Function at 0x42b000
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
test esi, esi
mov dword [ebp - 4], 0
jne 0x42b042
mov eax, dword [0x47eb44]
test eax, eax
jne 0x42b02a
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
jmp 0x42b02f
call fcn.0044e440
mov edi, dword [0x47eb44]
mov dword [ebp + 8], eax
mov dword [ebp - 8], edi
mov ebx, 1
jmp 0x42b068
mov eax, dword [esi + 0xa4]
mov ebx, dword [esi + 0x100]
mov dword [ebp + 8], eax
mov eax, dword [esi + 0x124]
mov edi, eax
shr edi, 6
shr eax, 7
and edi, 1
and eax, 1
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
test eax, eax
jne 0x42b0db
test esi, esi
mov eax, 1
je 0x42b27d
test dword [esi + 0x11c], 0x40000000
je 0x42b27d
mov eax, dword [esi + 0x28]
mov edx, dword [esi + 0x30]
lea ecx, [ebp - 0xc]
push 0
sub edx, eax
push ecx
push edx
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x42b0ad
or eax, 0xffffffff
mov ecx, dword [esi + 0xb0]
mov edx, dword [esi + 0x28]
add ecx, edx
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], ecx
mov ecx, dword [esi + 0x11c]
and ecx, 0xbfffffff
mov dword [esi + 0x11c], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x42b110
mov eax, dword [esi + 0x30]
test eax, eax
je 0x42b110
cmp dword [ebp + 0xc], eax
je 0x42b110
mov ecx, dword [esi + 0x28]
lea edx, [ebp - 0xc]
push 0
sub eax, ecx
push edx
push eax
mov eax, dword [ebp + 8]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x42b110
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [0x47eb44]
test eax, eax
je 0x42b156
test ebx, ebx
jne 0x42b127
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test edi, edi
je 0x42b13c
cmp ebx, 0xfffffffa
jne 0x42b13c
mov ebx, dword [ebp + 8]
mov dword [ebp - 4], 1
jmp 0x42b159
cmp ebx, 1
je 0x42b146
cmp ebx, 2
jne 0x42b156
mov dword [ebp - 4], 1
call fcn.0044e440
mov ebx, eax
jmp 0x42b159
mov ebx, dword [ebp + 0x10]
mov eax, dword [0x47eb44]
test eax, eax
je 0x42b17f
test edi, edi
je 0x42b17f
mov eax, dword [ebp - 8]
test eax, eax
je 0x42b17f
push ebx
call fcn.0044e4c0
add esp, 4
push ebx
call fcn.0044e650
add esp, 4
mov eax, dword [ebp - 4]
test eax, eax
je 0x42b1ae
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
push 0
push ebx
push ecx
push edx
call fcn.0044e510
mov ecx, dword [ebp + 0x10]
add esp, 0x10
cmp eax, ecx
je 0x42b27d
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test esi, esi
mov eax, 1
je 0x42b218
mov ecx, dword [esi + 0x124]
test ch, 0x80
je 0x42b218
mov edx, dword [esi + 0x28]
mov ecx, dword [ebp + 0xc]
cmp ecx, edx
je 0x42b1d1
cmp ecx, dword [esi + 0x30]
jne 0x42b21b
mov edi, dword [esi + 0xb0]
mov ebx, dword [esi + 0x2c]
lea edi, [ebx + edi*2]
mov ebx, dword [esi + 0xac]
add ebx, edx
cmp ebx, edi
jbe 0x42b21b
mov edx, dword [ebp + 0x10]
mov edi, dword [esi + 0x11c]
add edx, ecx
mov ecx, dword [esi + 0xb0]
mov dword [esi + 0x30], edx
mov edx, dword [esi + 0x34]
or edi, 0x40000000
add edx, ecx
mov dword [esi + 0x11c], edi
mov dword [esi + 0x34], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 0xc]
test esi, esi
je 0x42b236
mov eax, dword [esi + 0x30]
cmp ecx, eax
jne 0x42b236
mov ecx, dword [esi + 0x28]
mov edx, dword [ebp + 0x10]
sub eax, ecx
mov dword [ebp + 0xc], ecx
add edx, eax
mov dword [ebp + 0x10], edx
mov edx, dword [ebp + 0x10]
lea eax, [ebp - 0xc]
push 0
push eax
mov eax, dword [ebp + 8]
push edx
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x42b252
or eax, 0xffffffff
test esi, esi
je 0x42b27d
mov edi, dword [esi + 0x11c]
mov ecx, dword [esi + 0x28]
mov edx, dword [esi + 0xb0]
and edi, 0xbfffffff
add ecx, edx
mov dword [esi + 0x11c], edi
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret