Function at 0x412f07
Capabilities:
Accept command line arguments
Get file size
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x16b0
call fcn.0041a800
mov eax, dword [0x439450]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x16a0], esi
call fcn.00411305
test al, al
je 0x4135e4
push ebx
xor ebx, ebx
cmp dword [0x4393c0], ebx
jne 0x412f4a
call fcn.00411350
jmp 0x4135e3
push edi
cmp byte [0x43dd40], bl
jne 0x412f6b
push ebx
push 0x105
push 0x43dc38
mov edi, 0x43dd40
call fcn.00411367
add esp, 0xc
lea eax, [ebp - 0x1670]
push eax
push dword [0x43c848]
mov dword [esi + 8], 0x43dd40
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x412f9a
test byte [ebp - 0x1670], 0x10
mov byte [ebp - 0x1691], 1
jne 0x412fa0
mov byte [ebp - 0x1691], bl
cmp eax, 0xffffffff
je 0x412fac
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp byte [ebp - 0x1691], bl
je 0x4135dd
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
cmp dword [ebp + 8], ebx
jne 0x4130b5
mov dword [ebp - 0x1698], 1
call fcn.004120d9
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x16a8], eax
mov eax, dword [ebp - 0x16a8]
mov dword [ebp - 0x16a4], eax
cmp eax, ebx
jne 0x412ffc
mov dword [ebp - 0x16a4], 0x43dc38
push dword [ebp - 0x1698]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push dword [ebp - 0x16a4]
push dword [0x43c84c]
push dword [0x43c848]
push 0x431708
call fcn.004087f7
pop ecx
push eax
lea eax, [ebp - 0x50c]
push eax
call esi
add esp, 0x1c
push ebx
push 1
push 3
push ebx
push 7
push SysReAllocString
lea eax, [ebp - 0x50c]
push eax
mov byte [ebp - 0x1691], bl
call edi
cmp eax, 0xffffffff
je 0x413062
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 0x1691], 1
inc dword [ebp - 0x1698]
cmp byte [ebp - 0x1691], bl
jne 0x412fe2
mov eax, dword [ebp - 0x16a0]
mov eax, dword [eax]
cmp eax, ebx
je 0x413095
lea ecx, [ebp - 0x50c]
push ecx
push 0x104
push eax
call fcn.0041687f
add esp, 0xc
push ebx
push 0x80
push 2
push ebx
push ebx
push 0xc0000000
lea eax, [ebp - 0x50c]
push eax
call edi
mov dword [ebp - 0x1698], eax
jmp 0x413110
mov eax, dword [ebp - 0x16a0]
push dword [eax]
lea eax, [ebp - 0x50c]
push 0x105
push eax
call fcn.0041687f
add esp, 0xc
push ebx
push 0x80
push 3
push ebx
push ebx
push 0xc0000000
lea eax, [ebp - 0x50c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
mov dword [ebp - 0x1698], edi
cmp edi, 0xffffffff
je 0x4135dd
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push ebx
push ebx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp dword [ebp - 0x1698], 0xffffffff
je 0x4135dd
push 0x19
push ebx
push 0x43dc18
call fcn.00416670
push ebx
call fcn.00419017
mov dword [ebp - 0x16b0], eax
lea eax, [ebp - 0x16b0]
push eax
lea eax, [ebp - 0x1530]
push eax
mov dword [ebp - 0x16ac], edx
call fcn.0041a8fe
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
add esp, 0x18
mov dword [ebp - 0x169c], ebx
cmp dword [ebp + 8], ebx
jne 0x413488
push dword [ebp - 0x1530]
mov eax, dword [ebp - 0x151c]
push dword [ebp - 0x152c]
add eax, 0x76c
push dword [ebp - 0x1528]
push eax
push dword [ebp - 0x1524]
mov eax, dword [ebp - 0x1520]
inc eax
push eax
push 0x4316c8
call fcn.004087f7
pop ecx
push eax
lea eax, [ebp - 0x404]
push eax
call esi
add esp, 0x20
push ebx
lea ecx, [ebp - 0x169c]
push ecx
push eax
lea eax, [ebp - 0x404]
push eax
push dword [ebp - 0x1698]
call edi
lea eax, [ebp - 0x404]
push eax
mov ebx, 0x1000
lea eax, [ebp - 0x150c]
push ebx
push eax
call fcn.0041687f
add esp, 0xc
cmp byte [0x43dd40], 0
je 0x413299
push 0x43dd40
push 0x4316b0
call fcn.004087f7
pop ecx
push eax
lea eax, [ebp - 0x404]
push eax
call esi
add esp, 0xc
push 0
lea ecx, [ebp - 0x169c]
push ecx
push eax
lea eax, [ebp - 0x404]
push eax
push dword [ebp - 0x1698]
call edi
lea eax, [ebp - 0x404]
push eax
lea eax, [ebp - 0x150c]
push ebx
push eax
call fcn.0041995b
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
test eax, eax
je 0x41324b
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
jmp 0x413250
mov eax, 0x42be24
push eax
push 0x431694
call fcn.004087f7
pop ecx
push eax
lea eax, [ebp - 0x404]
push eax
call esi
add esp, 0xc
push 0
lea ecx, [ebp - 0x169c]
push ecx
push eax
lea eax, [ebp - 0x404]
push eax
push dword [ebp - 0x1698]
call edi
lea eax, [ebp - 0x404]
push eax
lea eax, [ebp - 0x150c]
push ebx
push eax
call fcn.0041995b
add esp, 0xc
lea eax, [ebp - 0x1690]
push eax
call fcn.00412c97
cmp dword [ebp - 0x1678], 0
pop ecx
je 0x413307
push 0
push dword [ebp - 0x1678]
call fcn.00411611
pop ecx
pop ecx
push eax
push 0x431660
call fcn.004087f7
pop ecx
push eax
lea eax, [ebp - 0x404]
push eax
call esi
add esp, 0xc
push 0
lea ecx, [ebp - 0x169c]
push ecx
push eax
lea eax, [ebp - 0x404]
push eax
push dword [ebp - 0x1698]
call edi
lea eax, [ebp - 0x404]
push eax
lea eax, [ebp - 0x150c]
push ebx
push eax
call fcn.0041995b
add esp, 0xc
mov ecx, dword [ebp - 0x1688]
add ecx, dword [ebp - 0x168c]
push 0
push ecx
call fcn.00411611
pop ecx
pop ecx
push eax
push 0x431630
call fcn.004087f7
pop ecx
push eax
lea eax, [ebp - 0x404]
push eax
call esi
add esp, 0xc
push 0
lea ecx, [ebp - 0x169c]
push ecx
push eax
lea eax, [ebp - 0x404]
push eax
push dword [ebp - 0x1698]
call edi
lea eax, [ebp - 0x404]
push eax
lea eax, [ebp - 0x150c]
push ebx
push eax
call fcn.0041995b
push 0
push dword [ebp - 0x1690]
call fcn.00411611
add esp, 0x14
push eax
push 0x431600
call fcn.004087f7
pop ecx
push eax
lea eax, [ebp - 0x404]
push eax
call esi
add esp, 0xc
push 0
lea ecx, [ebp - 0x169c]
push ecx
push eax
lea eax, [ebp - 0x404]
push eax
push dword [ebp - 0x1698]
call edi
lea eax, [ebp - 0x404]
push eax
lea eax, [ebp - 0x150c]
push ebx
push eax
call fcn.0041995b
mov eax, dword [ebp - 0x1688]
sub eax, dword [ebp - 0x1690]
push 0
add eax, dword [ebp - 0x168c]
push eax
call fcn.00411611
add esp, 0x14
push eax
push 0x4315d0
call fcn.004087f7
pop ecx
push eax
lea eax, [ebp - 0x404]
push eax
call esi
add esp, 0xc
push 0
lea ecx, [ebp - 0x169c]
push ecx
push eax
lea eax, [ebp - 0x404]
push eax
push dword [ebp - 0x1698]
call edi
lea eax, [ebp - 0x404]
push eax
lea eax, [ebp - 0x150c]
push ebx
push eax
call fcn.0041995b
add esp, 0xc
lea eax, [ebp - 0x50c]
push eax
push 0x4315a4
call fcn.004087f7
pop ecx
push eax
lea eax, [ebp - 0x404]
push eax
call esi
lea eax, [ebp - 0x404]
push eax
lea eax, [ebp - 0x150c]
push ebx
push eax
call fcn.0041995b
push 0x431408
call fcn.004087f7
push eax
lea eax, [ebp - 0x404]
push eax
call esi
lea eax, [ebp - 0x404]
push eax
lea eax, [ebp - 0x150c]
push ebx
push eax
call fcn.0041995b
lea eax, [ebp - 0x150c]
push eax
call fcn.0041217c
add esp, 0x34
xor ebx, ebx
push 0x431510
call fcn.004087f7
push eax
lea eax, [ebp - 0x404]
push eax
call esi
add esp, 0xc
push ebx
lea ecx, [ebp - 0x169c]
push ecx
push eax
lea eax, [ebp - 0x404]
push eax
push dword [ebp - 0x1698]
call edi
cmp byte [0x43dd40], 0
je 0x41353d
push 0x43dd40
push 0x4316b0
call fcn.004087f7
pop ecx
push eax
lea eax, [ebp - 0x404]
push eax
call esi
add esp, 0xc
push ebx
lea ecx, [ebp - 0x169c]
push ecx
push eax
lea eax, [ebp - 0x404]
push eax
push dword [ebp - 0x1698]
call edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
test eax, eax
je 0x413507
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
jmp 0x41350c
mov eax, 0x42be24
push eax
push 0x431694
call fcn.004087f7
pop ecx
push eax
lea eax, [ebp - 0x404]
push eax
call esi
add esp, 0xc
push ebx
lea ecx, [ebp - 0x169c]
push ecx
push eax
lea eax, [ebp - 0x404]
push eax
push dword [ebp - 0x1698]
call edi
mov eax, dword [0x4393c0]
cmp eax, ebx
je 0x413594
push ebx
push eax
call fcn.00411611
pop ecx
pop ecx
push eax
push 0x4314dc
call fcn.004087f7
pop ecx
push eax
lea eax, [ebp - 0x404]
push eax
call esi
add esp, 0xc
push ebx
lea ecx, [ebp - 0x169c]
push ecx
push eax
lea eax, [ebp - 0x404]
push eax
push dword [ebp - 0x1698]
call edi
cmp dword [0x4393c0], ebx
je 0x413594
push dword [ebp - 0x1698]
call fcn.00411b36
pop ecx
push 0x431498
call fcn.004087f7
push eax
lea eax, [ebp - 0x404]
push eax
call esi
add esp, 0xc
push ebx
lea ecx, [ebp - 0x169c]
push ecx
push eax
lea eax, [ebp - 0x404]
push eax
push dword [ebp - 0x1698]
call edi
call fcn.0041b1c6
mov ecx, dword [ebp - 0x16a0]
push dword [ebp - 0x1698]
mov dword [ecx + 4], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.00411350
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00416261
leave
ret