Function at 0x41b700
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 8
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov dword [esp + 4], str.module_load_mismatched
mov ebx, dword [sym.imp.ucrtbase.dll__stricmp]
mov dword [esp], esi
call ebx
test eax, eax
jne 0x41b788
call dword [sym.imp.dbghelp.dll_SymGetOptions]
mov esi, eax
test edi, edi
je 0x41b750
mov dword [esp + 4], str.true
mov dword [esp], edi
call ebx
test eax, eax
jne 0x41b7f8
or esi, 0x40
jmp 0x41b76f
test al, 0x40
mov edx, str.false
mov eax, str.true
mov dword [esp], str.Option:_module_load_mismatched__s_n
cmove eax, edx
mov dword [esp + 4], eax
call sym._dbg_printf
mov dword [esp], esi
call dword [sym.imp.dbghelp.dll_SymSetOptions]
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 4], str.symbol_picker
mov dword [esp], esi
call ebx
test eax, eax
jne 0x41b818
test edi, edi
je 0x41b7c8
mov dword [esp + 4], str.interactive
mov dword [esp], edi
call ebx
test eax, eax
jne 0x41b868
mov dword [sym._symbol_picker_interactive], 0x432e40
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
cmp dword [sym._symbol_picker_interactive], 0x432e40
mov eax, str.interactive
mov edx, str.scoped
mov dword [ebp + 8], str.Option:_symbol_picker__s_n
cmovne eax, edx
mov dword [ebp + 0xc], eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
jmp sym._dbg_printf
mov dword [esp + 4], str.false
mov dword [esp], edi
call ebx
test eax, eax
jne 0x41b938
and esi, 0xffffffbf
jmp 0x41b76f
mov dword [esp + 4], str.data_model
mov dword [esp], esi
call ebx
test eax, eax
jne 0x41b890
mov eax, dword [0x43ac08]
test eax, eax
je 0x41b948
test edi, edi
je 0x41b8e8
mov dword [esp + 4], str.auto
mov dword [esp], edi
call ebx
test eax, eax
jne 0x41b8a0
mov eax, dword [0x43ac08]
mov dword [eax + 0x1420], 0
jmp 0x41b77b
mov dword [esp + 4], str.scoped
mov dword [esp], edi
call ebx
test eax, eax
jne 0x41b8d0
mov dword [sym._symbol_picker_interactive], 0x4330e0
jmp 0x41b77b
mov dword [ebp + 0xc], esi
mov dword [ebp + 8], str.Unknown_option__s_n
jmp 0x41b7e9
mov dword [esp + 4], str.ilp32
mov dword [esp], edi
call ebx
test eax, eax
jne 0x41b951
mov eax, dword [0x43ac08]
mov dword [eax + 0x1420], 0x49dca0
jmp 0x41b77b
mov dword [ebp + 8], str.Syntax:_symbol_picker__interactivescoped__n
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
jmp sym._dbg_printf
mov edx, dword [eax + 0x1420]
mov eax, str.auto
test edx, edx
je 0x41b924
mov eax, str.ilp32
cmp edx, 0x49dca0
je 0x41b924
mov eax, str.llp64
cmp edx, 0x49de00
je 0x41b924
cmp edx, 0x49e140
mov eax, 0x443ecf
mov edx, str.lp64
cmove eax, edx
mov dword [ebp + 0xc], eax
mov dword [ebp + 8], str.Option:_data_model__s_n
jmp 0x41b7e9
mov dword [ebp + 8], str.Syntax:_module_load_mismatched__truefalse__n
jmp 0x41b8d7
mov dword [ebp + 8], str.Not_attached_to_a_process_n
jmp 0x41b8d7
mov dword [esp + 4], str.llp64
mov dword [esp], edi
call ebx
test eax, eax
jne 0x41b976
mov eax, dword [0x43ac08]
mov dword [eax + 0x1420], 0x49de00
jmp 0x41b77b
mov dword [esp + 4], str.lp64
mov dword [esp], edi
call ebx
test eax, eax
jne 0x41b99b
mov eax, dword [0x43ac08]
mov dword [eax + 0x1420], 0x49e140
jmp 0x41b77b
mov dword [ebp + 0xc], edi
mov dword [ebp + 8], str.Unknown_data_model__s_n
jmp 0x41b7e9