Function at 0x41e700
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x344
mov eax, dword [0x462650]
mov dword [esp + 0x340], eax
mov eax, dword [esp + 0x348]
test eax, eax
jne 0x41e73a
mov eax, 0x10000
mov dword [0x4638a4], eax
mov ecx, dword [esp + 0x340]
call fcn.0042af5e
add esp, 0x344
ret
cmp dword [eax], 1
je 0x41e75c
mov eax, 0x80000
mov dword [0x4638a4], eax
mov ecx, dword [esp + 0x340]
call fcn.0042af5e
add esp, 0x344
ret
push ebx
push esi
push edi
mov edi, dword [eax + 4]
mov eax, dword [edi + 4]
or ebx, 0xffffffff
cmp eax, ebx
je 0x41e777
mov eax, dword [edi]
push eax
call fcn.0041bf10
add esp, 4
mov eax, dword [edi]
mov esi, dword [esp + 0x358]
mov dword [edi + 4], ebx
cmp esi, dword [eax + 4]
jl 0x41e792
mov eax, 0x10000
jmp 0x41e9f0
cmp esi, dword [eax + 0x10]
jge 0x41e7a0
push eax
call fcn.0041bc50
add esp, 4
mov ecx, dword [edi]
cmp dword [ecx + 0x10], esi
jge 0x41e7bb
mov edx, dword [edi]
push edx
call fcn.0041bca0
mov eax, dword [edi]
mov ecx, dword [eax + 0x10]
add esp, 4
cmp ecx, esi
jl 0x41e7a7
lea ecx, [esp + 0x11c]
push ecx
push esi
mov ecx, edi
call fcn.0041c090
test byte [esp + 0x224], 0x10
je 0x41e819
mov ecx, dword [esp + 0x35c]
mov al, byte [ecx]
cmp al, 0x2f
je 0x41e7f0
cmp al, 0x5c
je 0x41e7f0
test al, al
je 0x41e802
cmp byte [ecx + 1], 0x3a
jne 0x41e802
push ecx
push 0
call fcn.0041c610
add esp, 8
xor eax, eax
jmp 0x41e9f0
push ecx
add edi, 0x140
push edi
call fcn.0041c610
add esp, 8
xor eax, eax
jmp 0x41e9f0
mov edx, dword [esp + 0x35c]
mov al, byte [edx]
test al, al
push ebp
mov ebp, edx
mov ecx, edx
je 0x41e843
jmp 0x41e830
cmp al, 0x2f
je 0x41e838
cmp al, 0x5c
jne 0x41e83b
lea ebp, [ecx + 1]
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x41e830
lea esi, [esp + 0x1c]
mov eax, edx
sub esi, edx
jmp 0x41e850
mov cl, byte [eax]
mov byte [esi + eax], cl
inc eax
test cl, cl
jne 0x41e850
cmp ebp, edx
jne 0x41e8c3
mov byte [esp + 0x1c], cl
push ebp
lea ecx, [esp + 0x20]
push ecx
lea esi, [edi + 0x140]
push esi
lea edx, [esp + 0x258]
push str._s_s_s
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [esp + 0x30]
push eax
push esi
call fcn.0041c610
add esp, 0x1c
mov ecx, dword [esp + 0x228]
push 0
push ecx
push 2
push 0
push 0
push 0x40000000
lea edx, [esp + 0x264]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebp, eax
cmp ebp, ebx
jne 0x41e914
mov eax, 0x200
jmp 0x41e9ef
mov eax, ebp
sub eax, edx
mov byte [esp + eax + 0x1c], 0
mov al, byte [esp + 0x1c]
cmp al, 0x2f
je 0x41e8e7
cmp al, 0x5c
je 0x41e8e7
test al, al
je 0x41e862
cmp byte [esp + 0x1d], 0x3a
jne 0x41e862
push ebp
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x254]
push str._s_s
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [esp + 0x2c]
push eax
push 0
call fcn.0041c610
add esp, 0x18
jmp 0x41e890
mov eax, dword [edi + 0x138]
mov ecx, dword [edi]
push eax
push ecx
call fcn.0041e0c0
mov eax, dword [edi + 0x13c]
add esp, 8
test eax, eax
jne 0x41e943
push 0x4000
call fcn.0043d247
add esp, 4
mov dword [edi + 0x13c], eax
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [esp + 0x14], 0
mov eax, dword [edi + 0x13c]
mov ecx, dword [edi]
lea edx, [esp + 0x13]
push edx
push 0x4000
push eax
push ecx
call fcn.0041e250
mov esi, eax
add esp, 0x10
cmp esi, 0xffffff96
je 0x41e9a6
test esi, esi
jl 0x41e99c
jle 0x41e990
mov eax, dword [edi + 0x13c]
push 0
lea edx, [esp + 0x1c]
push edx
push esi
push eax
push ebp
call ebx
test eax, eax
je 0x41e9b0
mov al, byte [esp + 0x13]
test al, al
jne 0x41e9ba
test esi, esi
jne 0x41e951
mov dword [esp + 0x14], 0x5000000
jmp 0x41e9d9
mov dword [esp + 0x14], 0x1000
jmp 0x41e9d9
mov dword [esp + 0x14], 0x400
jmp 0x41e9d9
lea ecx, [esp + 0x23c]
push ecx
lea edx, [esp + 0x230]
push edx
lea eax, [esp + 0x23c]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [edi]
push ecx
call fcn.0041bf10
mov eax, dword [esp + 0x18]
add esp, 4
pop ebp
mov ecx, dword [esp + 0x34c]
pop edi
pop esi
pop ebx
mov dword [0x4638a4], eax
call fcn.0042af5e
add esp, 0x344
ret