Function at 0x460540
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2820
call fcn.004e1f60
mov eax, dword [0x55e2f4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x2818], eax
or esi, 0xffffffff
mov eax, dword [ebp + 0x14]
push 0x802
mov dword [ebp - 0x281c], eax
lea eax, [ebp - 0x808]
push ebx
push eax
call fcn.004e46b0
add esp, 0xc
cmp dword [edi], ebx
je 0x4607d5
lea ecx, [ebp - 0x808]
push ecx
push dword [ebp - 0x2818]
lea eax, [edi + 8]
push eax
mov dword [ebp - 0x2810], eax
call fcn.00426bf0
mov ebx, eax
add esp, 0xc
test ebx, ebx
jne 0x46093a
cmp dword [ebp + 0xc], eax
jne 0x4606f0
lea eax, [ebp - 0x808]
push eax
call fcn.00429b00
add esp, 4
test eax, eax
je 0x4606be
lea eax, [edi + 8]
push eax
lea eax, [ebp - 0x808]
push eax
call fcn.00426830
mov esi, eax
add esp, 8
cmp esi, 0xffffffff
jne 0x460611
push dword [edi + 0x88c]
push str.FORMAT_CANT_DISMOUNT_FILESYS
call fcn.00419a00
add esp, 8
mov ebx, 0x1c
jmp 0x4608bf
push 0
lea eax, [ebp - 0x2814]
push eax
push 0
push 0
push 0
push 0
push 0x90083
push esi
call dword [sym.imp.KERNEL32.DLL_DeviceIoControl]
test eax, eax
mov ecx, 1
push 0
mov eax, 0
cmove eax, ecx
mov dword [ebp - 0x280c], eax
lea eax, [ebp - 0x2814]
push eax
push 0
push 0
push 0
push 0
push 0x90083
push esi
call dword [sym.imp.KERNEL32.DLL_DeviceIoControl]
cmp dword [edi + 4], 0
jne 0x4606f0
mov eax, dword [ebp - 0x280c]
test eax, eax
je 0x4606f0
push 0x2000
lea eax, [ebp - 0x2808]
push 0
push eax
call fcn.004e46b0
add esp, 0xc
lea eax, [ebp - 0x2820]
push 0
push eax
push 0x2000
lea eax, [ebp - 0x2808]
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_WriteFile]
test eax, eax
je 0x46087e
push esi
call dword [sym.imp.KERNEL32.DLL_FlushFileBuffers]
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
jmp 0x4606ed
lea esi, [edi + 8]
push esi
call fcn.00427440
push 0xb
mov dword [ebp - 0x280c], eax
call fcn.0041c0d0
add esp, 8
test eax, eax
je 0x4606ed
cmp dword [ebp - 0x280c], 0xffffffff
jne 0x4606ed
push esi
call fcn.0042a6a0
add esp, 4
or esi, 0xffffffff
xor ecx, ecx
cmp esi, 0xffffffff
jne 0x460793
mov edx, dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov eax, ecx
push 0
push 0
inc ecx
cmp eax, 0x1f4
push 3
mov dword [ebp - 0x280c], ecx
lea eax, [ebp - 0x808]
push 0
jge 0x460740
push 0
push 0xc0000000
push eax
call edx
mov esi, eax
cmp esi, 0xffffffff
jne 0x460793
push 0xa
call dword [sym.imp.KERNEL32.DLL_Sleep]
mov ecx, dword [ebp - 0x280c]
jmp 0x4606fb
push 3
push 0xc0000000
push eax
call edx
push dword [edi + 0x88c]
mov esi, eax
cmp esi, 0xffffffff
je 0x460771
push str.DEVICE_IN_USE_FORMAT
call fcn.00419610
add esp, 8
cmp eax, 7
jne 0x460793
lea ebx, [eax + 0x15]
jmp 0x460883
call fcn.00417c00
push dword [edi + 0x88c]
push str.CANT_ACCESS_VOL
call fcn.00419a00
add esp, 0xc
mov ebx, 0x1c
jmp 0x4608bf
push 0
lea eax, [ebp - 0x2814]
push eax
push 0
push 0
push 0
push 0
push 0x90028
push esi
call dword [sym.imp.KERNEL32.DLL_DeviceIoControl]
test eax, eax
je 0x460930
push dword [edi + 0x88c]
push str.FORMAT_CANT_DISMOUNT_FILESYS
call fcn.00419a00
add esp, 8
mov ebx, 0x1c
jmp 0x460883
cmp dword [edi + 4], ebx
jne 0x460894
cmp dword [ebp + 0xc], ebx
jne 0x460894
push 0
push 0
push 2
push 0
push 0
lea eax, [edi + 8]
push 0xc0000000
push eax
mov dword [ebp - 0x2810], eax
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x4608ba
push esi
call fcn.00426790
add esp, 4
cmp dword [edi + 0x834], ebx
je 0x460843
push 0
lea eax, [ebp - 0x2820]
push eax
push 0
push 0
push 0
push 0
push 0x900c4
push esi
call dword [sym.imp.KERNEL32.DLL_DeviceIoControl]
test eax, eax
je 0x46087e
push 0
push 0
push dword [edi + 0x814]
push dword [edi + 0x810]
push esi
call dword [sym.imp.KERNEL32.DLL_SetFilePointerEx]
test eax, eax
je 0x46087e
push esi
call dword [sym.imp.KERNEL32.DLL_SetEndOfFile]
test eax, eax
je 0x46087e
push 0
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.DLL_SetFilePointer]
test eax, eax
je 0x460930
mov ebx, 1
cmp esi, 0xffffffff
je 0x4608bf
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
or esi, 0xffffffff
jmp 0x4608bf
push 0
push 0
push 3
push 0
push 3
lea eax, [edi + 8]
push 0xc0000000
push eax
mov dword [ebp - 0x2810], eax
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x460927
mov ebx, 1
mov edi, dword [ebp - 0x2818]
mov ecx, 0x516968
mov eax, edi
nop dword [eax]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4608f6
test dx, dx
je 0x4608f2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4608f6
add eax, 4
add ecx, 4
test dx, dx
jne 0x4608d0
xor eax, eax
jmp 0x4608fb
sbb eax, eax
or eax, 1
test eax, eax
je 0x460930
push edi
push dword [ebp - 0x2810]
call fcn.0042aae0
mov ecx, 0x516968
add esp, 8
sub edi, ecx
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edi + ecx - 2], ax
test ax, ax
jne 0x460915
jmp 0x460930
push esi
call fcn.00426790
add esp, 4
mov eax, dword [ebp - 0x281c]
mov dword [eax], esi
mov eax, ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004e1f40
mov esp, ebp
pop ebp
ret