Function at 0x46cfa2
Capabilities:
Write file on windows

Disassembly:
push 0xdb4
mov eax, 0x50023b
call fcn.004e336a
mov dword [ebp - 0xd78], ecx
lea ecx, [ebp - 0xd9c]
call fcn.0046cf5b
xor eax, eax
push eax
push 0x80
push 2
push eax
push 1
push 0xc0000000
mov dword [ebp - 4], eax
push dword [ebp - 0xd9c]
mov dword [ebp - 0xda0], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
mov dword [ebp - 0xda4], ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp ebx, 0xffffffff
je 0x46d433
xor eax, eax
mov word [ebp - 0xd88], 0xbbef
push eax
mov dword [ebp - 0xd74], eax
lea eax, [ebp - 0xd74]
push eax
push 3
lea eax, [ebp - 0xd88]
mov byte [ebp - 0xd86], 0xbf
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 5
pop ecx
mov esi, str.var_KWHISTORY_DATA___
lea edi, [ebp - 0x28]
rep movsd dword es:[edi], dword [esi]
lea ecx, [ebp - 0x28]
lea edx, [ecx + 1]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x46d046
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
xor eax, eax
push eax
lea eax, [ebp - 0xd74]
sub ecx, edx
push eax
push ecx
lea eax, [ebp - 0x28]
push eax
push ebx
call edi
xor eax, eax
push 0xc17
push eax
mov byte [ebp - 0xd48], al
lea eax, [ebp - 0xd47]
push eax
call fcn.004db6f0
xor eax, eax
push 0x103
push eax
mov byte [ebp - 0x130], al
lea eax, [ebp - 0x12f]
push eax
call fcn.004db6f0
mov esi, dword [0x542750]
add esp, 0x18
mov dword [ebp - 0xd8c], esi
mov dword [ebp - 0xda8], esi
mov dword [ebp - 0xd90], esi
mov dword [ebp - 0xd94], esi
mov edx, dword [ebp - 0xd78]
mov byte [ebp - 4], 3
mov eax, dword [edx + 4]
sub eax, dword [edx]
sar eax, 5
mov dword [ebp - 0xd98], eax
test eax, eax
jle 0x46d3cc
xor ecx, ecx
mov dword [ebp - 0xd7c], ecx
test eax, eax
jle 0x46d3ba
mov dword [ebp - 0xd80], ecx
mov eax, dword [edx]
push esi
push dword [eax + ecx + 0x18]
call fcn.004d6cd4
pop ecx
pop ecx
test eax, eax
je 0x46d1e2
mov eax, dword [ebp - 0xd78]
xor esi, esi
mov ecx, dword [ebp - 0xd80]
add ecx, 0x18
mov dword [ebp - 0xd7c], esi
mov eax, dword [eax]
add eax, ecx
lea ecx, [ebp - 0xd90]
push eax
call fcn.00402a9f
lea ecx, [ebp - 0x130]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x46d138
sub ecx, edx
je 0x46d155
push esi
lea eax, [ebp - 0xd74]
push eax
push 3
push 0x52643c
push ebx
call edi
mov esi, dword [ebp - 0xd90]
mov dword [ebp - 0xd8c], esi
test esi, esi
je 0x46d186
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0xda0]
jne 0x46d16a
sub ecx, edx
sar ecx, 1
inc ecx
cmp ecx, 0x3fffffff
jle 0x46d18a
xor eax, eax
jmp 0x46d1a6
lea edi, [ecx + ecx]
mov eax, edi
call fcn.004dfec0
mov ecx, esp
mov edx, esi
push 3
push edi
call fcn.00404eea
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
push eax
lea eax, [ebp - 0x130]
push str.date:_s_kw_history:_
push eax
call fcn.004d7093
lea ecx, [ebp - 0x130]
add esp, 0xc
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x46d1c4
xor eax, eax
sub ecx, edx
push eax
lea eax, [ebp - 0xd74]
push eax
push ecx
lea eax, [ebp - 0x130]
push eax
push ebx
call edi
cmp dword [ebp - 0xd7c], 0
je 0x46d1ff
xor eax, eax
push eax
lea eax, [ebp - 0xd74]
push eax
push 1
push 0x526458
push ebx
call edi
mov eax, dword [ebp - 0xd78]
xor ecx, ecx
mov edx, dword [ebp - 0xd80]
mov dword [ebp - 0xd7c], ecx
mov eax, dword [eax]
mov eax, dword [edx + eax + 0x1c]
mov eax, dword [eax - 8]
mov dword [ebp - 0xd70], eax
test eax, eax
jle 0x46d281
mov ebx, dword [ebp - 0xd78]
mov esi, eax
mov eax, dword [ebx]
add eax, 0x1c
add eax, edx
mov dword [ebp - 0xd70], eax
mov eax, dword [eax]
cmp word [eax + ecx*2], 0x5c
jne 0x46d26a
mov ecx, dword [ebp - 0xd70]
call fcn.00402c72
mov ecx, dword [ebp - 0xd70]
push 0x2f
pop edx
mov eax, dword [ecx]
mov ecx, dword [ebp - 0xd7c]
mov word [eax + ecx*2], dx
mov edx, dword [ebp - 0xd80]
inc ecx
mov dword [ebp - 0xd7c], ecx
cmp ecx, esi
jl 0x46d22e
mov esi, dword [ebp - 0xd8c]
mov ebx, dword [ebp - 0xda4]
mov eax, dword [ebp - 0xd78]
mov ecx, dword [eax]
mov eax, dword [ecx + edx + 8]
mov dword [ebp - 0xdb0], eax
mov eax, dword [ecx + edx + 0xc]
mov dword [ebp - 0xdac], eax
lea eax, [ebp - 0xdb0]
push eax
lea eax, [ebp - 0xd6c]
push eax
call fcn.004d9350
mov ax, word [ebp - 0xd68]
mov ecx, dword [ebp - 0xd64]
mov word [ebp - 0xdb6], ax
mov eax, dword [0x542750]
mov word [ebp - 0xdb8], cx
mov dword [ebp - 0xd70], eax
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0xdb8]
shr eax, 0x10
push eax
movzx eax, cx
push eax
lea eax, [ebp - 0xd70]
push 0x52645c
push eax
call fcn.0040301c
mov eax, dword [ebp - 0xd78]
mov ecx, dword [ebp - 0xd80]
mov eax, dword [eax]
push dword [ecx + eax + 0x14]
push dword [ecx + eax + 0x10]
push dword [ecx + eax + 0x1c]
lea eax, [ebp - 0xd94]
push dword [ebp - 0xd70]
push str.date_time:_s_icon:_s_http_url:_s_title:_s
push eax
call fcn.0040301c
mov eax, dword [ebp - 0xd94]
add esp, 0x30
xor edx, edx
mov ecx, dword [eax - 8]
push edx
push edx
push 0xc18
lea edx, [ebp - 0xd48]
inc ecx
push edx
push ecx
push eax
xor eax, eax
push eax
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea ecx, [ebp - 0xd48]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x46d360
xor eax, eax
sub ecx, edx
push eax
lea eax, [ebp - 0xd74]
push eax
push ecx
lea eax, [ebp - 0xd48]
push eax
push ebx
call edi
lea ecx, [ebp - 0xd70]
mov dword [ebp - 0xd7c], 1
mov byte [ebp - 4], 3
call fcn.00403030
mov ecx, dword [ebp - 0xd80]
mov edx, dword [ebp - 0xd78]
add ecx, 0x20
dec dword [ebp - 0xd98]
mov dword [ebp - 0xd80], ecx
jne 0x46d0f2
xor ecx, ecx
push ecx
lea eax, [ebp - 0xd74]
push eax
push 2
push 0x5264d8
push ebx
call edi
mov ax, word [0x5264dc]
lea ecx, [ebp - 0xd84]
mov word [ebp - 0xd84], ax
lea edx, [ecx + 1]
mov al, byte [0x5264de]
mov byte [ebp - 0xd82], al
mov al, byte [ecx]
inc ecx
test al, al
jne 0x46d3ed
xor eax, eax
sub ecx, edx
push eax
lea eax, [ebp - 0xd74]
push eax
push ecx
lea eax, [ebp - 0xd84]
push eax
push ebx
call edi
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0xd94]
call fcn.00403030
lea ecx, [ebp - 0xd90]
call fcn.00403030
lea ecx, [ebp - 0xda8]
call fcn.00403030
lea ecx, [ebp - 0xd9c]
call fcn.00403030
lea esp, [ebp - 0xdd0]
call fcn.004e3319
ret