Function at 0x41bf10
Capabilities:
Resolve function by parsing pe exports
Write file on windows

Disassembly:
sub esp, 0xb90
mov eax, dword [0x488e40]
xor eax, esp
mov dword [esp + 0xb8c], eax
mov eax, dword [esp + 0xb94]
push ebx
push ebp
push esi
push edi
mov esi, ecx
push eax
mov edi, str._Module_List__r_n_______________________________________________________________________________r_n_Legend:_D__Delay_Load_Module______Missing_Module___________6__64_bit_Module___r_n___________Dynamic_Module_________Invalid_Module______________________________r_n________________________________E__Import_Export_Mismatch_or_Load_Failure______r_n_______________________________________________________________________________r_n_r_n_r_n
mov dword [esp + 0x44], eax
mov dword [esp + 0x40], esi
call fcn.00416f60
mov eax, dword [esp + 0xbb0]
mov ecx, dword [esp + 0xbac]
add esp, 4
push eax
push ecx
mov edi, esi
call fcn.0041e380
push 0x54
lea edx, [esp + 0xac]
mov edi, eax
push 0
push edx
mov dword [esp + 0x4c], edi
call fcn.004579a0
add esp, 0x14
mov dword [esp + 0xa0], 5
xor ecx, ecx
mov eax, dword [ecx + 0x48a634]
lea esi, [eax + 1]
mov edi, edi
mov dl, byte [eax]
add eax, 1
test dl, dl
jne 0x41bf90
sub eax, esi
mov dword [esp + ecx + 0xa4], eax
add ecx, 4
cmp ecx, 0x50
jl 0x41bf85
cmp dword [edi], 0
mov ebx, dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov dword [esp + 0x10], edi
je 0x41c8ac
lea ecx, [ecx]
mov ebp, dword [edi]
push 0x54
lea eax, [esp + 0x4c]
push 0
push eax
call fcn.004579a0
mov ecx, dword [ebp + 0x20]
add esp, 0xc
cmp byte [esp + 0xbac], 0
je 0x41bfe8
mov eax, dword [ecx + 0x88]
jmp 0x41bfee
mov eax, dword [ecx + 0x84]
test eax, eax
je 0x41bff7
cmp byte [eax], 0
jne 0x41bffc
mov eax, str._empty_string_
lea esi, [eax + 1]
nop
mov dl, byte [eax]
add eax, 1
test dl, dl
jne 0x41c000
mov edx, dword [ecx + 8]
or edx, dword [ebp + 0x10]
sub eax, esi
test edx, 0x10000
mov dword [esp + 0x4c], eax
jne 0x41c87c
lea eax, [esp + 0x18]
push eax
add ecx, 0x14
push ecx
call ebx
mov eax, dword [0x48d794]
cmp eax, 1
jne 0x41c052
movsx eax, byte [0x48d79e]
movzx ecx, word [esp + 0x18]
movzx edx, word [esp + 0x1a]
push ecx
push eax
push edx
push eax
movzx eax, word [esp + 0x2e]
jmp 0x41c08c
cmp eax, 2
movsx eax, byte [0x48d79e]
jne 0x41c079
movzx ecx, word [esp + 0x1e]
movzx edx, word [esp + 0x1a]
push ecx
push eax
push edx
push eax
movzx eax, word [esp + 0x28]
push eax
push str._04u_c_02u_c_02u
jmp 0x41c092
movzx ecx, word [esp + 0x18]
movzx edx, word [esp + 0x1e]
push ecx
push eax
push edx
push eax
movzx eax, word [esp + 0x2a]
push eax
push str._02u_c_02u_c_04u
mov esi, 0xaa0
lea edi, [esp + 0x110]
call fcn.00416ab0
add esp, 0x18
cmp byte [0x48d79c], 0
mov edi, eax
je 0x41c109
mov cx, word [esp + 0x20]
cmp cx, 0xa
jb 0x41c0c3
mov eax, 0x4727f1
jmp 0x41c0d6
cmp byte [0x48d79d], 0
mov eax, 0x47c530
jne 0x41c0d6
mov eax, 0x474d04
movzx edx, word [esp + 0x22]
push edx
movsx edx, byte [0x48d79f]
push edx
movzx ecx, cx
push ecx
push eax
mov esi, 0xaa0
sub esi, edi
push str.__s_u_c_02u
lea edi, [esp + edi + 0x10c]
call fcn.00416ab0
add esp, 0x14
jmp 0x41c191
mov ax, word [esp + 0x20]
cmp ax, 0xc
movzx eax, ax
cdq
setae cl
mov esi, 0xc
idiv esi
test edx, edx
je 0x41c136
cmp dx, 0xa
mov word [esp + 0x20], dx
jb 0x41c145
mov eax, 0x4727f1
jmp 0x41c158
mov dx, si
mov word [esp + 0x20], dx
mov eax, 0x4727f1
jmp 0x41c158
cmp byte [0x48d79d], 0
mov eax, 0x47c530
jne 0x41c158
mov eax, 0x474d04
neg cl
movzx edx, dx
mov esi, 0xaa0
sbb ecx, ecx
and ecx, 0xf
add ecx, 0x61
push ecx
movzx ecx, word [esp + 0x26]
push ecx
movsx ecx, byte [0x48d79f]
push ecx
push edx
push eax
sub esi, edi
push str.__s_u_c_02u_c
lea edi, [esp + edi + 0x110]
call fcn.00416ab0
add esp, 0x18
lea eax, [esp + 0xf8]
lea edx, [eax + 1]
jmp 0x41c1a0
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x41c1a0
mov ecx, dword [ebp + 0x20]
sub eax, edx
mov dword [esp + 0x50], eax
lea eax, [esp + 0x28]
push eax
add ecx, 0x1c
push ecx
call ebx
mov eax, dword [0x48d794]
cmp eax, 1
jne 0x41c1e4
movzx edx, word [esp + 0x28]
movsx eax, byte [0x48d79e]
movzx ecx, word [esp + 0x2a]
push edx
movzx edx, word [esp + 0x32]
push eax
push ecx
push eax
push edx
jmp 0x41c21f
cmp eax, 2
movsx eax, byte [0x48d79e]
jne 0x41c20b
movzx ecx, word [esp + 0x2e]
movzx edx, word [esp + 0x2a]
push ecx
push eax
push edx
push eax
movzx eax, word [esp + 0x38]
push eax
push str._04u_c_02u_c_02u
jmp 0x41c224
movzx ecx, word [esp + 0x28]
movzx edx, word [esp + 0x2e]
push ecx
push eax
push edx
push eax
movzx eax, word [esp + 0x3a]
push eax
push str._02u_c_02u_c_04u
mov esi, 0xaa0
lea edi, [esp + 0x110]
call fcn.00416ab0
add esp, 0x18
cmp byte [0x48d79c], 0
mov edi, eax
je 0x41c29b
mov cx, word [esp + 0x30]
cmp cx, 0xa
jb 0x41c255
mov eax, 0x4727f1
jmp 0x41c268
cmp byte [0x48d79d], 0
mov eax, 0x47c530
jne 0x41c268
mov eax, 0x474d04
movzx edx, word [esp + 0x32]
push edx
movsx edx, byte [0x48d79f]
push edx
movzx ecx, cx
push ecx
push eax
mov esi, 0xaa0
sub esi, edi
push str.__s_u_c_02u
lea edi, [esp + edi + 0x10c]
call fcn.00416ab0
add esp, 0x14
jmp 0x41c323
mov ax, word [esp + 0x30]
cmp ax, 0xc
movzx eax, ax
cdq
setae cl
mov esi, 0xc
idiv esi
test edx, edx
je 0x41c2c8
cmp dx, 0xa
mov word [esp + 0x30], dx
jb 0x41c2d7
mov eax, 0x4727f1
jmp 0x41c2ea
mov dx, si
mov word [esp + 0x30], dx
mov eax, 0x4727f1
jmp 0x41c2ea
cmp byte [0x48d79d], 0
mov eax, 0x47c530
jne 0x41c2ea
mov eax, 0x474d04
neg cl
movzx edx, dx
mov esi, 0xaa0
sbb ecx, ecx
and ecx, 0xf
add ecx, 0x61
push ecx
movzx ecx, word [esp + 0x36]
push ecx
movsx ecx, byte [0x48d79f]
push ecx
push edx
push eax
sub esi, edi
push str.__s_u_c_02u_c
lea edi, [esp + edi + 0x110]
call fcn.00416ab0
add esp, 0x18
lea eax, [esp + 0xf8]
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x41c330
sub eax, edx
mov dword [esp + 0x54], eax
mov eax, dword [ebp + 0x20]
mov ecx, dword [eax + 0x24]
push 0xaa0
lea eax, [esp + 0xfc]
call fcn.00416730
add esp, 4
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x41c360
sub eax, edx
mov dword [esp + 0x58], eax
push 0xaa0
lea ecx, [esp + 0xfc]
mov eax, ebp
call fcn.00425fd0
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x41c385
mov ecx, dword [ebp + 0x20]
sub eax, edx
mov edx, dword [ecx + 0x34]
push edx
push str.0x_08X
mov esi, 0xaa0
lea edi, [esp + 0x100]
mov dword [esp + 0x64], eax
call fcn.00416ab0
mov eax, edi
add esp, 8
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x41c3c0
sub eax, edx
mov dword [esp + 0x60], eax
mov eax, dword [ebp + 0x20]
mov ecx, dword [eax + 0x38]
push ecx
push str.0x_08X
lea edi, [esp + 0x100]
call fcn.00416ab0
mov eax, edi
add esp, 8
lea edx, [eax + 1]
nop
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x41c3f0
sub eax, edx
mov dword [esp + 0x64], eax
mov ecx, esi
lea eax, [esp + 0xf8]
mov edx, ebp
call fcn.004260a0
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x41c412
sub eax, edx
mov dword [esp + 0x68], eax
mov ecx, esi
lea edx, [esp + 0xf8]
mov eax, ebp
call fcn.004263b0
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x41c434
sub eax, edx
mov dword [esp + 0x6c], eax
mov eax, esi
push ebp
lea esi, [esp + 0xfc]
call fcn.004264d0
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x41c455
sub eax, edx
mov edx, dword [esp + 0x3c]
mov ebx, dword [edx + 0x34]
mov dword [esp + 0x70], eax
mov eax, dword [ebp + 0x20]
mov ecx, dword [eax + 0x40]
mov edx, dword [eax + 0x44]
mov esi, ecx
and esi, edx
cmp esi, 0xffffffff
jne 0x41c4aa
lea eax, [esp + 0xf8]
mov esi, str.Unknown
mov ecx, eax
mov edx, 0xa9f
sub esi, ecx
mov cl, byte [esi + eax]
test cl, cl
je 0x41c4a5
mov byte [eax], cl
sub edx, 1
add eax, 1
test edx, edx
jg 0x41c492
mov byte [eax], 0
jmp 0x41c4e1
test dword [eax + 8], 0x2000
push edx
push ecx
je 0x41c4bc
push str.0x_016I64X
jmp 0x41c4cd
test bl, 2
je 0x41c4c8
push str.0x_________08I64X
jmp 0x41c4cd
push str.0x_08I64X
mov esi, 0xaa0
lea edi, [esp + 0x104]
call fcn.00416ab0
add esp, 0xc
lea eax, [esp + 0xf8]
lea edx, [eax + 1]
jmp 0x41c4f0
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x41c4f0
sub eax, edx
mov edx, dword [esp + 0x3c]
mov ebx, dword [edx + 0x34]
mov dword [esp + 0x74], eax
mov eax, dword [ebp + 0x20]
mov ecx, dword [eax + 0x48]
mov edx, dword [eax + 0x4c]
mov eax, dword [eax + 8]
test eax, 0x800
je 0x41c54d
and ecx, edx
cmp ecx, 0xffffffff
je 0x41c556
lea eax, [esp + 0xf8]
mov esi, str.Data_file
mov ecx, eax
mov edx, 0xa9f
sub esi, ecx
mov cl, byte [eax + esi]
test cl, cl
je 0x41c548
mov byte [eax], cl
sub edx, 1
add eax, 1
test edx, edx
jg 0x41c535
mov byte [eax], 0
jmp 0x41c5bd
mov esi, ecx
and esi, edx
cmp esi, 0xffffffff
jne 0x41c588
lea eax, [esp + 0xf8]
mov esi, str.Unknown
mov ecx, eax
mov edx, 0xa9f
sub esi, ecx
jmp 0x41c570
mov cl, byte [eax + esi]
test cl, cl
je 0x41c583
mov byte [eax], cl
sub edx, 1
add eax, 1
test edx, edx
jg 0x41c570
mov byte [eax], 0
jmp 0x41c5bd
test eax, 0x2000
push edx
push ecx
je 0x41c598
push str.0x_016I64X
jmp 0x41c5a9
test bl, 2
je 0x41c5a4
push str.0x_________08I64X
jmp 0x41c5a9
push str.0x_08I64X
mov esi, 0xaa0
lea edi, [esp + 0x104]
call fcn.00416ab0
add esp, 0xc
lea eax, [esp + 0xf8]
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x41c5c7
sub eax, edx
mov edx, dword [ebp + 0x20]
mov dword [esp + 0x78], eax
mov eax, dword [edx + 0x50]
push eax
push str.0x_08X
mov esi, 0xaa0
lea edi, [esp + 0x100]
call fcn.00416ab0
mov eax, edi
add esp, 8
lea edx, [eax + 1]
jmp 0x41c600
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x41c600
mov ecx, dword [ebp + 0x20]
mov ecx, dword [ecx + 0x10]
sub eax, edx
test ecx, ecx
mov dword [esp + 0x7c], eax
lea eax, [esp + 0xf8]
je 0x41c62f
push 0xaa0
call fcn.00416730
add esp, 4
jmp 0x41c658
mov esi, str.Not_Loaded
mov ecx, 0xa9f
lea esp, [esp]
mov dl, byte [esi]
test dl, dl
je 0x41c655
mov byte [eax], dl
sub ecx, 1
add eax, 1
add esi, 1
test ecx, ecx
jg 0x41c640
mov byte [eax], 0
lea eax, [esp + 0xf8]
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x41c662
sub eax, edx
mov dword [esp + 0x80], eax
mov eax, dword [ebp + 0x20]
mov ecx, dword [eax + 0x68]
mov edx, dword [eax + 0x64]
mov ebx, 0x1000
test dword [eax + 8], ebx
je 0x41c6b2
movzx eax, cx
push eax
shr ecx, 0x10
push ecx
movzx ecx, dx
push ecx
shr edx, 0x10
push edx
push str._u._u._u._u
mov esi, 0xaa0
lea edi, [esp + 0x10c]
call fcn.00416ab0
add esp, 0x14
jmp 0x41c6dd
lea eax, [esp + 0xf8]
mov esi, 0x479354
mov ecx, eax
mov edx, 0xa9f
sub esi, ecx
mov cl, byte [eax + esi]
test cl, cl
je 0x41c6da
mov byte [eax], cl
sub edx, 1
add eax, 1
test edx, edx
jg 0x41c6c7
mov byte [eax], 0
lea eax, [esp + 0xf8]
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x41c6e7
sub eax, edx
mov dword [esp + 0x84], eax
mov eax, dword [ebp + 0x20]
test dword [eax + 8], ebx
mov ecx, dword [eax + 0x70]
mov edx, dword [eax + 0x6c]
je 0x41c732
movzx eax, cx
push eax
shr ecx, 0x10
push ecx
movzx ecx, dx
push ecx
shr edx, 0x10
push edx
push str._u._u._u._u
mov esi, 0xaa0
lea edi, [esp + 0x10c]
call fcn.00416ab0
add esp, 0x14
jmp 0x41c75d
lea eax, [esp + 0xf8]
mov esi, 0x479354
mov ecx, eax
mov edx, 0xa9f
sub esi, ecx
mov cl, byte [eax + esi]
test cl, cl
je 0x41c75a
mov byte [eax], cl
sub edx, 1
add eax, 1
test edx, edx
jg 0x41c747
mov byte [eax], 0
lea eax, [esp + 0xf8]
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x41c767
sub eax, edx
mov edx, dword [ebp + 0x20]
mov dword [esp + 0x88], eax
mov eax, dword [edx + 0x54]
movzx ecx, ax
push ecx
shr eax, 0x10
push eax
push str._u._u
mov esi, 0xaa0
lea edi, [esp + 0x104]
call fcn.00416ab0
mov eax, edi
add esp, 0xc
lea ecx, [eax + 1]
mov dl, byte [eax]
add eax, 1
test dl, dl
jne 0x41c7a5
mov edx, dword [ebp + 0x20]
sub eax, ecx
mov dword [esp + 0x8c], eax
mov eax, dword [edx + 0x58]
movzx ecx, ax
push ecx
shr eax, 0x10
push eax
push str._u._u
lea edi, [esp + 0x104]
call fcn.00416ab0
mov eax, edi
add esp, 0xc
lea ecx, [eax + 1]
mov edi, edi
mov dl, byte [eax]
add eax, 1
test dl, dl
jne 0x41c7e0
mov edx, dword [ebp + 0x20]
sub eax, ecx
mov dword [esp + 0x90], eax
mov eax, dword [edx + 0x5c]
movzx ecx, ax
push ecx
shr eax, 0x10
push eax
push str._u._u
lea edi, [esp + 0x104]
call fcn.00416ab0
mov eax, edi
add esp, 0xc
lea ecx, [eax + 1]
lea esp, [esp]
mov dl, byte [eax]
add eax, 1
test dl, dl
jne 0x41c820
mov edx, dword [ebp + 0x20]
sub eax, ecx
mov dword [esp + 0x94], eax
mov eax, dword [edx + 0x60]
movzx ecx, ax
push ecx
shr eax, 0x10
push eax
push str._u._u
lea edi, [esp + 0x104]
call fcn.00416ab0
mov eax, edi
add esp, 0xc
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x41c860
mov ebx, dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov edi, dword [esp + 0x10]
sub eax, edx
mov dword [esp + 0x98], eax
xor eax, eax
mov edi, edi
mov ecx, dword [esp + eax + 0x4c]
cmp ecx, dword [esp + eax + 0xa4]
jle 0x41c894
mov dword [esp + eax + 0xa4], ecx
add eax, 4
cmp eax, 0x50
jl 0x41c880
add edi, 4
cmp dword [edi], 0
mov dword [esp + 0x10], edi
jne 0x41bfc0
xor ebp, ebp
lea edi, [esp + 0xf8]
xor ebx, ebx
jmp 0x41c8c0
mov esi, dword [ebx*4 + 0x48a630]
lea eax, [esp + 0xb98]
sub eax, edi
cmp eax, ebp
mov ecx, edi
jle 0x41c8f8
sub eax, 1
cmp eax, ebp
jle 0x41c8f5
lea ecx, [ecx]
mov dl, byte [esi]
test dl, dl
je 0x41c8f5
mov byte [ecx], dl
sub eax, 1
add ecx, 1
add esi, 1
cmp eax, ebp
jg 0x41c8e0
mov byte [ecx], 0
mov eax, edi
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x41c900
sub eax, edx
add eax, edi
cmp ebx, 0x14
jge 0x41c946
mov edx, dword [esp + ebx*4 + 0xa0]
mov ecx, eax
sub ecx, edi
add edx, 2
cmp ecx, edx
jge 0x41c946
lea edx, [esp + 0xb97]
cmp eax, edx
jae 0x41c946
mov edx, dword [esp + ebx*4 + 0xa0]
mov byte [eax], 0x20
add ecx, 1
add edx, 2
add eax, 1
cmp ecx, edx
jl 0x41c924
add ebx, 1
cmp ebx, 0x15
mov edi, eax
jl 0x41c8c0
lea ecx, [esp + 0xb98]
sub ecx, eax
cmp ecx, ebp
mov esi, 0x47656c
jle 0x41c988
sub ecx, 1
cmp ecx, ebp
jle 0x41c985
lea ecx, [ecx]
mov dl, byte [esi]
test dl, dl
je 0x41c985
mov byte [eax], dl
sub ecx, 1
add eax, 1
add esi, 1
cmp ecx, ebp
jg 0x41c970
mov byte [eax], 0
lea eax, [esp + 0xf8]
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x41c992
sub eax, edx
mov esi, eax
cmp esi, 0xffffffff
jne 0x41c9bd
lea eax, [esp + 0xf8]
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x41c9b0
sub eax, edx
mov esi, eax
mov edi, dword [esp + 0x40]
push ebp
lea eax, [esp + 0x14]
push eax
push esi
lea ecx, [esp + 0x104]
push ecx
push edi
mov dword [esp + 0x24], ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x41c9ed
cmp dword [esp + 0x10], esi
je 0x41c9ff
push 0x1d
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edx, dword [esp + 0x38]
push edx
call fcn.00454dd4
add esp, 4
jmp 0x41d488
lea eax, [esp + 0xf8]
xor esi, esi
lea edx, [esp + 0xa0]
nop
xor ecx, ecx
cmp dword [edx], ebp
jle 0x41ca38
jmp 0x41ca20
lea ebx, [esp + 0xb97]
cmp eax, ebx
jae 0x41ca38
mov byte [eax], 0x2d
add ecx, 1
add eax, 1
cmp ecx, dword [edx]
jl 0x41ca20
cmp esi, 0x14
jge 0x41ca58
lea ecx, [esp + 0xb97]
cmp eax, ecx
jae 0x41ca58
mov byte [eax], 0x20
add eax, 1
cmp eax, ecx
jae 0x41ca58
mov byte [eax], 0x20
add eax, 1
add esi, 1
add edx, 4
cmp esi, 0x15
jl 0x41ca10
lea ecx, [esp + 0xb98]
sub ecx, eax
cmp ecx, ebp
jle 0x41ca96
sub ecx, 1
cmp ecx, ebp
jle 0x41ca93
mov esi, 0x47656c
sub esi, eax
mov edi, edi
mov dl, byte [esi + eax]
test dl, dl
je 0x41ca93
mov byte [eax], dl
sub ecx, 1
add eax, 1
cmp ecx, ebp
jg 0x41ca80
mov byte [eax], 0
lea eax, [esp + 0xf8]
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x41caa0
sub eax, edx
mov esi, eax
cmp esi, 0xffffffff
jne 0x41cacd
lea eax, [esp + 0xf8]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x41cac0
sub eax, edx
mov esi, eax
push ebp
lea edx, [esp + 0x14]
push edx
push esi
lea eax, [esp + 0x104]
push eax
push edi
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [esp + 0x24], ebp
call edi
test eax, eax
je 0x41cafb
cmp dword [esp + 0x10], esi
je 0x41cb0d
push 0x1d
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [esp + 0x38]
push ecx
call fcn.00454dd4
add esp, 4
jmp 0x41d488
mov eax, dword [esp + 0x38]
cmp dword [eax], ebp
mov ecx, eax
mov dword [esp + 0x10], eax
je 0x41d430
nop
mov edi, dword [ecx]
xor edx, edx
mov dword [esp + 0x44], edi
lea ebp, [esp + 0xf8]
mov dword [esp + 0x14], edx
jmp 0x41cb44
mov edi, dword [esp + 0x44]
cmp edx, 0x14
mov ecx, dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
ja case.default.0x41cb53
jmp dword [edx*4 + 0x41d4a4]
mov edx, dword [edi + 0x20]
mov ecx, dword [edx + 8]
or ecx, dword [edi + 0x10]
lea edx, [esp + 0xb97]
cmp ebp, edx
mov eax, ebp
jae 0x41cb77
mov byte [ebp], 0x5b
lea eax, [ebp + 1]
test cl, 1
jne 0x41cba6
test cl, 0x40
je 0x41cb91
lea edx, [esp + 0xb97]
cmp eax, edx
jae 0x41cbb7
mov byte [eax], 0x2a
jmp 0x41cbb4
test cl, 0x10
je 0x41cba6
lea edx, [esp + 0xb97]
cmp eax, edx
jae 0x41cbb7
mov byte [eax], 0x44
jmp 0x41cbb4
lea edx, [esp + 0xb97]
cmp eax, edx
jae 0x41cbb7
mov byte [eax], 0x20
add eax, 1
test ecx, 0x80000
lea edx, [esp + 0xb97]
je 0x41cbcf
cmp eax, edx
jae 0x41cbf7
mov byte [eax], 0x3f
jmp 0x41cbf4
test ecx, 0x10000
je 0x41cbe0
cmp eax, edx
jae 0x41cbf7
mov byte [eax], 0x21
jmp 0x41cbf4
test cl, cl
jns 0x41cbed
cmp eax, edx
jae 0x41cbf7
mov byte [eax], 0x45
jmp 0x41cbf4
cmp eax, edx
jae 0x41cbf7
mov byte [eax], 0x20
add eax, 1
test ecx, 0x2000
je 0x41cc0f
lea ecx, [esp + 0xb97]
cmp eax, ecx
jae 0x41cc31
mov byte [eax], 0x36
jmp 0x41cc1d
lea edx, [esp + 0xb97]
cmp eax, edx
jae 0x41cc31
mov byte [eax], 0x20
add eax, 1
lea ecx, [esp + 0xb97]
cmp eax, ecx
jae 0x41cc31
mov byte [eax], 0x5d
add eax, 1
mov byte [eax], 0
jmp 0x41d2d1
mov eax, dword [esp + 0xbac]
push 1
push eax
lea edx, [esp + 0xba0]
mov eax, edi
sub edx, ebp
call fcn.00425dc0
test edx, edx
mov esi, eax
mov ecx, ebp
jle 0x41d2d1
sub edx, 1
test edx, edx
jle 0x41cc81
mov al, byte [esi]
test al, al
je 0x41cc81
cmp al, 0x20
jge 0x41cc72
mov al, 4
mov byte [ecx], al
sub edx, 1
add ecx, 1
add esi, 1
test edx, edx
jg 0x41cc66
mov byte [ecx], 0
jmp 0x41d2d1
mov eax, dword [edi + 0x20]
mov edx, dword [eax + 8]
or edx, dword [edi + 0x10]
test edx, 0x10000
jne 0x41d336
lea edx, [esp + 0x28]
push edx
add eax, 0x14
lea esi, [esp + 0xb9c]
push eax
sub esi, ebp
call ecx
mov eax, dword [0x48d794]
cmp eax, 1
jne 0x41ccd8
movsx eax, byte [0x48d79e]
movzx ecx, word [esp + 0x28]
movzx edx, word [esp + 0x2a]
push ecx
push eax
push edx
push eax
movzx eax, word [esp + 0x3e]
jmp 0x41cd12
cmp eax, 2
movsx eax, byte [0x48d79e]
jne 0x41ccff
movzx ecx, word [esp + 0x2e]
movzx edx, word [esp + 0x2a]
push ecx
push eax
push edx
push eax
movzx eax, word [esp + 0x38]
push eax
push str._04u_c_02u_c_02u
jmp 0x41cd18
movzx ecx, word [esp + 0x28]
movzx edx, word [esp + 0x2e]
push ecx
push eax
push edx
push eax
movzx eax, word [esp + 0x3a]
push eax
push str._02u_c_02u_c_04u
mov edi, ebp
call fcn.00416ab0
add esp, 0x18
cmp byte [0x48d79c], 0
mov edi, eax
je 0x41cd7b
mov cx, word [esp + 0x30]
cmp cx, 0xa
jb 0x41cd3f
mov eax, 0x4727f1
jmp 0x41cd52
cmp byte [0x48d79d], 0
mov eax, 0x47c530
jne 0x41cd52
mov eax, 0x474d04
movzx edx, word [esp + 0x32]
push edx
movsx edx, byte [0x48d79f]
push edx
movzx ecx, cx
push ecx
push eax
sub esi, edi
push str.__s_u_c_02u
add edi, ebp
call fcn.00416ab0
add esp, 0x14
jmp 0x41d2d1
mov ax, word [esp + 0x30]
cmp ax, 0xc
movzx eax, ax
cdq
setae cl
mov ebx, 0xc
idiv ebx
test edx, edx
je 0x41cda8
cmp dx, 0xa
mov word [esp + 0x30], dx
jb 0x41cdb7
mov eax, 0x4727f1
jmp 0x41cdca
mov dx, bx
mov word [esp + 0x30], dx
mov eax, 0x4727f1
jmp 0x41cdca
cmp byte [0x48d79d], 0
mov eax, 0x47c530
jne 0x41cdca
mov eax, 0x474d04
neg cl
sbb ecx, ecx
and ecx, 0xf
add ecx, 0x61
push ecx
movzx ecx, word [esp + 0x36]
push ecx
movsx ecx, byte [0x48d79f]
push ecx
movzx edx, dx
push edx
push eax
sub esi, edi
push str.__s_u_c_02u_c
add edi, ebp
call fcn.00416ab0
add esp, 0x18
jmp 0x41d2d1
mov edx, dword [edi + 0x20]
lea eax, [esp + 0x18]
push eax
add edx, 0x1c
lea esi, [esp + 0xb9c]
push edx
sub esi, ebp
call ecx
mov eax, dword [0x48d794]
cmp eax, 1
jne 0x41ce3b
movsx eax, byte [0x48d79e]
movzx ecx, word [esp + 0x18]
movzx edx, word [esp + 0x1a]
push ecx
push eax
push edx
push eax
movzx eax, word [esp + 0x2e]
jmp 0x41ce75
cmp eax, 2
movsx eax, byte [0x48d79e]
jne 0x41ce62
movzx ecx, word [esp + 0x1e]
movzx edx, word [esp + 0x1a]
push ecx
push eax
push edx
push eax
movzx eax, word [esp + 0x28]
push eax
push str._04u_c_02u_c_02u
jmp 0x41ce7b
movzx ecx, word [esp + 0x18]
movzx edx, word [esp + 0x1e]
push ecx
push eax
push edx
push eax
movzx eax, word [esp + 0x2a]
push eax
push str._02u_c_02u_c_04u
mov edi, ebp
call fcn.00416ab0
add esp, 0x18
cmp byte [0x48d79c], 0
mov edi, eax
je 0x41cec7
mov cx, word [esp + 0x20]
cmp cx, 0xa
jb 0x41ceaa
movzx edx, word [esp + 0x22]
mov eax, 0x4727f1
jmp 0x41cd57
cmp byte [0x48d79d], 0
mov eax, 0x47c530
jne 0x41cebd
mov eax, 0x474d04
movzx edx, word [esp + 0x22]
jmp 0x41cd57
mov ax, word [esp + 0x20]
cmp ax, 0xc
movzx eax, ax
cdq
setae cl
mov ebx, 0xc
idiv ebx
test edx, edx
je 0x41cef4
cmp dx, 0xa
mov word [esp + 0x20], dx
jb 0x41cf03
mov eax, 0x4727f1
jmp 0x41cf16
mov dx, bx
mov word [esp + 0x20], dx
mov eax, 0x4727f1
jmp 0x41cf16
cmp byte [0x48d79d], 0
mov eax, 0x47c530
jne 0x41cf16
mov eax, 0x474d04
neg cl
sbb ecx, ecx
and ecx, 0xf
add ecx, 0x61
push ecx
movzx ecx, word [esp + 0x26]
jmp 0x41cdda
mov eax, dword [edi + 0x20]
lea ecx, [esp + 0xb98]
sub ecx, ebp
push ecx
mov ecx, dword [eax + 0x24]
mov eax, ebp
call fcn.00416730
mov ecx, ebp
add esp, 4
mov eax, ebp
lea esi, [ecx + 1]
lea esp, [esp]
mov dl, byte [ecx]
add ecx, 1
test dl, dl
jne 0x41cf50
sub ecx, esi
mov edx, ecx
mov ecx, dword [esp + 0xb0]
sub ecx, edx
test ecx, ecx
jle 0x41cf88
lea ebx, [ebx]
lea edx, [esp + 0xb97]
cmp eax, edx
jae 0x41cf88
mov byte [eax], 0x20
sub ecx, 1
add eax, 1
test ecx, ecx
jg 0x41cf70
mov ecx, dword [edi + 0x20]
mov ecx, dword [ecx + 0x24]
lea edx, [esp + 0xb98]
sub edx, eax
push edx
call fcn.00416730
add esp, 4
jmp 0x41d2d1
lea eax, [esp + 0xb98]
sub eax, ebp
push eax
mov ecx, ebp
mov eax, edi
call fcn.00425fd0
jmp 0x41d2d1
mov ecx, dword [edi + 0x20]
mov edx, dword [ecx + 0x34]
push edx
lea esi, [esp + 0xb9c]
push str.0x_08X
sub esi, ebp
mov edi, ebp
call fcn.00416ab0
add esp, 8
jmp 0x41d2d1
mov eax, dword [edi + 0x20]
mov ecx, dword [eax + 0x38]
push ecx
jmp 0x41cfc4
lea ecx, [esp + 0xb98]
sub ecx, ebp
mov eax, ebp
mov edx, edi
call fcn.004260a0
jmp 0x41d2d1
lea ecx, [esp + 0xb98]
sub ecx, ebp
mov edx, ebp
mov eax, edi
call fcn.004263b0
jmp 0x41d2d1
lea eax, [esp + 0xb98]
sub eax, ebp
push edi
mov esi, ebp
call fcn.004264d0
jmp 0x41d2d1
mov edx, dword [esp + 0x3c]
mov eax, dword [esp + 0x44]
mov ebx, dword [edx + 0x34]
mov edx, dword [eax + 0x20]
mov eax, dword [edx + 0x40]
mov ecx, dword [edx + 0x44]
mov edi, eax
lea esi, [esp + 0xb98]
and edi, ecx
sub esi, ebp
cmp edi, 0xffffffff
jne 0x41d08b
test esi, esi
mov eax, ebp
jle 0x41d2d1
add esi, edi
test esi, esi
jle 0x41d083
mov edx, str.Unknown
sub edx, ebp
jmp 0x41d070
mov cl, byte [eax + edx]
test cl, cl
je 0x41d083
mov byte [eax], cl
sub esi, 1
add eax, 1
test esi, esi
jg 0x41d070
mov byte [eax], 0
jmp 0x41d2d1
test dword [edx + 8], 0x2000
push ecx
mov edi, ebp
push eax
je 0x41d0aa
push str.0x_016I64X
call fcn.00416ab0
add esp, 0xc
jmp 0x41d2d1
test bl, 2
je 0x41d0c1
push str.0x_________08I64X
call fcn.00416ab0
add esp, 0xc
jmp 0x41d2d1
push str.0x_08I64X
call fcn.00416ab0
add esp, 0xc
jmp 0x41d2d1
mov ecx, dword [esp + 0x3c]
mov eax, dword [edi + 0x20]
mov ebx, dword [ecx + 0x34]
mov ecx, dword [eax + 0x48]
mov edx, dword [eax + 0x4c]
mov eax, dword [eax + 8]
lea esi, [esp + 0xb98]
sub esi, ebp
test eax, 0x800
je 0x41d130
and ecx, edx
cmp ecx, 0xffffffff
je 0x41d139
test esi, esi
mov eax, ebp
jle 0x41d2d1
add esi, 0xffffffff
test esi, esi
jle 0x41d128
mov edx, str.Data_file
sub edx, ebp
mov cl, byte [eax + edx]
test cl, cl
je 0x41d128
mov byte [eax], cl
sub esi, 1
add eax, 1
test esi, esi
jg 0x41d115
mov byte [eax], 0
jmp 0x41d2d1
mov edi, ecx
and edi, edx
cmp edi, 0xffffffff
jne 0x41d16c
test esi, esi
mov eax, ebp
jle 0x41d2d1
add esi, 0xffffffff
test esi, esi
jle 0x41d164
mov edx, str.Unknown
sub edx, ebp
mov cl, byte [eax + edx]
test cl, cl
je 0x41d164
mov byte [eax], cl
sub esi, 1
add eax, 1
test esi, esi
jg 0x41d151
mov byte [eax], 0
jmp 0x41d2d1
test eax, 0x2000
push edx
mov edi, ebp
push ecx
je 0x41d0aa
push str.0x_016I64X
call fcn.00416ab0
add esp, 0xc
jmp 0x41d2d1
mov edx, dword [edi + 0x20]
mov eax, dword [edx + 0x50]
push eax
jmp 0x41cfc4
mov ecx, dword [edi + 0x20]
mov ecx, dword [ecx + 0x10]
lea edx, [esp + 0xb98]
sub edx, ebp
test ecx, ecx
mov eax, ebp
je 0x41d1bc
push edx
call fcn.00416730
add esp, 4
jmp 0x41d2d1
test edx, edx
jle 0x41d2d1
add edx, 0xffffffff
test edx, edx
jle 0x41d1e5
mov esi, str.Not_Loaded
sub esi, ebp
mov cl, byte [eax + esi]
test cl, cl
je 0x41d1e5
mov byte [eax], cl
sub edx, 1
add eax, 1
test edx, edx
jg 0x41d1d2
mov byte [eax], 0
jmp 0x41d2d1
mov ecx, dword [edi + 0x20]
mov eax, dword [ecx + 0x68]
mov ecx, dword [ecx + 0x64]
lea edx, [esp + 0xb98]
sub edx, ebp
push edx
push ebp
mov edx, edi
call fcn.00426690
jmp 0x41d2d1
mov ecx, dword [edi + 0x20]
lea eax, [esp + 0xb98]
sub eax, ebp
push eax
mov eax, dword [ecx + 0x70]
mov ecx, dword [ecx + 0x6c]
push ebp
mov edx, edi
call fcn.00426690
jmp 0x41d2d1
mov ecx, dword [edi + 0x20]
mov eax, dword [ecx + 0x54]
movzx edx, ax
push edx
shr eax, 0x10
push eax
lea esi, [esp + 0xba0]
push str._u._u
sub esi, ebp
mov edi, ebp
call fcn.00416ab0
add esp, 0xc
jmp 0x41d2d1
mov eax, dword [edi + 0x20]
mov eax, dword [eax + 0x58]
movzx ecx, ax
push ecx
shr eax, 0x10
push eax
lea esi, [esp + 0xba0]
push str._u._u
sub esi, ebp
mov edi, ebp
call fcn.00416ab0
add esp, 0xc
jmp 0x41d2d1
mov edx, dword [edi + 0x20]
mov eax, dword [edx + 0x5c]
movzx ecx, ax
push ecx
shr eax, 0x10
push eax
lea esi, [esp + 0xba0]
push str._u._u
sub esi, ebp
mov edi, ebp
call fcn.00416ab0
add esp, 0xc
jmp 0x41d2d1
mov edx, dword [edi + 0x20]
mov eax, dword [edx + 0x60]
movzx ecx, ax
push ecx
shr eax, 0x10
push eax
lea esi, [esp + 0xba0]
push str._u._u
sub esi, ebp
mov edi, ebp
call fcn.00416ab0
add esp, 0xc
jmp 0x41d2d1
mov byte [ebp], 0
mov eax, ebp
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x41d2d6
sub eax, edx
mov edx, dword [esp + 0x14]
add eax, ebp
cmp edx, 0x14
jge 0x41d322
mov esi, dword [esp + edx*4 + 0xa0]
mov ecx, eax
sub ecx, ebp
add esi, 2
cmp ecx, esi
jge 0x41d322
mov edi, edi
lea esi, [esp + 0xb97]
cmp eax, esi
jae 0x41d322
mov esi, dword [esp + edx*4 + 0xa0]
mov byte [eax], 0x20
add ecx, 1
add esi, 2
add eax, 1
cmp ecx, esi
jl 0x41d300
add edx, 1
cmp edx, 0x15
mov ebp, eax
mov dword [esp + 0x14], edx
jl 0x41cb40
jmp 0x41d37f
mov edx, dword [edi + 0x20]
mov esi, dword [edx + 0x80]
lea eax, [esp + 0xb98]
sub eax, ebp
test eax, eax
mov ecx, ebp
jle 0x41d36d
sub eax, 1
test eax, eax
jle 0x41d36a
mov dl, byte [esi]
test dl, dl
je 0x41d36a
mov byte [ecx], dl
sub eax, 1
add ecx, 1
add esi, 1
test eax, eax
jg 0x41d355
mov byte [ecx], 0
mov eax, ebp
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x41d372
sub eax, edx
add ebp, eax
lea eax, [esp + 0xb98]
sub eax, ebp
test eax, eax
jle 0x41d3b8
sub eax, 1
test eax, eax
jle 0x41d3b4
mov edx, 0x47656c
sub edx, ebp
lea ebx, [ebx]
mov cl, byte [edx + ebp]
test cl, cl
je 0x41d3b4
mov byte [ebp], cl
sub eax, 1
add ebp, 1
test eax, eax
jg 0x41d3a0
mov byte [ebp], 0
lea eax, [esp + 0xf8]
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x41d3c2
sub eax, edx
mov esi, eax
cmp esi, 0xffffffff
jne 0x41d3ed
lea eax, [esp + 0xf8]
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x41d3e0
sub eax, edx
mov esi, eax
mov edx, dword [esp + 0x40]
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea eax, [esp + 0x18]
push eax
push esi
lea ecx, [esp + 0x104]
push ecx
push edx
mov dword [esp + 0x28], 0
call edi
test eax, eax
je 0x41d471
cmp dword [esp + 0x14], esi
jne 0x41d469
mov ecx, dword [esp + 0x10]
add ecx, 4
cmp dword [ecx], 0
mov dword [esp + 0x10], ecx
jne 0x41cb20
mov ecx, dword [esp + 0x38]
push ecx
call fcn.00454dd4
mov eax, dword [esp + 0x44]
add esp, 4
push 0
lea edx, [esp + 0x18]
push edx
push 2
push 0x47656c
push eax
mov dword [esp + 0x28], 0
call edi
test eax, eax
je 0x41d488
cmp dword [esp + 0x14], 2
jne 0x41d480
mov al, 1
jmp 0x41d48a
push 0x1d
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [esp + 0x38]
push eax
call fcn.00454dd4
add esp, 4
jmp 0x41d488
push 0x1d
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor al, al
mov ecx, dword [esp + 0xb9c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00454016
add esp, 0xb90
ret