]
push edi
push dword [ebp - 0x78]
call fcn.0042688b
jmp 0x428cba
mov edi, dword [ebp - 0x70]
push ebx
lea eax, [ebp - 0x6c]
push eax
push dword [ebp - 0x6c]
push edi
push dword [ebp - 0x78]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebp - 0x78]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x74]
cmp ecx, ebx
je 0x428cf9
call fcn.00424f83
jmp 0x428cf9
xor eax, eax
mov word [esi + 0x3328], ax
push ebx
mov edx, 0x1fffffff
mov ecx, esi
call fcn.00427caa
push dword [ebp - 0x7c]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov ecx, dword [ebp + 0xc48]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0046890b
add ebp, 0xc4c
leave
ret 0xc