Function at 0x41a4b0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x1c
push esi
push str.SetByHandle__
push 1
mov esi, ecx
lea eax, [esp + 0xe]
push eax
lea ecx, [esp + 0x13]
push ecx
lea edx, [esp + 0x1c]
push edx
mov ecx, esi
mov byte [esp + 0x1b], 0
mov byte [esp + 0x1a], 0
call fcn.00417890
mov dword [esp + 8], eax
test eax, eax
jne 0x41a7b0
cmp byte [esp + 7], al
jne 0x41a7b0
cmp byte [esp + 6], al
jne 0x41a7b0
mov eax, dword [0x4c8aba]
inc eax
push ebx
mov ebx, dword [esp + 0x1c]
mov dword [0x4c8aba], eax
mov dword [esi + 2], eax
cmp bl, 2
je 0x41a520
mov ecx, esi
call fcn.004199b0
mov ebx, dword [esp + 0x1c]
cmp dword [esp + 0x30], 0
push ebp
mov ebp, dword [esp + 0x2c]
je 0x41a55e
push ebx
push ebp
mov ecx, 0x4c8ab8
call fcn.004171d0
cmp bl, 2
jne 0x41a55e
mov ecx, dword [esp + 0x22]
mov edx, dword [esp + 0x21]
lea eax, [esp + 0xe]
push eax
push ecx
push edx
mov ecx, esi
call fcn.0041a3b0
cmp byte [esp + 0xe], 0
jne 0x41a7ae
push edi
mov edi, dword [esp + 0x34]
lea eax, [esp + 0x12]
push eax
push edi
mov ecx, 0x4c8ab8
call fcn.00418e30
mov dword [esp + 0x14], eax
test eax, eax
jne 0x41a7ad
cmp byte [esp + 0x12], al
jne 0x41a7ad
movzx ebx, bp
mov ecx, ebx
imul ecx, dword [0x4c8df8]
add ecx, dword [0x4c8df4]
push eax
push eax
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xffffffff
jne 0x41a5c4
call ebp
mov dword [esp + 0x14], eax
test eax, eax
je 0x41a5c4
mov byte [esp + 0x12], 0x19
jmp 0x41a677
mov edx, dword [0x4c8df8]
inc edx
push edx
push 0x4c9504
mov ecx, esi
call fcn.004177b0
mov dword [esp + 0x14], eax
test eax, eax
jne 0x41a672
mov ecx, dword [0x4c8df8]
push eax
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x3c]
push eax
push ecx
push 0x4c9504
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x41a665
mov edx, dword [0x4c8df8]
cmp edx, dword [esp + 0x38]
jne 0x41a65b
mov al, byte [esp + 0x24]
cmp al, 2
jne 0x41a625
push 0x4c9504
push str.1G3RPC9696F5J76W9C6N77U2D9UYMZH
jmp 0x41a63f
cmp al, 1
je 0x41a635
cmp al, 5
je 0x41a635
cmp al, 4
je 0x41a635
cmp al, 6
jne 0x41a64c
push 0x4c9504
push str.RCJB9AJ64P9N8FBCN72B9BY5Z3TRGPF
push 0x4c851d
call fcn.004226c0
add esp, 0xc
push 0x4c851d
call fcn.00423bc0
add esp, 4
jmp 0x41a68d
mov byte [esp + 0x12], 0x1a
jmp 0x41a7ad
mov byte [esp + 0x12], 0x19
call ebp
mov dword [esp + 0x14], eax
jmp 0x41a677
mov byte [esp + 0x12], 0x1b
cmp dword [esp + 0x14], 0
jne 0x41a7ad
cmp byte [esp + 0x12], 0
jne 0x41a7ad
mov al, byte [esp + 0x24]
cmp al, 2
jne 0x41a6ff
mov dword [0x4c8628], ebx
mov ecx, dword [esi + 2]
mov dword [0x4c8de4], ecx
cmp esi, 0x4c8630
je 0x41a6c8
push 0x17a
push esi
push 0x17a
push 0x4c8630
call fcn.0046dad7
mov al, byte [esp + 0x34]
add esp, 0x10
mov dword [0x4c8624], 0x4c8630
mov byte [0x4c8924], 0
cmp al, 2
jne 0x41a787
mov eax, dword [esp + 0x25]
lea edx, [esp + 0x38]
push edx
push eax
mov ecx, 0x4c8630
call fcn.004179a0
mov byte [0x4c8924], al
jmp 0x41a787
cmp al, 1
je 0x41a70f
cmp al, 5
je 0x41a70f
cmp al, 4
je 0x41a70f
cmp al, 6
jne 0x41a74a
mov dword [0x4c862c], ebx
mov ecx, dword [esi + 2]
mov dword [0x4c8de8], ecx
cmp esi, 0x4c87aa
je 0x41a73e
push 0x17a
push esi
push 0x17a
push 0x4c87aa
call fcn.0046dad7
add esp, 0x10
mov dword [0x4c8624], 0x4c87aa
jmp 0x41a787
cmp al, 3
jne 0x41a787
mov dword [0x4c8928], ebx
mov edx, dword [esi + 2]
mov dword [0x4c8dec], edx
cmp esi, 0x4c892c
je 0x41a77d
push 0x17a
push esi
push 0x17a
push 0x4c892c
call fcn.0046dad7
add esp, 0x10
mov dword [0x4c8624], 0x4c892c
mov eax, dword [esp + 0x44]
mov dword [0x4c8620], ebx
test eax, eax
je 0x41a7ad
cmp esi, eax
je 0x41a7ad
push 0x17a
push esi
push 0x17a
push eax
call fcn.0046dad7
add esp, 0x10
pop edi
pop ebp
pop ebx
mov eax, dword [esp + 0x30]
pop esi
test eax, eax
je 0x41a7bf
mov cl, byte [esp + 3]
mov byte [eax], cl
mov eax, dword [esp + 0x30]
test eax, eax
je 0x41a7cd
mov dl, byte [esp + 2]
mov byte [eax], dl
mov eax, dword [esp + 4]
add esp, 0x1c
ret 0x18