Function at 0x41cde3
Capabilities:
Write file on windows

Disassembly:
push 0x40
mov eax, 0x451ece
call fcn.00433681
cmp dword [0x47164c], 0
je 0x41d12b
xor esi, esi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], esi
sub esp, 0xc
mov dword [ebp - 4], esi
push 3
push ecx
push 0x80000000
push dword [ebp + 8]
lea ecx, [ebp - 0x24]
call fcn.0041cd0d
mov edi, eax
test edi, edi
jns 0x41ce38
cmp dword [ebp - 0x24], esi
je 0x41ce31
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
jmp 0x41d130
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x28], esi
sub esp, 0xc
mov byte [ebp - 4], 1
push 2
push ecx
push 0x40000000
push dword [ebp + 0xc]
lea ecx, [ebp - 0x2c]
call fcn.0041cd0d
mov edi, eax
test edi, edi
jns 0x41ce7c
cmp dword [ebp - 0x2c], 0
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x41ce6f
push dword [ebp - 0x2c]
call esi
cmp dword [ebp - 0x24], 0
je 0x41ce31
push dword [ebp - 0x24]
call esi
jmp 0x41ce31
lea eax, [ebp - 0x1c]
xorps xmm0, xmm0
push eax
lea ecx, [ebp - 0x24]
movlpd qword [ebp - 0x1c], xmm0
call fcn.0041cdad
mov edi, eax
test edi, edi
js 0x41ce5e
mov edi, dword [ebp - 0x1c]
mov ebx, dword [ebp - 0x18]
mov dword [ebp + 8], ebx
cmp edi, esi
jne 0x41ceca
cmp ebx, esi
jne 0x41cecc
cmp dword [ebp - 0x2c], 0
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x41ceb8
push dword [ebp - 0x2c]
call esi
cmp dword [ebp - 0x24], 0
je 0x41cec3
push dword [ebp - 0x24]
call esi
xor eax, eax
jmp 0x41d130
cmp ebx, esi
ja 0x41d067
cmp edi, 0x3b9aca00
ja 0x41d067
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x40], esi
push ecx
push edi
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 2
call fcn.0041d138
cmp edi, dword [ebp - 0x48]
jne 0x41d0f9
cmp ebx, esi
jne 0x41d0f9
push dword [ebp - 0x48]
mov edi, dword [ebp - 0x4c]
push edi
lea ecx, [ebp - 0x24]
call fcn.0041cd72
mov ebx, eax
test ebx, ebx
jns 0x41cf4c
test edi, edi
je 0x41cf29
push edi
call fcn.0042df00
pop ecx
cmp dword [ebp - 0x2c], 0
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x41cf3a
push dword [ebp - 0x2c]
call esi
cmp dword [ebp - 0x24], 0
je 0x41cf45
push dword [ebp - 0x24]
call esi
mov eax, ebx
jmp 0x41d130
mov eax, dword [ebp - 0x18]
cmp eax, esi
ja 0x41cf67
mov ecx, 0xf4240
mov dword [ebp + 0xc], ecx
cmp dword [ebp - 0x1c], ecx
ja 0x41cf67
mov eax, esi
mov dword [ebp + 8], eax
jmp 0x41cf6d
mov ecx, dword [ebp - 0x1c]
mov dword [ebp + 0xc], ecx
mov ebx, esi
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x30], esi
mov byte [ebp - 4], 4
cmp eax, esi
ja 0x41cfee
jb 0x41cf8d
cmp ecx, 0x3b9aca00
ja 0x41cfee
push ecx
push esi
lea ecx, [ebp - 0x3c]
call fcn.0041d138
mov ebx, dword [ebp + 0xc]
push ecx
push ebx
lea ecx, [ebp - 0x3c]
call fcn.0041d138
cmp ebx, dword [ebp - 0x38]
jne 0x41d0a4
cmp dword [ebp + 8], esi
jne 0x41d0a4
push dword [ebp - 0x48]
lea eax, [ebp - 0x18]
push edi
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0x3c]
push eax
push ebx
call dword [0x47164c]
add esp, 0x10
test eax, eax
jne 0x41d04c
mov eax, dword [ebp - 0x18]
cmp esi, dword [ebp + 8]
ja 0x41d051
jb 0x41cfe1
cmp eax, dword [ebp + 0xc]
ja 0x41d051
push ecx
push eax
lea ecx, [ebp - 0x3c]
call fcn.0041d138
mov ebx, dword [ebp - 0x3c]
push esi
lea eax, [ebp + 8]
push eax
push dword [ebp - 0x38]
push ebx
push dword [ebp - 0x2c]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x41d00b
call fcn.004019f2
mov esi, eax
test esi, esi
jns 0x41d0da
test ebx, ebx
je 0x41d01e
push ebx
call fcn.0042df00
pop ecx
test edi, edi
je 0x41d029
push edi
call fcn.0042df00
pop ecx
cmp dword [ebp - 0x2c], 0
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x41d03a
push dword [ebp - 0x2c]
call edi
cmp dword [ebp - 0x24], 0
je 0x41d045
push dword [ebp - 0x24]
call edi
mov eax, esi
jmp 0x41d130
cmp eax, 0xfffffffb
je 0x41d08d
test ebx, ebx
je 0x41d05c
push ebx
call fcn.0042df00
pop ecx
test edi, edi
je 0x41d067
push edi
call fcn.0042df00
pop ecx
cmp dword [ebp - 0x2c], 0
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x41d078
push dword [ebp - 0x2c]
call esi
cmp dword [ebp - 0x24], 0
je 0x41d083
push dword [ebp - 0x24]
call esi
mov eax, 0x80004005
jmp 0x41d130
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
shld eax, ecx, 1
add ecx, ecx
mov dword [ebp + 8], eax
mov dword [ebp + 0xc], ecx
jmp 0x41cf7f
cmp dword [ebp - 0x3c], 0
je 0x41d0b3
push dword [ebp - 0x3c]
call fcn.0042df00
pop ecx
test edi, edi
je 0x41d108
push edi
jmp 0x41d102
test ebx, ebx
je 0x41d0e5
push ebx
call fcn.0042df00
pop ecx
test edi, edi
je 0x41cea7
push edi
call fcn.0042df00
pop ecx
jmp 0x41cea7
cmp dword [ebp - 0x4c], 0
je 0x41d108
push dword [ebp - 0x4c]
call fcn.0042df00
pop ecx
cmp dword [ebp - 0x2c], 0
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x41d119
push dword [ebp - 0x2c]
call esi
cmp dword [ebp - 0x24], 0
je 0x41d124
push dword [ebp - 0x24]
call esi
mov eax, 0x8007000e
jmp 0x41d130
mov eax, 0x80004002
call fcn.004335e6
ret 0xc