Function at 0x41e463
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2c
mov dword [ebp - 0x10], 0x7b829d7e
mov esi, dword [ebp - 0x30]
xor edi, edi
mov eax, dword [ebp - 0x10]
cmp eax, 0x6f32ba3
jg 0x41e4e1
cmp eax, 0xc790f37d
jg 0x41e57c
cmp eax, 0x8c9a7c35
jle 0x41e688
cmp eax, 0xba19f149
jle 0x41e6f3
cmp eax, 0xba19f14a
je 0x41e8ce
cmp eax, 0xc02aa3de
je 0x41e8ec
cmp eax, 0xc3c216ce
jne 0x41e478
imul eax, dword [ebp - 0x14], 0x67628000
shr eax, 6
imul eax, eax, 0x8371
add eax, 0xff896509
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 0xe57461c3
jmp 0x41e478
cmp eax, 0x444b13ff
jg 0x41e548
cmp eax, 0x1b9c2851
jle 0x41e6c3
cmp eax, 0x3361bb00
jle 0x41e812
cmp eax, 0x3361bb01
je 0x41eaca
cmp eax, 0x41e179c3
jne 0x41eb77
mov eax, dword [ebp - 0x14]
shr eax, 0xa
mov ecx, eax
imul ecx, eax
imul edx, ecx, 0xaa9
dec edx
shl eax, 7
add eax, 0x2700
mov dword [ebp - 0x14], eax
mov eax, 0x719fe0ff
cmp ecx, edx
je 0x41eaa7
mov eax, 0x7a18dbdd
jmp 0x41eaa7
cmp eax, 0x719fe0fe
jg 0x41e5bd
cmp eax, 0x630b484a
jg 0x41e73a
cmp eax, 0x444b1400
je 0x41e901
cmp eax, 0x524f7fc6
jne 0x41e478
mov dword [ebp - 0x10], 0x164f71a1
jmp 0x41e478
cmp eax, 0xe5444043
jg 0x41e5ed
cmp eax, 0xe2e8a62f
jg 0x41e7a3
cmp eax, 0xc790f37e
je 0x41e9f2
cmp eax, 0xd914716f
jne 0x41e478
cmp dword [ebp - 0x28], 0
mov eax, 0x375c1a1a
je 0x41eaa7
mov eax, 0x83fc6d78
jmp 0x41eaa7
cmp eax, 0x7b829d7d
jg 0x41e775
cmp eax, 0x719fe0ff
je 0x41e964
cmp eax, 0x7a18dbdd
jne 0x41e478
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x10], 0xe38d4443
jmp 0x41e478
cmp eax, 0xf0558410
jg 0x41e7ce
cmp eax, 0xe57461c3
je 0x41ea28
cmp eax, 0xede0b7b1
jne 0x41eb84
add esi, 6
shr esi, 0xd
add esi, 0xb9
shr esi, 5
imul esi, esi, 0x61
add esi, 0xe8
sub esp, 0x14
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], 0x25eb
mov dword [esp + 8], 0x248b
mov dword [esp + 4], 0x4598
mov dword [esp], 0x2eb7
call fcn.004164ba
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], 0x17a9
mov dword [esp + 8], 0x3198
mov dword [esp + 4], 0x1ce0
mov dword [esp], 0x4861
call fcn.004165c3
add esp, 0x14
mov dword [ebp - 0x10], 0x79322a22
jmp 0x41e478
cmp eax, 0x8410c220
jg 0x41e7f0
cmp eax, 0x826ee42d
je 0x41ea86
cmp eax, 0x83fc6d78
jne 0x41e478
mov eax, dword [ebp - 0x14]
shl eax, 9
add eax, 0xffff6ce7
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 0x6f32ba4
jmp 0x41e478
cmp eax, 0x11f24230
jg 0x41e872
cmp eax, 0x6f32ba4
je 0x41eb1a
cmp eax, 0xa87d953
jne 0x41e478
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x10], 0xc02aa3de
jmp 0x41e478
cmp eax, 0x8c9a7c36
je 0x41e89c
cmp eax, 0x8eaab81d
jne 0x41e478
mov eax, dword [ebp - 0x2c]
cmp eax, 0xffffffff
setne al
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ecx]
mov dword [ebp - 0x28], ecx
cmp dword [ebp - 0x28], 0
setne cl
and cl, al
mov byte [ebp - 0x15], cl
mov eax, dword [ebp - 0x20]
mov eax, dword [eax]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x10], 0xc790f37e
jmp 0x41e478
cmp eax, 0x630b484b
je 0x41e9ad
cmp eax, 0x6d1dd2ca
jne 0x41e478
mov cl, byte [ebp - 0x15]
cmp byte [ebp - 0x16], 0
mov eax, 0xa87d953
jne 0x41e763
mov eax, 0xf884d28d
test cl, cl
jne 0x41eaa7
mov eax, 0xf884d28d
jmp 0x41eaa7
cmp eax, 0x7f31619f
je 0x41e9da
cmp eax, 0x7b829d7e
jne 0x41e478
push eax
mov eax, esp
mov dword [ebp - 0x1c], eax
push eax
mov eax, esp
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x10], 0xe2e8a630
jmp 0x41e478
cmp eax, 0xe2e8a630
je 0x41ea34
cmp eax, 0xe38d4443
jne 0x41e478
mov eax, dword [ebp - 0x1c]
mov dword [eax], 0
mov dword [ebp - 0x10], 0x630b484b
jmp 0x41e478
cmp eax, 0xf0558411
je 0x41ea46
cmp eax, 0xf884d28d
jne 0x41e478
mov dword [ebp - 0x10], 0xd914716f
jmp 0x41e478
cmp eax, 0x8410c221
je 0x41eaaf
cmp eax, 0x84554dd1
jne 0x41e478
mov dword [ebp - 0x10], 0x1f64fb16
jmp 0x41e478
cmp eax, 0x1b9c2852
je 0x41eabe
cmp eax, 0x1f64fb16
jne 0x41e478
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x28]
mov ebx, dword [ebp - 0x34]
sub esp, 0x14
mov dword [esp + 0xc], eax
mov dword [esp + 8], ebx
mov dword [esp + 4], edx
mov dword [esp], ecx
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 0x2c]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x10], 0x6f32ba4
jmp 0x41e478
cmp eax, 0x11f24231
je 0x41eb37
cmp eax, 0x164f71a1
jne 0x41e478
cmp dword [ebp - 0x34], 0
setg byte [ebp - 0x16]
mov dword [ebp - 0x10], 0x8c9a7c36
jmp 0x41e478
mov eax, dword [ebp - 0x14]
lea ecx, [eax - 0x66]
imul ecx, ecx
imul edx, ecx, 0xf89
dec edx
shl eax, 0xd
add eax, 0x44000
mov dword [ebp - 0x14], eax
mov eax, 0xe38d4443
cmp ecx, edx
je 0x41eaa7
mov eax, 0x6d1dd2ca
jmp 0x41eaa7
shr esi, 2
mov eax, 0x3361bb01
and esi, 0x3fffff80
je 0x41eaa7
mov eax, 0xe2e8a630
jmp 0x41eaa7
mov eax, dword [ebp - 0x24]
mov dword [eax], 0
mov dword [ebp - 0x10], 0x1b9c2852
jmp 0x41e478
mov eax, dword [ebp - 0x20]
mov dword [eax], edi
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
sub esp, 0xc
mov dword [esp + 8], ecx
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.0041ca9c
sub esp, 0x10
mov dword [esp + 0x18], edi
mov dword [esp + 0xc], edi
mov dword [esp + 8], edi
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
mov dword [esp + 0x14], 0x80
mov dword [esp + 0x10], 2
mov dword [esp + 4], 0x40000000
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x10], 0xc3c216ce
jmp 0x41e478
shr esi, 0xa
mov eax, esi
shl eax, 5
add esi, eax
add esi, 0xffffe25a
sub esp, 0xc
mov dword [esp], esi
mov dword [esp + 8], 0x49e5
mov dword [esp + 4], 0x57d6
call fcn.004167d9
add esp, 0xc
mov eax, 0xe2e8a630
cmp esi, 0xde
je 0x41eaa7
mov eax, 0xede0b7b1
jmp 0x41eaa7
mov eax, dword [ebp - 0x14]
lea ecx, [eax + 0x4f]
imul ecx, ecx
imul edx, ecx, 0x334b
add eax, 0x78
dec edx
mov dword [ebp - 0x14], eax
mov eax, 0xe2e8a630
cmp edx, ecx
je 0x41eaa7
mov eax, 0x8410c221
jmp 0x41eaa7
imul esi, esi, 0xde
add esi, 0xffffd2d8
mov dword [ebp - 0x10], 0xe2e8a630
jmp 0x41e478
imul eax, dword [ebp - 0x14], 0xb9
lea ecx, [eax + 0x2ecd]
add eax, 0x2e03
imul ecx, ecx
shr eax, 6
imul edx, ecx, 0x3e65
dec edx
mov dword [ebp - 0x14], eax
mov eax, 0x8eaab81d
cmp edx, ecx
je 0x41eaa7
mov eax, 0x524f7fc6
jmp 0x41eaa7
mov dword [ebp - 0x10], 0x8eaab81d
jmp 0x41e478
push eax
mov eax, esp
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x10], 0x41e179c3
jmp 0x41e478
imul esi, esi, 0x34
add esi, 0x37dc
sub esp, 0x10
mov dword [esp], esi
mov dword [esp + 0xc], 0x12ea
mov dword [esp + 8], 0x296d
mov dword [esp + 4], 0x3741
call fcn.00412f93
add esp, 0x10
mov eax, 0xd914716f
cmp esi, 0x2d
jl 0x41eaa7
mov eax, 0x8eaab81d
jmp 0x41eaa7
imul esi, esi, 0xa6
shr esi, 0xf
add esi, 0xffffff80
mov eax, 0xba19f14a
cmp esi, 0x9500
jae 0x41eaa4
mov eax, 0xe5444044
shr esi, 8
mov dword [ebp - 0x10], eax
jmp 0x41e478
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x10], 0x444b1400
jmp 0x41e478
mov dword [ebp - 0x10], 0x84554dd1
jmp 0x41e478
imul esi, esi, 0x78
add esi, 0xfffffe6a
sub esp, 0x14
mov eax, dword [ebp - 0x34]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x1f6a
mov dword [esp + 4], 0x4fcf
mov dword [esp], 0x2d95
mov ebx, 0x6d1dd2ca
and esi, 0xffffe000
mov dword [esp + 8], esi
je 0x41eb0a
mov ebx, 0x164f71a1
call fcn.00417132
add esp, 0x14
mov dword [ebp - 0x10], ebx
jmp 0x41e478
mov eax, dword [ebp - 0x28]
sub esp, 4
mov dword [esp], eax
call fcn.0044db0c
add esp, 4
mov dword [ebp - 0x10], 0x11f24231
jmp 0x41e478
mov ecx, dword [ebp - 0x14]
mov eax, ecx
shl eax, 8
sub eax, ecx
add eax, 0x2a
mov ecx, eax
shl ecx, 7
sub ecx, eax
imul eax, eax
add ecx, 0xffffff73
imul edx, eax, 0x7435
dec edx
shr ecx, 0x19
mov dword [ebp - 0x14], ecx
mov ecx, 0xe2e8a630
cmp edx, eax
je 0x41eb6f
mov ecx, 0x375c1a1a
mov dword [ebp - 0x10], ecx
jmp 0x41e478
cmp eax, 0x375c1a1a
jne 0x41e478
jmp 0x41ebab
cmp eax, 0xe5444044
jne 0x41e478
add esi, 0xfffffea6
mov dword [ebp - 0x30], esi
sub esp, 8
mov dword [esp], esi
mov dword [esp + 4], 0x3cfe
call fcn.00412e4c
mov dword [ebp - 0x30], esi
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret