Function at 0x4109b0
Capabilities:
Write file on windows

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x417d68
push eax
mov eax, 0x10f4
mov dword fs:[0], esp
call fcn.00416730
push ebp
push esi
push edi
lea eax, [esp + 0x900]
push 0x400
xor ebp, ebp
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [esp + 0x900]
push 0x5c
push ecx
call dword [sym.imp.MSVCRT.dll_wcsrchr]
add esp, 8
cmp eax, ebp
je 0x410a03
mov word [eax + 2], bp
lea edx, [esp + 0x900]
push str.process.xml
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
mov ecx, 0x1ff
xor eax, eax
lea edi, [esp + 0x102]
mov word [esp + 0x100], bp
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x31
xor eax, eax
lea edi, [esp + 0x3a]
mov word [esp + 0x38], bp
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
push ebp
mov dword [esp + 0x2a], eax
push 0x80
mov dword [esp + 0x32], eax
push 2
mov dword [esp + 0x3a], eax
push ebp
push ebp
lea ecx, [esp + 0x914]
mov dword [esp + 0x46], eax
push 0x40000000
push ecx
mov word [esp + 0x2c], 0xd
mov word [esp + 0x2e], 0xa
mov word [esp + 0x30], bp
mov word [esp + 0x40], bp
mov word [esp + 0x52], ax
mov dword [esp + 0x28], ebp
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x410ab3
lea ecx, [esp + 0x1110]
mov dword [esp + 0x1108], eax
call sub.MFC42u.DLL_CString::CString
jmp 0x411112
push ebx
push 0xfe
push 0xff
lea edx, [esp + 0x10c]
push str._C_C
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
lea eax, [esp + 0x10]
lea edi, [esp + 0x104]
or ecx, 0xffffffff
push ebp
push eax
xor eax, eax
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
lea ecx, [esp + 0x110]
push ecx
push esi
call ebx
mov eax, dword [esp + 0x1118]
mov ecx, dword [esp + 0x1114]
lea edx, [esp + 0x14]
push edx
push eax
push ecx
lea edx, [esp + 0x110]
push str._product_name__s__opt__d___s
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x14
lea eax, [esp + 0x10]
lea ecx, [esp + 0x104]
push ebp
mov ebp, dword [sym.imp.MSVCRT.dll_wcslen]
push eax
push ecx
call ebp
add esp, 4
lea edx, [esp + 0x10c]
shl eax, 1
push eax
push edx
push esi
call ebx
mov eax, dword [0x421200]
mov dword [esp + 0x20], 0
test eax, eax
jle 0x41109f
mov eax, dword [0x4211fc]
mov ecx, dword [esp + 0x20]
lea edx, [esp + 0x14]
mov edi, dword [eax + ecx*4]
push edx
lea ecx, [esp + 0x18]
lea edx, [esp + 0x108]
lea eax, [edi + 2]
mov dword [esp + 0x20], edi
push eax
push ecx
push str._s_item_name__s___s
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x14
lea eax, [esp + 0x10]
lea ecx, [esp + 0x104]
push 0
push eax
push ecx
call ebp
add esp, 4
lea edx, [esp + 0x10c]
shl eax, 1
push eax
push edx
push esi
call ebx
lea eax, [esp + 0x14]
lea ecx, [edi + 0x25a]
push eax
mov eax, dword [0x421210]
lea edx, [edi + 0xca]
push ecx
and eax, 0xffff
push edx
push eax
lea ecx, [esp + 0x114]
push str._description_l_id__d__title__s___s__description__s
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x18
lea edx, [esp + 0x10]
lea eax, [esp + 0x104]
push 0
push edx
push eax
call ebp
add esp, 4
lea ecx, [esp + 0x10c]
shl eax, 1
push eax
push ecx
push esi
call ebx
mov al, byte [edi]
cmp al, 2
jne 0x410c2a
lea edx, [esp + 0x14]
lea eax, [esp + 0x104]
push edx
push str._type__driver___type__s
push eax
jmp 0x410c54
cmp al, 3
jne 0x410c42
lea ecx, [esp + 0x14]
lea edx, [esp + 0x104]
push ecx
push str._type__AP___type__s
push edx
jmp 0x410c54
lea eax, [esp + 0x14]
lea ecx, [esp + 0x104]
push eax
push str._type__BIOS___type__s
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x104]
push 0
push edx
push eax
call ebp
add esp, 4
lea ecx, [esp + 0x10c]
shl eax, 1
push eax
push ecx
push esi
call ebx
lea edx, [esp + 0x14]
lea eax, [edi + 0x192]
push edx
push eax
lea ecx, [esp + 0x10c]
push str._version___s___version__s
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea edx, [esp + 0x10]
lea eax, [esp + 0x104]
push 0
push edx
push eax
call ebp
add esp, 4
lea ecx, [esp + 0x10c]
shl eax, 1
push eax
push ecx
push esi
call ebx
mov eax, dword [edi + 0x117c]
lea edx, [esp + 0x14]
push edx
push eax
lea ecx, [esp + 0x10c]
push str._size___d___size__s
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea edx, [esp + 0x10]
lea eax, [esp + 0x104]
push 0
push edx
push eax
call ebp
add esp, 4
lea ecx, [esp + 0x10c]
shl eax, 1
push eax
push ecx
push esi
call ebx
lea edx, [esp + 0x14]
lea eax, [edi + 0x65a]
push edx
push eax
lea ecx, [esp + 0x10c]
push str._zip_path___s___zip_path__s
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea edx, [esp + 0x10]
lea eax, [esp + 0x104]
push 0
push edx
push eax
call ebp
add esp, 4
lea ecx, [esp + 0x10c]
shl eax, 1
push eax
push ecx
push esi
call ebx
lea edx, [esp + 0x14]
lea eax, [edi + 0xa5a]
push edx
push eax
lea ecx, [esp + 0x10c]
push str._path___s___path__s
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea edx, [esp + 0x10]
lea eax, [esp + 0x104]
push 0
push edx
push eax
call ebp
add esp, 4
lea ecx, [esp + 0x10c]
shl eax, 1
push eax
push ecx
push esi
call ebx
cmp word [edi + 0xe5a], 0
lea eax, [edi + 0xe5a]
je 0x410ddd
lea edx, [esp + 0x14]
push edx
push eax
lea eax, [esp + 0x10c]
push str._execute___s___execute__s
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea ecx, [esp + 0x10]
lea edx, [esp + 0x104]
push 0
push ecx
push edx
call ebp
add esp, 4
shl eax, 1
push eax
lea eax, [esp + 0x110]
push eax
push esi
call ebx
cmp word [edi + 0xf22], 0
lea eax, [edi + 0xf22]
je 0x410e2b
lea ecx, [esp + 0x14]
lea edx, [esp + 0x104]
push ecx
push eax
push str._uninstall___s___uninstall__s
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [esp + 0x10]
lea ecx, [esp + 0x104]
push 0
push eax
push ecx
call ebp
add esp, 4
lea edx, [esp + 0x10c]
shl eax, 1
push eax
push edx
push esi
call ebx
mov ecx, dword [edi + 0x1180]
lea eax, [esp + 0x14]
push eax
push ecx
lea edx, [esp + 0x10c]
push 0x41e9c8
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [esp + 0x10]
lea ecx, [esp + 0x104]
push 0
push eax
push ecx
call ebp
add esp, 4
lea edx, [esp + 0x10c]
shl eax, 1
push eax
push edx
push esi
call ebx
mov ecx, 0x32
xor eax, eax
lea edi, [esp + 0x3c]
mov dword [esp + 0x24], eax
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x1c]
lea edi, [eax + 0x1184]
cmp dword [edi], 0
je 0x410edb
cmp word [esp + 0x3c], 0
je 0x410ea7
lea ecx, [esp + 0x3c]
push 0x41e9c4
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
mov eax, dword [edi]
lea edx, [esp + 0x28]
push 0xa
push edx
push eax
call dword [sym.imp.MSVCRT.dll__ltow]
add esp, 0xc
lea ecx, [esp + 0x28]
lea edx, [esp + 0x3c]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
mov eax, dword [esp + 0x24]
add edi, 4
inc eax
cmp eax, 0x14
mov dword [esp + 0x24], eax
jl 0x410e8a
cmp word [esp + 0x3c], 0
je 0x410f29
mov edi, dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x3c]
push eax
push ecx
lea edx, [esp + 0x10c]
push str._dependence___s___dependence__s
push edx
call edi
add esp, 0x10
lea eax, [esp + 0x10]
lea ecx, [esp + 0x104]
push 0
push eax
push ecx
call ebp
add esp, 4
lea edx, [esp + 0x10c]
shl eax, 1
push eax
push edx
push esi
call ebx
jmp 0x410f2f
mov edi, dword [sym.imp.USER32.dll_wsprintfW]
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax + 0x11d4]
test ecx, ecx
je 0x410f76
lea ecx, [esp + 0x14]
lea edx, [esp + 0x104]
push ecx
push str._reboot__1___reboot__s
push edx
call edi
add esp, 0xc
lea eax, [esp + 0x10]
lea ecx, [esp + 0x104]
push 0
push eax
push ecx
call ebp
add esp, 4
lea edx, [esp + 0x10c]
shl eax, 1
push eax
push edx
push esi
call ebx
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax + 0x11d8]
test ecx, ecx
je 0x410fbd
lea ecx, [esp + 0x14]
lea edx, [esp + 0x104]
push ecx
push str._downgradable__1___downgradable__s
push edx
call edi
add esp, 0xc
lea eax, [esp + 0x10]
lea ecx, [esp + 0x104]
push 0
push eax
push ecx
call ebp
add esp, 4
lea edx, [esp + 0x10c]
shl eax, 1
push eax
push edx
push esi
call ebx
mov eax, dword [esp + 0x1c]
add eax, 0xfea
cmp word [eax], 0
je 0x411006
lea ecx, [esp + 0x14]
lea edx, [esp + 0x104]
push ecx
push eax
push str._pre_patch___s___pre_patch__s
push edx
call edi
add esp, 0x10
lea eax, [esp + 0x10]
lea ecx, [esp + 0x104]
push 0
push eax
push ecx
call ebp
add esp, 4
lea edx, [esp + 0x10c]
shl eax, 1
push eax
push edx
push esi
call ebx
mov eax, dword [esp + 0x1c]
add eax, 0x10b2
cmp word [eax], 0
je 0x41104f
lea ecx, [esp + 0x14]
lea edx, [esp + 0x104]
push ecx
push eax
push str._post_patch___s___post_patch__s
push edx
call edi
add esp, 0x10
lea eax, [esp + 0x10]
lea ecx, [esp + 0x104]
push 0
push eax
push ecx
call ebp
add esp, 4
lea edx, [esp + 0x10c]
shl eax, 1
push eax
push edx
push esi
call ebx
lea eax, [esp + 0x14]
lea ecx, [esp + 0x104]
push eax
push str.__item__s
push ecx
call edi
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x104]
push 0
push edx
push eax
call ebp
add esp, 4
lea ecx, [esp + 0x10c]
shl eax, 1
push eax
push ecx
push esi
call ebx
mov eax, dword [esp + 0x20]
mov ecx, dword [0x421200]
inc eax
cmp eax, ecx
mov dword [esp + 0x20], eax
jl 0x410b64
lea edx, [esp + 0x14]
lea eax, [esp + 0x14]
push edx
push eax
lea ecx, [esp + 0x10c]
push str._s__product__s
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea edx, [esp + 0x10]
lea eax, [esp + 0x104]
push 0
push edx
push eax
call ebp
add esp, 4
lea ecx, [esp + 0x10c]
shl eax, 1
push eax
push ecx
push esi
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [esp + 0x1114]
mov dword [esp + 0x110c], 0xffffffff
call sub.MFC42u.DLL_CString::CString
pop ebx
mov ecx, dword [esp + 0x1100]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x1100
ret