Function at 0x410f10
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
mov edi, eax
mov esi, ecx
mov ebp, dword [esi + 0x67c]
mov dword [esp + 0x10], 0
cmp edi, 4
jne 0x410f3a
mov eax, dword [esi + 0x318]
mov dword [esp + 0x14], eax
jmp 0x410f4d
mov ecx, edi
imul ecx, ecx, 0x354
lea edx, [ecx + esi + 0x69c]
mov dword [esp + 0x14], edx
mov eax, dword [esp + 0x1c]
push esi
push eax
mov ecx, edi
call fcn.0040fee0
mov ebx, eax
add esp, 8
test ebx, ebx
jne 0x410f9d
cmp dword [ebp + 8], eax
je 0x41117a
mov edi, str.Break_1
mov esi, str.K7IS_Parser_Extract_Module
call fcn.00412cb0
cmp dword [ebp + 8], ebx
je 0x41117a
mov edi, dword [esp + 0x14]
add edi, 0x284
call fcn.00412cb0
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx + 0x308]
sub eax, 0
je 0x4110ef
sub eax, 1
jne 0x41117a
push 0
push 0x80
push 4
push 0
push 0
lea eax, [ebp + 0x20]
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ecx, eax
inc ecx
neg ecx
sbb ecx, ecx
and ecx, eax
mov dword [esi + 0x31c], ecx
jne 0x411007
cmp dword [ebp + 8], 0
je 0x410ffb
mov edi, str.Break_5
mov esi, str.K7IS_Parser_Extract_Module
call fcn.00412cb0
xor ebx, ebx
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov edi, dword [esi + 0x350]
mov eax, dword [esi + 0x358]
push 0
lea edx, [esp + 0x14]
push edx
shl edi, 8
push edi
push eax
push ecx
mov dword [esi + 0x320], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x411054
cmp dword [ebp + 8], eax
je 0x411048
mov edi, str.Break_7
mov esi, str.K7IS_Parser_Extract_Module
call fcn.00412cb0
xor ebx, ebx
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
cmp edi, dword [esp + 0x10]
je 0x41107b
cmp dword [ebp + 8], 0
je 0x41106f
mov edi, str.Break_8
mov esi, str.K7IS_Parser_Extract_Module
call fcn.00412cb0
xor ebx, ebx
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov edi, dword [esi + 0x35c]
mov edx, dword [esi + 0x364]
mov eax, dword [esi + 0x31c]
push 0
lea ecx, [esp + 0x14]
push ecx
shl edi, 8
push edi
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x4110c4
cmp dword [ebp + 8], eax
je 0x4110b8
mov edi, str.Break_9
mov esi, str.K7IS_Parser_Extract_Module
call fcn.00412cb0
xor ebx, ebx
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
cmp edi, dword [esp + 0x10]
je 0x41117a
cmp dword [ebp + 8], 0
je 0x4110e3
mov edi, str.Break_10
mov esi, str.K7IS_Parser_Extract_Module
call fcn.00412cb0
xor ebx, ebx
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
push 1
push esi
call fcn.00410ac0
mov ebx, eax
add esp, 8
test ebx, ebx
jne 0x41111e
cmp dword [ebp + 8], eax
je 0x41117a
mov edi, str.Break_2
mov esi, str.K7IS_Parser_Extract_Module
call fcn.00412cb0
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
cmp dword [ebp + 0x103c], 1
je 0x41117a
push edi
push esi
call fcn.0040f6e0
mov ebx, eax
add esp, 8
test ebx, ebx
jne 0x411155
cmp dword [ebp + 8], eax
je 0x41117a
mov edi, str.Break_3
mov esi, str.K7IS_Parser_Extract_Module
call fcn.00412cb0
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
push 2
push esi
call fcn.00410ac0
mov ebx, eax
add esp, 8
test ebx, ebx
jne 0x41117a
cmp dword [ebp + 8], eax
je 0x41117a
mov edi, str.Break_4
mov esi, str.K7IS_Parser_Extract_Module
call fcn.00412cb0
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 8
ret