Function at 0x4061ad
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x650
push ebx
mov ebx, dword [ebp + 8]
cmp dword [ebx + 4], 0xffffffff
push esi
push edi
je 0x4061c9
mov edi, dword [ebx]
call fcn.00405a7e
mov esi, dword [ebx]
mov edi, dword [ebp + 0xc]
or dword [ebx + 4], 0xffffffff
cmp edi, dword [esi + 4]
jl 0x4061e1
mov eax, 0x10000
jmp 0x406432
cmp edi, dword [esi + 0x10]
jge 0x4061f4
call fcn.004054a9
jmp 0x4061f4
mov esi, dword [ebx]
call fcn.004054de
mov eax, dword [ebx]
cmp dword [eax + 0x10], edi
jl 0x4061ed
push edi
push ebx
lea ebx, [ebp - 0x444]
call fcn.00405bda
mov eax, dword [ebp - 0x238]
shr eax, 4
test al, 1
je 0x406250
mov ecx, dword [ebp + 0x10]
movzx eax, word [ecx]
cmp ax, 0x2f
je 0x406233
cmp ax, 0x5c
je 0x406233
test ax, ax
je 0x406238
cmp word [ecx + 2], 0x3a
jne 0x406238
push ecx
push 0
jmp 0x406242
mov eax, dword [ebp + 8]
push ecx
sub eax, 0xfffffdbc
push eax
call fcn.0040604c
pop eax
pop edi
xor eax, eax
jmp 0x406432
mov esi, dword [ebp + 0x10]
xor ebx, ebx
mov word [ebp - 0x64c], bx
movzx eax, word [esi]
mov ebx, esi
mov ecx, esi
test ax, ax
je 0x406284
movzx eax, ax
cmp ax, 0x2f
je 0x406277
cmp ax, 0x5c
jne 0x40627a
lea ebx, [ecx + 2]
inc ecx
inc ecx
movzx eax, word [ecx]
or ax, ax
jne 0x40626b
push 0x104
lea eax, [ebp - 0x214]
push esi
push eax
call fcn.00408a75
add esp, 0xc
cmp ebx, esi
jne 0x40630d
xor eax, eax
mov word [ebp - 0x214], ax
mov edi, dword [ebp + 8]
push ebx
lea esi, [ebp - 0x214]
push esi
lea esi, [edi + 0x244]
push esi
lea eax, [ebp - 0x64c]
push 0x417488
push eax
call dword [sym.imp.user32.dll_wsprintfW]
sub esp, 0xffffffec
lea eax, [ebp - 0x214]
push eax
push esi
call fcn.0040604c
pop esi
pop ecx
xor ebx, ebx
push ebx
push dword [ebp - 0x238]
push 2
push ebx
push ebx
push 0x40000000
lea eax, [ebp - 0x64c]
push eax
call dword [sym.imp.kernel32.dll_CreateFileW]
mov dword [ebp + 0xc], eax
cmp eax, 0xffffffff
jne 0x40637f
mov eax, 0x200
jmp 0x406432
mov eax, ebx
sub eax, esi
sar eax, 1
xor ecx, ecx
mov word [ebp + eax*2 - 0x214], cx
cmp word [ebp - 0x214], 0x2f
je 0x40634c
cmp word [ebp - 0x214], 0x5c
je 0x40634c
cmp word [ebp - 0x214], cx
je 0x4062a6
cmp word [ebp - 0x212], 0x3a
jne 0x4062a6
push ebx
lea ebx, [ebp - 0x214]
push ebx
lea eax, [ebp - 0x64c]
push 0x41747c
push eax
call dword [sym.imp.user32.dll_wsprintfW]
lea eax, [ebp - 0x214]
push eax
push 0
call fcn.0040604c
mov edi, dword [ebp + 8]
sub esp, 0xffffffe8
jmp 0x4062dc
push dword [edi + 0x23c]
mov ebx, dword [edi]
call fcn.004056f2
cmp dword [edi + 0x240], 0
pop ecx
mov esi, 0x4000
jne 0x4063aa
push esi
push pe_nt_image_headers32
call dword [sym.imp.kernel32.dll_GlobalAlloc]
mov dword [edi + 0x240], eax
and dword [ebp + 0x10], 0
lea ebx, [ebp + 0xb]
push ebx
push dword [edi + 0x240]
mov eax, dword [edi]
mov ecx, esi
call fcn.0040584c
mov ebx, eax
pop ecx
pop ecx
cmp ebx, 0xffffff96
je 0x406439
or ebx, ebx
jl 0x4063f4
jle 0x4063ea
push 0
lea eax, [ebp - 8]
push eax
push ebx
push dword [edi + 0x240]
push dword [ebp + 0xc]
call dword [sym.imp.kernel32.dll_WriteFile]
or eax, eax
je 0x406442
cmp byte [ebp + 0xb], 0
jne 0x4063fb
test ebx, ebx
jne 0x4063ae
mov dword [ebp + 0x10], 0x5000000
mov edi, dword [edi]
call fcn.00405a7e
cmp dword [ebp + 0x10], 0
jne 0x406426
lea ebx, [ebp - 0x224]
push ebx
lea ebx, [ebp - 0x234]
push ebx
lea eax, [ebp - 0x22c]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.kernel32.dll_SetFileTime]
push dword [ebp + 0xc]
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, dword [ebp + 0x10]
pop edi
pop esi
pop ebx
leave
ret 0xc
mov dword [ebp + 0x10], 0x1000
jmp 0x4063fb
mov dword [ebp + 0x10], 0x400
jmp 0x4063fb