Function at 0x41f7d0
Capabilities:
Write file on windows

Disassembly:
mov eax, 0x434c
call fcn.004479f0
mov eax, dword [0x47b660]
xor eax, esp
mov dword [esp + 0x4344], eax
mov eax, dword [esp + 0x4354]
push ebx
push ebp
mov ebp, dword [esp + 0x4358]
push esi
or esi, 0xffffffff
push edi
mov ebx, ecx
mov dword [esp + 0x14], eax
cmp dword [ebp + 4], esi
je 0x41f810
mov edi, dword [ebp]
call fcn.0041f180
mov dword [ebp + 4], esi
mov esi, dword [ebp]
cmp ebx, dword [esi + 4]
jl 0x41f825
mov eax, 0x10000
jmp 0x41fa7c
cmp ebx, dword [esi + 0x10]
jge 0x41f82f
call fcn.0041eba0
mov ecx, dword [ebp]
cmp dword [ecx + 0x10], ebx
jge 0x41f886
mov esi, dword [ebp]
test esi, esi
je 0x41f87e
cmp dword [esi + 0x18], 0
je 0x41f87e
mov eax, dword [esi + 0x10]
inc eax
cmp eax, dword [esi + 4]
je 0x41f87e
mov edx, dword [esi + 0x50]
add edx, dword [esi + 0x4c]
mov ecx, dword [esi + 0x48]
push 0
mov dword [esi + 0x10], eax
lea edx, [edx + ecx + 0x2e]
add dword [esi + 0x14], edx
push 0
lea eax, [esi + 0x78]
push eax
lea ecx, [esi + 0x28]
push ecx
mov eax, esi
call fcn.0041e750
add esp, 0x10
neg eax
sbb eax, eax
inc eax
mov dword [esi + 0x18], eax
mov edx, dword [ebp]
cmp dword [edx + 0x10], ebx
jl 0x41f837
lea eax, [esp + 0x18]
push eax
push ebx
mov ecx, ebp
call fcn.0041f2e0
test byte [esp + 0x120], 0x10
je 0x41f8ca
lea ecx, [esp + 0x1c]
push ecx
lea esi, [esp + 0x14c]
call fcn.0041e140
add esp, 4
mov edx, esi
push edx
add ebp, 0x138
push ebp
call fcn.0041f6c0
add esp, 8
xor eax, eax
jmp 0x41fa7c
mov edi, dword [esp + 0x14]
movzx eax, word [edi]
mov esi, edi
mov ecx, edi
test ax, ax
je 0x41f9a2
movzx eax, ax
cmp ax, 0x2f
je 0x41f8ed
cmp ax, 0x5c
jne 0x41f8f0
lea esi, [ecx + 2]
movzx eax, word [ecx + 2]
add ecx, 2
test ax, ax
jne 0x41f8e1
cmp esi, edi
je 0x41f9a2
lea edx, [esp + 0x148]
mov eax, edi
sub edx, edi
nop
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x41f910
sub esi, edi
xor eax, eax
sar esi, 1
mov word [esp + esi*2 + 0x146], ax
mov ax, word [esp + 0x148]
cmp ax, 0x2f
je 0x41f950
cmp ax, 0x5c
je 0x41f950
cmp word [esp + 0x14a], 0x3a
je 0x41f950
xor bl, bl
jmp 0x41f952
mov bl, 1
lea ecx, [esp + 0x148]
push 0x46f30c
push ecx
call fcn.004437e1
lea edx, [esp + 0x150]
push 0x46f314
push edx
mov esi, eax
call fcn.004437e1
add esp, 0x10
test eax, eax
setne al
test esi, esi
setne cl
or al, cl
or al, bl
jne 0x41f9a2
lea edx, [esp + 0x148]
push edx
lea eax, [ebp + 0x138]
push eax
call fcn.0041f6c0
add esp, 8
mov ecx, dword [esp + 0x120]
push 0
push ecx
push 2
push 0
push 0
push 0x40000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x41f9cf
mov eax, 0x200
jmp 0x41fa7c
mov eax, dword [ebp]
call fcn.0041eed0
mov eax, dword [ebp]
lea edx, [esp + 0x350]
push edx
mov ecx, 0x4000
xor bl, bl
call fcn.0041efe0
add esp, 4
test eax, eax
jl 0x41fa30
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
je 0x41fa32
push 0
lea ecx, [esp + 0x18]
push ecx
push eax
lea edx, [esp + 0x35c]
push edx
push esi
call edi
test eax, eax
je 0x41fa30
lea eax, [esp + 0x350]
push eax
mov eax, dword [ebp]
mov ecx, 0x4000
call fcn.0041efe0
add esp, 4
test eax, eax
jge 0x41f9fb
mov bl, 1
push esi
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 1
jne 0x41fa61
test bl, bl
jne 0x41fa61
lea ecx, [esp + 0x134]
push ecx
lea edx, [esp + 0x128]
push edx
lea eax, [esp + 0x134]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [ebp]
call fcn.0041f180
movzx eax, bl
neg eax
sbb eax, eax
and eax, 0x400
mov ecx, dword [esp + 0x4354]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00442896
add esp, 0x434c
ret 8