Function at 0x41f5b0
Capabilities:
Resolve function by parsing pe exports
Write file on windows

Disassembly:
mov eax, 0x1068
call fcn.0042bb10
mov eax, dword [0x44b754]
xor eax, esp
push ebx
push esi
mov ebx, ecx
mov ecx, dword [esp + 0x107c]
mov dword [esp + 0x106c], eax
mov eax, dword [esp + 0x1074]
push edi
mov edi, dword [esp + 0x107c]
mov dword [esp + 0x10], ecx
push eax
mov ecx, ebx
call fcn.0041f3b0
mov esi, eax
cmp esi, 0xffffffff
jne 0x41f5fc
xor al, al
jmp 0x41f869
mov ecx, dword [ebx]
mov edx, dword [ecx]
push 0
push esi
call dword [edx + 8]
mov ecx, dword [ebx]
mov eax, dword [ecx]
push 0x1e
lea edx, [esp + 0x24]
push edx
call dword [eax + 4]
movzx ecx, word [esp + 0x3a]
movzx eax, word [esp + 0x3c]
add ecx, esi
lea esi, [ecx + eax + 0x1e]
mov eax, dword [esp + 0x32]
test eax, eax
jne 0x41f633
mov al, 1
jmp 0x41f869
push ebp
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebp, eax
cmp ebp, 0xffffffff
mov dword [esp + 0x10], ebp
je 0x41f866
mov eax, dword [esp + 0x14]
test eax, eax
je 0x41f66a
mov dword [eax], 0
mov eax, dword [esp + 0x2e]
mov ecx, dword [esp + 0x30]
lea edx, [esp + 0x6c]
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_DosDateTimeToFileTime]
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFileTimeToFileTime]
lea ecx, [esp + 0x1c]
push ecx
mov edx, ecx
push edx
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_SetFileTime]
mov ax, word [esp + 0x2c]
test ax, ax
jne 0x41f73a
mov ecx, dword [ebx]
mov eax, dword [ecx]
push 0
push esi
call dword [eax + 8]
mov eax, dword [esp + 0x36]
xor edi, edi
test eax, eax
jle 0x41f72c
mov ebp, dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x41f6d0
sub eax, edi
cmp eax, 0x800
jbe 0x41f6de
mov eax, 0x800
mov ecx, dword [ebx]
mov edx, dword [ecx]
push eax
lea eax, [esp + 0x78]
push eax
call dword [edx + 4]
push 0
mov esi, eax
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x1c]
push ecx
push esi
lea edx, [esp + 0x80]
push edx
push eax
add edi, esi
call ebp
mov eax, dword [esp + 0x14]
test eax, eax
je 0x41f710
add dword [eax], esi
mov eax, dword [esp + 0x1088]
test eax, eax
je 0x41f720
cmp byte [eax], 1
je 0x41f728
mov eax, dword [esp + 0x36]
cmp edi, eax
jl 0x41f6d0
mov ebp, dword [esp + 0x10]
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x41f868
cmp ax, 8
jne 0x41f85f
mov ecx, dword [ebx]
mov edx, dword [ecx]
mov ebp, dword [esp + 0x3a]
xor edi, edi
push edi
push esi
call dword [edx + 8]
xor eax, eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], eax
lea eax, [esp + 0x44]
push 0xfffffffffffffff1
push eax
call fcn.0041e5e0
add esp, 8
test eax, eax
je 0x41f780
mov ecx, dword [esp + 0x10]
push ecx
jmp 0x41f860
cmp ebp, 0x800
lea edx, [esp + 0x874]
mov dword [esp + 0x50], edx
mov esi, 0x800
jg 0x41f79a
mov esi, ebp
mov dword [esp + 0x54], esi
mov edi, edi
mov eax, dword [esp + 0x48]
test eax, eax
jne 0x41f7d5
mov eax, dword [esp + 0x36]
sub eax, edi
cmp eax, 0x800
jbe 0x41f7ba
mov eax, 0x800
mov ecx, dword [ebx]
mov edx, dword [ecx]
push eax
lea eax, [esp + 0x78]
push eax
call dword [edx + 4]
lea ecx, [esp + 0x74]
add edi, eax
mov dword [esp + 0x44], ecx
mov dword [esp + 0x48], eax
lea edx, [esp + 0x44]
push 0
push edx
call fcn.0041e690
add esp, 8
test eax, eax
je 0x41f7ea
jl 0x41f849
mov eax, dword [esp + 0x54]
test eax, eax
ja 0x41f7a0
mov edx, dword [esp + 0x10]
push 0
lea eax, [esp + 0x1c]
push eax
push esi
lea ecx, [esp + 0x880]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 0x14]
test eax, eax
je 0x41f817
add dword [eax], esi
mov eax, dword [esp + 0x1088]
sub ebp, esi
test eax, eax
je 0x41f829
cmp byte [eax], 1
je 0x41f831
test ebp, ebp
jg 0x41f780
lea ecx, [esp + 0x44]
push ecx
call fcn.0041e5a0
add esp, 4
test eax, eax
je 0x41f850
mov edx, dword [esp + 0x10]
push edx
jmp 0x41f860
mov eax, dword [esp + 0x10]
push eax
jmp 0x41f860
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x41f868
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
pop ebp
mov ecx, dword [esp + 0x1070]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0042baa4
add esp, 0x1068
ret 0x10