Function at 0x410661
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
push ebx
push esi
push edi
mov ebx, ecx
push 0x20
call fcn.0040f8c3
push 0x64
push dword [ebx + 0x2c]
call dword [sym.imp.USER32.dll_KillTimer]
xor edi, edi
cmp dword [ebx + 0x48c], edi
jne 0x410762
cmp dword [ebx + 0x490], edi
jne 0x410762
mov eax, dword [ebx]
push 0x404d4c
push edi
push 0xc
push 0xbc7
mov ecx, ebx
mov dword [ebp - 8], edi
call dword [eax + 0xe0]
push dword [ebx + 0xb1c]
lea esi, [ebx + 0xb1c]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
mov eax, dword [ebx + 0x538]
mov dword [esi], edi
mov edi, eax
and eax, 0x10000000
shr edi, 0x1c
and edi, 1
mov esi, dword [ebx]
neg eax
sbb eax, eax
push 0
and eax, 0x2a
add eax, 0x1c
push eax
call fcn.00417fc0
add esp, 0xc
mov dword [ebp - 4], esi
neg edi
sbb edi, edi
mov esi, 0xbf8
and edi, esi
push eax
mov eax, dword [ebp - 4]
inc edi
push edi
mov ecx, ebx
call dword [eax + 0x98]
mov eax, dword [ebx]
push 0x41b380
push 0xbcb
mov ecx, ebx
call dword [eax + 0x98]
mov eax, dword [ebx + 0x638]
cmp eax, 2
je 0x410a1c
cmp eax, 1
jne 0x410a2e
xor edi, edi
cmp dword [ebp - 8], edi
je 0x410a1e
cmp dword [ebx + 0xb94], edi
jne 0x410a30
cmp dword [ebx + 0xb9c], edi
jne 0x410a30
jmp 0x410a1e
push 1
mov ecx, ebx
pop esi
push esi
push edi
mov dword [ebp - 8], esi
call fcn.00412411
cmp dword [ebx + 0x868], edi
je 0x4109bc
test byte [ebx + 0x53b], 0x10
jne 0x4109bc
push esi
mov ecx, ebx
call fcn.00410df2
push 2
push edi
push edi
push dword [ebx + 0xb20]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
movzx eax, word [ebx + 0xb14]
push eax
movzx eax, word [ebx + 0xb12]
push eax
movzx eax, word [ebx + 0xb10]
push eax
movzx eax, word [ebx + 0xb0e]
push eax
movzx eax, word [ebx + 0xb0a]
push eax
movzx eax, word [ebx + 0xb08]
push eax
call fcn.00412ef3
push eax
lea eax, [ebp - 0x418]
push 0x404ce4
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x24
lea ecx, [ebp - 4]
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 4], eax
push edi
push ecx
push eax
lea eax, [ebp - 0x418]
push eax
push dword [ebx + 0xb20]
call esi
mov edx, dword [ebx + 0xb1c]
lea eax, [ebp - 4]
push edi
push eax
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
push dword [ebx + 0xb20]
call esi
mov eax, dword [ebx + 0xae8]
xor edi, edi
cmp eax, edi
je 0x4108f0
cmp dword [0x41b4bc], edi
push edi
je 0x4108a5
lea eax, [eax + eax*2]
lea ecx, [ebp - 0x18]
cdq
sub eax, edx
sar eax, 1
push eax
call fcn.00419d80
mov eax, dword [ebx + 0xbc0]
mov ecx, dword [ebx + 0xae8]
push edi
push edi
push dword [ebp - 0x14]
mov eax, dword [eax]
shr ecx, 1
push dword [ebp - 0x18]
push ecx
push eax
mov eax, dword [ebx + 0x5dc]
push edi
neg eax
sbb eax, eax
and eax, 0xfde9
push eax
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea ecx, [ebp - 4]
push edi
push ecx
push eax
push dword [ebp - 0x18]
mov dword [ebp - 4], eax
push dword [ebx + 0xb20]
call esi
lea ecx, [ebp - 0x18]
call fcn.00419db0
jmp 0x4108ba
lea ecx, [ebp - 4]
push ecx
push eax
mov eax, dword [ebx + 0xbc0]
push dword [eax]
push dword [ebx + 0xb20]
call esi
mov edi, 0x404ce0
push 0x404c20
lea eax, [ebp - 0x418]
push edi
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
lea ecx, [ebp - 4]
mov dword [ebp - 4], eax
push 0
push ecx
push eax
lea eax, [ebp - 0x418]
push eax
push dword [ebx + 0xb20]
call esi
jmp 0x41091e
mov esi, 0x404cd4
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 4]
push 0
push eax
lea eax, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
push 0xb
push eax
push dword [ebx + 0xb20]
movsd dword es:[edi], dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
mov edi, 0x404ce0
mov eax, dword [ebx]
lea ecx, [ebp - 0x418]
push 0x400
push ecx
push 0xbc7
mov ecx, ebx
call dword [eax + 0x90]
mov dword [ebp - 4], eax
push 0x404cc8
lea eax, [ebp + eax - 0x418]
push edi
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add dword [ebp - 4], eax
mov ecx, 0x400
sub ecx, dword [ebp - 4]
add esp, 0xc
mov eax, dword [ebx]
push ecx
mov ecx, dword [ebp - 4]
lea ecx, [ebp + ecx - 0x418]
push ecx
push 0xbd8
mov ecx, ebx
call dword [eax + 0x90]
add dword [ebp - 4], eax
mov eax, dword [ebp - 4]
push 0x404c20
push edi
lea eax, [ebp + eax - 0x418]
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add dword [ebp - 4], eax
add esp, 0xc
lea eax, [ebp - 4]
push 0
push eax
push dword [ebp - 4]
lea eax, [ebp - 0x418]
push eax
push dword [ebx + 0xb20]
call esi
push 0
mov ecx, ebx
call fcn.00410df2
xor edi, edi
mov ecx, dword [ebx + 0x538]
mov eax, dword [ebx]
and ecx, 0x10000000
push edi
neg ecx
sbb ecx, ecx
and ecx, 0xbf8
inc ecx
push ecx
mov ecx, ebx
call dword [eax + 0xa8]
mov esi, dword [sym.imp.USER32.dll_EnableWindow]
push eax
call esi
lea ecx, [ebx + 0x38]
call fcn.0040d580
mov ecx, dword [ebx + 0x538]
mov eax, dword [ebx]
and ecx, 0x10000000
push 1
neg ecx
sbb ecx, ecx
and ecx, 0xbf8
inc ecx
push ecx
mov ecx, ebx
call dword [eax + 0xa8]
push eax
call esi
jmp 0x4106b5
xor edi, edi
mov eax, dword [ebx]
push edi
push edi
push 0x10
mov ecx, ebx
call dword [eax + 0xd0]
jmp 0x410a30
xor edi, edi
push 1
mov ecx, ebx
mov dword [ebx + 0x638], edi
mov dword [ebx + 0x650], edi
call fcn.0040efe2
mov ecx, ebx
call fcn.00412f0a
mov ecx, dword [ebx + 0x538]
mov eax, dword [ebx]
and ecx, 0x10000000
neg ecx
sbb ecx, ecx
and ecx, esi
inc ecx
push ecx
mov ecx, ebx
call dword [eax + 0xa8]
push eax
call dword [sym.imp.USER32.dll_SetFocus]
cmp dword [ebx + 0x63c], edi
je 0x410a93
push 0x404c0c
mov ecx, ebx
push dword [ebx + 0x624]
mov dword [ebx + 0xafc], edi
push 1
call fcn.004122e0
mov eax, dword [0x41b53c]
cmp al, 6
jb 0x410acb
cmp eax, 0x80000000
jae 0x410acb
call fcn.004188c0
test eax, eax
jne 0x410acb
push edi
push 0x7544
push dword [ebx + 0x2c]
call dword [sym.imp.USER32.dll_GetMenu]
push eax
call dword [sym.imp.USER32.dll_EnableMenuItem]
push dword [ebx + 0x2c]
call dword [sym.imp.USER32.dll_DrawMenuBar]
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret