Function at 0x471196
Capabilities:
Write file on windows

Disassembly:
push 0xdb4
mov eax, 0x5042b3
call fcn.004e6cea
mov dword [ebp - 0xd78], ecx
lea ecx, [ebp - 0xd9c]
call fcn.0047114f
xor eax, eax
push eax
push 0x80
push 2
push eax
push 1
push 0xc0000000
mov dword [ebp - 4], eax
push dword [ebp - 0xd9c]
mov dword [ebp - 0xda0], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
mov dword [ebp - 0xda4], ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp ebx, 0xffffffff
je 0x471627
xor eax, eax
mov word [ebp - 0xd88], 0xbbef
push eax
mov dword [ebp - 0xd74], eax
lea eax, [ebp - 0xd74]
push eax
push 3
lea eax, [ebp - 0xd88]
mov byte [ebp - 0xd86], 0xbf
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 5
pop ecx
mov esi, str.var_KWHISTORY_DATA___
lea edi, [ebp - 0x28]
rep movsd dword es:[edi], dword [esi]
lea ecx, [ebp - 0x28]
lea edx, [ecx + 1]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x47123a
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
xor eax, eax
push eax
lea eax, [ebp - 0xd74]
sub ecx, edx
push eax
push ecx
lea eax, [ebp - 0x28]
push eax
push ebx
call edi
xor eax, eax
push 0xc17
push eax
mov byte [ebp - 0xd48], al
lea eax, [ebp - 0xd47]
push eax
call fcn.004deff0
xor eax, eax
push 0x103
push eax
mov byte [ebp - 0x130], al
lea eax, [ebp - 0x12f]
push eax
call fcn.004deff0
mov esi, dword [0x548750]
add esp, 0x18
mov dword [ebp - 0xd8c], esi
mov dword [ebp - 0xda8], esi
mov dword [ebp - 0xd90], esi
mov dword [ebp - 0xd94], esi
mov edx, dword [ebp - 0xd78]
mov byte [ebp - 4], 3
mov eax, dword [edx + 4]
sub eax, dword [edx]
sar eax, 5
mov dword [ebp - 0xd98], eax
test eax, eax
jle 0x4715c0
xor ecx, ecx
mov dword [ebp - 0xd7c], ecx
test eax, eax
jle 0x4715ae
mov dword [ebp - 0xd80], ecx
mov eax, dword [edx]
push esi
push dword [eax + ecx + 0x18]
call fcn.004da5d4
pop ecx
pop ecx
test eax, eax
je 0x4713d6
mov eax, dword [ebp - 0xd78]
xor esi, esi
mov ecx, dword [ebp - 0xd80]
add ecx, 0x18
mov dword [ebp - 0xd7c], esi
mov eax, dword [eax]
add eax, ecx
lea ecx, [ebp - 0xd90]
push eax
call fcn.00402aef
lea ecx, [ebp - 0x130]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x47132c
sub ecx, edx
je 0x471349
push esi
lea eax, [ebp - 0xd74]
push eax
push 3
push 0x52b054
push ebx
call edi
mov esi, dword [ebp - 0xd90]
mov dword [ebp - 0xd8c], esi
test esi, esi
je 0x47137a
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0xda0]
jne 0x47135e
sub ecx, edx
sar ecx, 1
inc ecx
cmp ecx, 0x3fffffff
jle 0x47137e
xor eax, eax
jmp 0x47139a
lea edi, [ecx + ecx]
mov eax, edi
call fcn.004e37c0
mov ecx, esp
mov edx, esi
push 3
push edi
call fcn.00405007
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
push eax
lea eax, [ebp - 0x130]
push str.date:_s_kw_history:_
push eax
call fcn.004da993
lea ecx, [ebp - 0x130]
add esp, 0xc
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4713b8
xor eax, eax
sub ecx, edx
push eax
lea eax, [ebp - 0xd74]
push eax
push ecx
lea eax, [ebp - 0x130]
push eax
push ebx
call edi
cmp dword [ebp - 0xd7c], 0
je 0x4713f3
xor eax, eax
push eax
lea eax, [ebp - 0xd74]
push eax
push 1
push 0x52b070
push ebx
call edi
mov eax, dword [ebp - 0xd78]
xor ecx, ecx
mov edx, dword [ebp - 0xd80]
mov dword [ebp - 0xd7c], ecx
mov eax, dword [eax]
mov eax, dword [edx + eax + 0x1c]
mov eax, dword [eax - 8]
mov dword [ebp - 0xd70], eax
test eax, eax
jle 0x471475
mov ebx, dword [ebp - 0xd78]
mov esi, eax
mov eax, dword [ebx]
add eax, 0x1c
add eax, edx
mov dword [ebp - 0xd70], eax
mov eax, dword [eax]
cmp word [eax + ecx*2], 0x5c
jne 0x47145e
mov ecx, dword [ebp - 0xd70]
call fcn.00402cc2
mov ecx, dword [ebp - 0xd70]
push 0x2f
pop edx
mov eax, dword [ecx]
mov ecx, dword [ebp - 0xd7c]
mov word [eax + ecx*2], dx
mov edx, dword [ebp - 0xd80]
inc ecx
mov dword [ebp - 0xd7c], ecx
cmp ecx, esi
jl 0x471422
mov esi, dword [ebp - 0xd8c]
mov ebx, dword [ebp - 0xda4]
mov eax, dword [ebp - 0xd78]
mov ecx, dword [eax]
mov eax, dword [ecx + edx + 8]
mov dword [ebp - 0xdb0], eax
mov eax, dword [ecx + edx + 0xc]
mov dword [ebp - 0xdac], eax
lea eax, [ebp - 0xdb0]
push eax
lea eax, [ebp - 0xd6c]
push eax
call fcn.004dcc50
mov ax, word [ebp - 0xd68]
mov ecx, dword [ebp - 0xd64]
mov word [ebp - 0xdb6], ax
mov eax, dword [0x548750]
mov word [ebp - 0xdb8], cx
mov dword [ebp - 0xd70], eax
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0xdb8]
shr eax, 0x10
push eax
movzx eax, cx
push eax
lea eax, [ebp - 0xd70]
push 0x52b074
push eax
call fcn.0040306c
mov eax, dword [ebp - 0xd78]
mov ecx, dword [ebp - 0xd80]
mov eax, dword [eax]
push dword [ecx + eax + 0x14]
push dword [ecx + eax + 0x10]
push dword [ecx + eax + 0x1c]
lea eax, [ebp - 0xd94]
push dword [ebp - 0xd70]
push str.date_time:_s_icon:_s_http_url:_s_title:_s
push eax
call fcn.0040306c
mov eax, dword [ebp - 0xd94]
add esp, 0x30
xor edx, edx
mov ecx, dword [eax - 8]
push edx
push edx
push 0xc18
lea edx, [ebp - 0xd48]
inc ecx
push edx
push ecx
push eax
xor eax, eax
push eax
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea ecx, [ebp - 0xd48]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x471554
xor eax, eax
sub ecx, edx
push eax
lea eax, [ebp - 0xd74]
push eax
push ecx
lea eax, [ebp - 0xd48]
push eax
push ebx
call edi
lea ecx, [ebp - 0xd70]
mov dword [ebp - 0xd7c], 1
mov byte [ebp - 4], 3
call fcn.00403080
mov ecx, dword [ebp - 0xd80]
mov edx, dword [ebp - 0xd78]
add ecx, 0x20
dec dword [ebp - 0xd98]
mov dword [ebp - 0xd80], ecx
jne 0x4712e6
xor ecx, ecx
push ecx
lea eax, [ebp - 0xd74]
push eax
push 2
push 0x52b0f0
push ebx
call edi
mov ax, word [0x52b0f4]
lea ecx, [ebp - 0xd84]
mov word [ebp - 0xd84], ax
lea edx, [ecx + 1]
mov al, byte [0x52b0f6]
mov byte [ebp - 0xd82], al
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4715e1
xor eax, eax
sub ecx, edx
push eax
lea eax, [ebp - 0xd74]
push eax
push ecx
lea eax, [ebp - 0xd84]
push eax
push ebx
call edi
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0xd94]
call fcn.00403080
lea ecx, [ebp - 0xd90]
call fcn.00403080
lea ecx, [ebp - 0xda8]
call fcn.00403080
lea ecx, [ebp - 0xd9c]
call fcn.00403080
lea esp, [ebp - 0xdd0]
call fcn.004e6c99
ret