Function at 0x43a8ba
Capabilities:
Write file on windows

Disassembly:
cmp byte [0x4c7223], 1
jne 0x43a8dc
cmp byte [0x4c7230], 1
jne 0x43a8d5
mov byte [0x5038bc], 1
jmp 0x43a8dc
mov byte [0x5038bc], 0
lea edi, [0x5c9664]
xor al, al
mov ecx, 0x57
rep stosb byte es:[edi], al
lea edi, [0x5c9664]
mov al, byte [0x4fb2af]
stosb byte es:[edi], al
mov al, byte [0x4fb2ae]
stosb byte es:[edi], al
mov ax, word [0x4fb2ac]
stosw word es:[edi], ax
mov ax, word [0x4fb2a8]
stosw word es:[edi], ax
cmp byte [0x5038bc], 1
jne 0x43a920
mov ax, word [0x4fb2b8]
stosw word es:[edi], ax
jmp 0x43a925
xor ax, ax
stosw word es:[edi], ax
mov ax, word [0x4fb2b6]
stosw word es:[edi], ax
mov al, byte [0x4fb2ba]
stosb byte es:[edi], al
mov al, byte [0x4fb2bb]
stosb byte es:[edi], al
mov al, byte [0x4fa964]
sub al, 0x10
and al, 7
shl al, 1
mov bl, byte [0x4fb2bc]
shr bl, 7
or al, bl
and al, 0xf
cmp byte [0x5038bc], 1
jne 0x43a95c
or al, 0x20
stosb byte es:[edi], al
mov ax, word [0x4fb2aa]
stosw word es:[edi], ax
mov ax, word [0x4fb2a4]
stosw word es:[edi], ax
mov ax, word [0x4fb2a2]
stosw word es:[edi], ax
mov ax, word [0x4fb2a0]
stosw word es:[edi], ax
mov al, byte [0x4fb2a7]
stosb byte es:[edi], al
mov al, byte [0x4fb2a6]
stosb byte es:[edi], al
mov ax, word [0x4fb2b0]
stosw word es:[edi], ax
mov ax, word [0x4fb2b2]
stosw word es:[edi], ax
mov al, byte [0x4fb2c1]
shl al, 2
and al, 4
mov byte [0x4fb2bd], al
mov al, byte [0x4fb2bd]
and al, 4
je 0x43a9b3
mov al, 0xff
stosb byte es:[edi], al
mov al, 0xff
stosb byte es:[edi], al
mov al, byte [0x4fb2be]
stosb byte es:[edi], al
mov ax, 0x36
cmp byte [0x4c7230], 4
je 0x43a9d3
cmp byte [0x4c7230], 5
jne 0x43a9e1
mov al, byte [0x4fb492]
mov byte [0x5c96ba], al
mov ax, 0x37
stosw word es:[edi], ax
mov ax, word [0x4fb2b8]
stosw word es:[edi], ax
mov byte [0x5c9688], 0
movzx eax, byte [0x4c7230]
or eax, eax
jne 0x43aa08
or byte [0x5c9689], 0x80
xor al, al
jmp 0x43aa5f
cmp eax, 1
jne 0x43aa11
xor al, al
jmp 0x43aa5f
cmp eax, 7
jne 0x43aa24
mov al, byte [0x4fa9a5]
mov byte [0x5c9688], al
mov al, 0xe
jmp 0x43aa5f
cmp eax, 2
jne 0x43aa2d
mov al, 4
jmp 0x43aa5f
cmp eax, 3
jne 0x43aa3d
or byte [0x5c9689], 0x80
mov al, 4
jmp 0x43aa5f
cmp eax, 4
jne 0x43aa46
mov al, 0xd
jmp 0x43aa5f
cmp eax, 5
jne 0x43aa4f
mov al, 7
jmp 0x43aa5f
cmp eax, 6
jne 0x43aa58
mov al, 9
jmp 0x43aa5f
cmp eax, 8
jne 0x43aa5f
xor al, al
stosb byte es:[edi], al
mov al, byte [0x4fb491]
stosb byte es:[edi], al
inc edi
mov al, 7
or byte [edi], al
inc edi
mov al, byte [0x4fb490]
stosb byte es:[edi], al
lea esi, [0x4fb450]
mov ecx, 0x10
rep movsb byte es:[edi], byte [esi]
cmp byte [0x5038bc], 1
jne 0x43aad7
push 0
push 0x49ffbc
push 0x1e
push 0x5c9664
push dword [0x5c9660]
call sub.kernel32.dll_WriteFile
lea edi, [0x5c9667]
mov esi, dword [0x4fb33c]
xor cx, cx
mov dx, 0xc000
call fcn.0043ab95
push 0
push 0x49ffbc
push 4
push 0x442dcc
push dword [0x5c9660]
call sub.kernel32.dll_WriteFile
jmp 0x43ab7a
push 0x5c969b
call fcn.0043b991
push 0
push 0x49ffbc
push 0x20
push 0x5c9664
push dword [0x5c9660]
call sub.kernel32.dll_WriteFile
movzx edx, word [0x5c9682]
push 0
push 0x49ffbc
push edx
push 0x5c9684
push dword [0x5c9660]
call sub.kernel32.dll_WriteFile
cmp byte [0x4c7230], 0
je 0x43ab3d
cmp byte [0x4c7230], 1
je 0x43ab3d
cmp byte [0x4c7230], 7
je 0x43ab3d
cmp byte [0x4c7230], 8
jne 0x43ab63
cmp byte [0x4c7230], 0
je 0x43ab58
mov bl, 4
mov bh, 2
call fcn.0043ab7b
mov bl, 5
mov bh, 0
call fcn.0043ab7b
mov bl, 8
mov bh, 5
call fcn.0043ab7b
jmp 0x43ab7a
mov bl, 3
mov bh, 0
mov cl, 8
push ecx
push ebx
call fcn.0043ab7b
pop ebx
pop ecx
inc bl
inc bh
dec cl
jne 0x43ab69
ret