Function at 0x419878
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push 0
push 0
call fcn.0041955c
add esp, 8
mov eax, dword [ebp + 0xc]
test eax, eax
jne 0x419920
mov edx, dword [ebp + 0x14]
mov dword [ebp - 0xc], edx
mov ecx, dword [ebp + 0x14]
test ecx, ecx
jbe 0x419919
mov eax, dword [ebp + 0x14]
cmp eax, 0x40
jbe 0x4198b3
mov dword [ebp - 8], 0x40
jmp 0x4198b9
mov edx, dword [ebp + 0x14]
mov dword [ebp - 8], edx
push dword [ebp - 8]
push dword [ebp + 0x10]
push dword [ebp + 8]
call fcn.00420888
add esp, 0xc
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 8]
cmp ecx, eax
je 0x4198de
xor eax, eax
jmp 0x419aa8
mov edx, dword [ebp - 8]
sub dword [ebp + 0x14], edx
mov ecx, dword [ebp - 8]
add dword [ebp + 0x10], ecx
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp + 0x14]
sub eax, edx
imul eax, eax, 0x64
xor edx, edx
div dword [ebp - 0xc]
push eax
push 1
call fcn.0041955c
add esp, 8
mov ecx, dword [0x4e518c]
mov eax, dword [ecx]
call fcn.0047fd80
mov edx, dword [ebp + 0x14]
test edx, edx
ja 0x4198a2
mov al, 1
jmp 0x419aa8
mov edx, dword [ebp + 0xc]
dec edx
jne 0x4199b5
mov ecx, dword [ebp + 0x14]
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp + 0x14]
test eax, eax
jbe 0x4199ae
mov edx, dword [ebp + 0x14]
cmp edx, 0x40
jbe 0x419948
mov dword [ebp - 8], 0x40
jmp 0x41994e
mov ecx, dword [ebp + 0x14]
mov dword [ebp - 8], ecx
push dword [ebp - 8]
push dword [ebp + 0x10]
push dword [ebp + 8]
call fcn.00420e90
add esp, 0xc
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
cmp eax, edx
je 0x419973
xor eax, eax
jmp 0x419aa8
mov edx, dword [ebp - 8]
sub dword [ebp + 0x14], edx
mov ecx, dword [ebp - 8]
add dword [ebp + 0x10], ecx
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp + 0x14]
sub eax, edx
imul eax, eax, 0x64
xor edx, edx
div dword [ebp - 0xc]
push eax
push 1
call fcn.0041955c
add esp, 8
mov ecx, dword [0x4e518c]
mov eax, dword [ecx]
call fcn.0047fd80
mov edx, dword [ebp + 0x14]
test edx, edx
ja 0x419937
mov al, 1
jmp 0x419aa8
mov edx, dword [ebp + 0xc]
cmp edx, 2
jne 0x419a0c
mov ecx, dword [ebp + 0x14]
mov dword [ebp - 0xc], ecx
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 8]
call sub.KERNEL32.DLL_WriteFile
test eax, eax
je 0x4199ec
mov edx, dword [ebp - 4]
mov ecx, dword [ebp + 0x14]
cmp edx, ecx
je 0x4199ec
xor eax, eax
jmp 0x419aa8
push 0x64
push 1
call fcn.0041955c
add esp, 8
mov edx, dword [0x4e518c]
mov eax, dword [edx]
call fcn.0047fd80
mov al, 1
jmp 0x419aa8
mov edx, dword [ebp + 0xc]
cmp edx, 3
jne 0x419aa6
mov ecx, dword [ebp + 0x14]
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp + 0x14]
test eax, eax
jbe 0x419a96
mov edx, dword [ebp + 0x14]
cmp edx, 0x200
jbe 0x419a39
mov dword [ebp - 8], pe_nt_image_headers32
jmp 0x419a3f
mov ecx, dword [ebp + 0x14]
mov dword [ebp - 8], ecx
push dword [ebp - 8]
push dword [ebp + 0x10]
push dword [0x4e5c10]
call fcn.00428540
add esp, 0xc
test al, al
jne 0x419a5b
xor eax, eax
jmp 0x419aa8
mov edx, dword [ebp - 8]
sub dword [ebp + 0x14], edx
mov ecx, dword [ebp - 8]
add dword [ebp + 0x10], ecx
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp + 0x14]
sub eax, edx
imul eax, eax, 0x64
xor edx, edx
div dword [ebp - 0xc]
push eax
push 1
call fcn.0041955c
add esp, 8
mov ecx, dword [0x4e518c]
mov eax, dword [ecx]
call fcn.0047fd80
mov edx, dword [ebp + 0x14]
test edx, edx
ja 0x419a25
push 0x64
push 1
call fcn.0041955c
add esp, 8
mov al, 1
jmp 0x419aa8
xor eax, eax
mov esp, ebp
pop ebp
ret