Function at 0x41d7e3
Capabilities:
Write file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov dword [esp], 0x7b829d7e
mov esi, dword [esp + 0x24]
xor ebp, ebp
mov ebx, dword [sym.imp.KERNEL32.dll_CreateFileW]
mov eax, dword [esp]
cmp eax, 0xa87d952
jg 0x41d873
cmp eax, 0xc790f37d
jle 0x41d8fc
cmp eax, 0xe57461c2
jg 0x41d9ae
cmp eax, 0xe2e8a62f
jg 0x41dad2
cmp eax, 0xc790f37e
je 0x41dc03
cmp eax, 0xd914716f
jne 0x41d7fd
mov ecx, dword [esp + 4]
mov eax, 0xffffff43
add ecx, eax
shr ecx, 0x14
imul eax, ecx, 0xf8
imul ecx, ecx
imul edx, ecx, 0x3705
dec edx
mov dword [esp + 4], eax
mov eax, 0x375c1a1a
cmp edx, ecx
je 0x41dde3
mov eax, 0x1f64fb16
jmp 0x41dde3
cmp eax, 0x524f7fc5
jg 0x41d951
cmp eax, 0x1f64fb15
jg 0x41da05
cmp eax, 0x164f71a0
jg 0x41dafc
cmp eax, 0xa87d953
je 0x41dc17
cmp eax, 0x11f24231
jne 0x41d7fd
imul esi, esi, 0x5390000
add esi, 0x78f8f788
push esi
push 0x255a
call fcn.00419bb0
add esp, 8
push esi
push 0x22f2
push 0x5c23
push 0x5bdf
push 0x10a
push 0x51ff
call fcn.00413b56
add esp, 0x18
mov eax, 0xc3c216ce
cmp esi, 0xc8
jl 0x41dce5
jmp 0x41dde3
cmp eax, 0x8c9a7c35
jle 0x41da44
cmp eax, 0xc02aa3dd
jg 0x41db2a
cmp eax, 0x8c9a7c36
je 0x41d9f9
cmp eax, 0x8eaab81d
jne 0x41d7fd
mov eax, dword [esp + 4]
shl eax, 0xe
add eax, 0xf50000
and eax, 0x1fff0000
or eax, 0x1700
imul eax, eax, 0x47
mov dword [esp + 4], eax
mov dword [esp], 0xc3c216ce
jmp 0x41d7fd
cmp eax, 0x719fe0fe
jle 0x41da82
cmp eax, 0x7b829d7d
jg 0x41db67
cmp eax, 0x719fe0ff
je 0x41dc5a
cmp eax, 0x7a18dbdd
jne 0x41d7fd
push ebp
push 0x80
push 2
push ebp
push ebp
push 0x40000000
push dword [esp + 0x58]
call ebx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
cmp eax, 0xffffffff
setne byte [esp + 9]
mov dword [esp], 0xe38d4443
jmp 0x41d7fd
cmp eax, 0xf884d28c
jg 0x41db89
cmp eax, 0xe57461c3
je 0x41dcb3
cmp eax, 0xede0b7b1
jne 0x41d7fd
imul eax, esi, 0xb5f
shr eax, 3
imul esi, eax, 0x27
add esi, 0x163e
push 0x2e3b
push esi
push 0x23c1
push 0x38ed
call fcn.00418a62
add esp, 0x10
mov dword [esp], 0xc02aa3de
jmp 0x41d7fd
cmp eax, 0x41e179c2
jle 0x41dbda
cmp eax, 0x41e179c3
je 0x41dcef
cmp eax, 0x444b1400
jne 0x41d7fd
mov eax, dword [esp + 0x14]
mov dword [esp + 0x1c], eax
cmp dword [esp + 0x1c], 0
setg byte [esp + 0xb]
mov dword [esp], 0x8eaab81d
jmp 0x41d7fd
cmp eax, 0x83fc6d78
je 0x41dd0c
cmp eax, 0x8410c221
je 0x41dd2d
cmp eax, 0x84554dd1
jne 0x41d7fd
imul eax, dword [esp + 4], 0x174
add eax, 0xfffe791c
mov dword [esp + 4], eax
mov dword [esp], 0x1b9c2852
jmp 0x41d7fd
cmp eax, 0x524f7fc6
je 0x41dd49
cmp eax, 0x630b484b
je 0x41dd55
cmp eax, 0x6d1dd2ca
jne 0x41d7fd
push 0
lea eax, [esp + 0x24]
push eax
push dword [esp + 0x24]
push dword [esp + 0x18]
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp], 0x84554dd1
jmp 0x41d7fd
cmp eax, 0xe2e8a630
je 0x41dd81
cmp eax, 0xe38d4443
jne 0x41d7fd
mov eax, dword [esp + 0x18]
mov dword [esp + 0xc], eax
mov dword [esp], 0x630b484b
jmp 0x41d7fd
cmp eax, 0x164f71a1
je 0x41ddab
cmp eax, 0x1b9c2852
jne 0x41d7fd
push dword [esp + 0xc]
call fcn.0044c77c
add esp, 4
mov dword [esp], 0xf884d28d
jmp 0x41d7fd
cmp eax, 0xc02aa3de
je 0x41ddb7
cmp eax, 0xc3c216ce
jne 0x41d7fd
mov cl, byte [esp + 0xa]
cmp byte [esp + 0xb], 0
mov eax, 0x524f7fc6
jne 0x41db55
mov eax, 0xa87d953
test cl, cl
jne 0x41dde3
mov eax, 0xa87d953
jmp 0x41dde3
cmp eax, 0x7f31619f
je 0x41ddca
cmp eax, 0x7b829d7e
jne 0x41d7fd
mov dword [esp], 0xe2e8a630
jmp 0x41d7fd
cmp eax, 0xf884d28d
je 0x41ddeb
cmp eax, 0x6f32ba4
jne 0x41d7fd
shl esi, 5
mov edi, esi
add edi, 0xffffff50
mov esi, edi
shr esi, 0xd
push 0x2642
push 0xd
push esi
call fcn.004170cf
add esp, 0xc
mov eax, 0xc3c216ce
cmp edi, 0x1d6000
jae 0x41dde3
mov eax, 0x83fc6d78
jmp 0x41dde3
cmp eax, 0x375c1a1a
jne 0x41de08
shl esi, 0xc
mov eax, 0x719fe0ff
add esi, 0xffd33000
je 0x41dde3
mov eax, 0x11f24231
jmp 0x41dde3
mov dword [esp + 0x20], 0
mov dword [esp], 0x164f71a1
jmp 0x41d7fd
mov eax, dword [esp + 4]
lea ecx, [eax + 0x62]
imul ecx, ecx
lea eax, [eax*4 + 0x188]
and eax, 0x3ffffc
imul edx, ecx, 0x3a89
dec edx
imul eax, eax, 0xcd
add eax, 0x9425
mov dword [esp + 4], eax
mov eax, 0x6f32ba4
cmp ecx, edx
je 0x41dde3
mov eax, 0x8c9a7c36
jmp 0x41dde3
imul esi, esi, 0x209b5880
add esi, 0xffffa3d5
push esi
push 0x1b28
push 0x2565
push 0xd9b
push 0x5438
call fcn.00419bc3
add esp, 0x14
push 0x401a
push esi
push 0x2e71
push 0x5a1b
call fcn.00417759
add esp, 0x10
mov eax, 0xc02aa3de
cmp esi, 0x23
jl 0x41dde3
mov eax, 0xede0b7b1
jmp 0x41dde3
mov ecx, dword [esp + 4]
shr ecx, 0xc
lea eax, [ecx - 0xbf]
imul ecx, ecx
imul edx, ecx, 0x7d5
dec edx
shr eax, 5
lea eax, [eax*8 + 0x430]
mov dword [esp + 4], eax
mov eax, 0x8410c221
cmp ecx, edx
je 0x41dde3
mov eax, 0x444b1400
jmp 0x41dde3
imul eax, dword [esp + 4], 0x3e00000
add eax, 0xdde000fb
mov dword [esp + 4], eax
mov dword [esp], 0x7a18dbdd
jmp 0x41d7fd
add esi, 0xffffff21
mov eax, 0x8410c221
cmp esi, 0xdf
jb 0x41dde3
mov eax, 0xc3c216ce
jmp 0x41dde3
cmp dword [esp + 0xc], 0
setne al
and al, byte [esp + 9]
mov byte [esp + 0xa], al
mov dword [esp], 0xe57461c3
jmp 0x41d7fd
mov dword [esp], 0xc790f37e
jmp 0x41d7fd
mov eax, dword [esp + 4]
shr eax, 7
mov ecx, eax
imul ecx, eax
add eax, eax
lea eax, [eax + eax*2]
imul edx, ecx, 0x4d0b
dec edx
mov dword [esp + 4], eax
mov eax, 0xe2e8a630
cmp ecx, edx
je 0x41dde3
mov eax, 0x8410c221
jmp 0x41dde3
mov dword [esp + 0x18], ebp
mov dword [esp + 0x14], ebp
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x1c]
push eax
push dword [esp + 0x44]
call fcn.0041c018
add esp, 0xc
mov dword [esp], 0x41e179c3
jmp 0x41d7fd
mov dword [esp], 0x6d1dd2ca
jmp 0x41d7fd
cmp dword [esp + 0xc], 0
mov eax, 0xd914716f
je 0x41dde3
mov eax, 0x1b9c2852
jmp 0x41dde3
lea esi, [esi*4 + 0x300]
shr esi, 4
mov eax, 0x8410c221
cmp esi, 0x51
je 0x41dde3
mov eax, 0x7a18dbdd
mov dword [esp], eax
jmp 0x41d7fd
imul eax, dword [esp + 4], 0x440c
add eax, 0xffddc5b2
mov dword [esp + 4], eax
mov dword [esp], 0x1f64fb16
jmp 0x41d7fd
cmp eax, 0x1f64fb16
jne 0x41d7fd
mov dword [esp + 0x24], esi
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret