Function at 0x415aa0
Capabilities:
Write file on windows

Disassembly:
mov eax, 0x4238
call fcn.0043d410
mov eax, dword [0x469644]
xor eax, esp
mov dword [esp + 0x4234], eax
mov eax, dword [esp + 0x4240]
push ebx
push ebp
mov ebp, dword [esp + 0x4244]
push esi
or esi, 0xffffffff
push edi
mov ebx, ecx
mov dword [esp + 0x10], eax
cmp dword [ebp + 4], esi
je 0x415ae0
mov edi, dword [ebp]
call fcn.00415310
mov dword [ebp + 4], esi
mov esi, dword [ebp]
cmp ebx, dword [esi + 4]
jl 0x415af5
mov eax, 0x10000
jmp 0x415d22
cmp ebx, dword [esi + 0x10]
jge 0x415aff
call fcn.00414bd0
mov ecx, dword [ebp]
cmp dword [ecx + 0x10], ebx
jge 0x415b56
mov esi, dword [ebp]
test esi, esi
je 0x415b4e
cmp dword [esi + 0x18], 0
je 0x415b4e
mov eax, dword [esi + 0x10]
inc eax
cmp eax, dword [esi + 4]
je 0x415b4e
mov edx, dword [esi + 0x50]
add edx, dword [esi + 0x4c]
mov ecx, dword [esi + 0x48]
push 0
mov dword [esi + 0x10], eax
lea edx, [edx + ecx + 0x2e]
add dword [esi + 0x14], edx
push 0
lea eax, [esi + 0x78]
push eax
lea ecx, [esi + 0x28]
push ecx
mov eax, esi
call fcn.00414770
add esp, 0x10
neg eax
sbb eax, eax
inc eax
mov dword [esi + 0x18], eax
mov edx, dword [ebp]
cmp dword [edx + 0x10], ebx
jl 0x415b07
push ebx
lea edx, [esp + 0x18]
mov ecx, ebp
call fcn.00415470
test byte [esp + 0x11c], 0x10
je 0x415b87
lea eax, [esp + 0x18]
push eax
add ebp, 0x138
push ebp
call fcn.004159b0
add esp, 8
xor eax, eax
jmp 0x415d22
mov edi, dword [esp + 0x10]
mov al, byte [edi]
mov esi, edi
mov ecx, edi
test al, al
je 0x415c48
lea esp, [esp]
cmp al, 0x2f
je 0x415ba8
cmp al, 0x5c
jne 0x415bab
lea esi, [ecx + 1]
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x415ba0
cmp esi, edi
je 0x415c48
lea edx, [esp + 0x140]
mov eax, edi
sub edx, edi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x415bc6
sub esi, edi
mov byte [esp + esi + 0x13f], cl
mov al, byte [esp + 0x140]
cmp al, 0x2f
je 0x415bf6
cmp al, 0x5c
je 0x415bf6
cmp byte [esp + 0x141], 0x3a
je 0x415bf6
xor bl, bl
jmp 0x415bf8
mov bl, 1
lea ecx, [esp + 0x140]
push 0x45d2c0
push ecx
call fcn.00436fb5
lea edx, [esp + 0x148]
push 0x45d2c4
push edx
mov esi, eax
call fcn.00436fb5
add esp, 0x10
test eax, eax
setne al
test esi, esi
setne cl
or al, cl
or al, bl
jne 0x415c48
lea edx, [esp + 0x140]
push edx
lea eax, [ebp + 0x138]
push eax
call fcn.004159b0
add esp, 8
mov ecx, dword [esp + 0x11c]
push 0
push ecx
push 2
push 0
push 0
push 0x40000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x415c75
mov eax, 0x200
jmp 0x415d22
mov eax, dword [ebp]
call fcn.00415050
mov eax, dword [ebp]
lea edx, [esp + 0x244]
push edx
mov ecx, 0x4000
xor bl, bl
call fcn.00415160
add esp, 4
test eax, eax
jl 0x415cd6
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
je 0x415cd8
push 0
lea ecx, [esp + 0x14]
push ecx
push eax
lea edx, [esp + 0x250]
push edx
push esi
call edi
test eax, eax
je 0x415cd6
lea eax, [esp + 0x244]
push eax
mov eax, dword [ebp]
mov ecx, 0x4000
call fcn.00415160
add esp, 4
test eax, eax
jge 0x415ca1
mov bl, 1
push esi
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 1
jne 0x415d07
test bl, bl
jne 0x415d07
lea ecx, [esp + 0x130]
push ecx
lea edx, [esp + 0x124]
push edx
lea eax, [esp + 0x130]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [ebp]
call fcn.00415310
movzx eax, bl
neg eax
sbb eax, eax
and eax, 0x400
mov ecx, dword [esp + 0x4244]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004366ef
add esp, 0x4238
ret 8