Function at 0x416940
Capabilities:
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x50fb17
mov eax, dword fs:[0]
push eax
sub esp, 0x710
mov eax, dword [0x56957c]
xor eax, esp
mov dword [esp + 0x708], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x56957c]
xor eax, esp
push eax
lea eax, [esp + 0x724]
mov dword fs:[0], eax
cmp byte [0x571bc5], 0
mov eax, dword [esp + 0x734]
mov dword [esp + 0x20], eax
mov dword [esp + 0x18], ecx
jne 0x416d01
call fcn.0041d570
cmp byte [eax + 0x96a], 0
je 0x416d01
cmp byte [0x571bc5], 0
jne 0x416d01
call fcn.0041d570
cmp byte [eax + 0x128], 0
je 0x4169c9
add eax, 0x18
jmp 0x4169cc
mov eax, dword [eax + 0x14]
lea esi, [eax + 4]
xor ebp, ebp
cmp esi, ebp
je 0x416d01
cmp word [esi], bp
je 0x416d01
lea ecx, [esp + 0x154]
call fcn.004174b0
mov eax, esi
lea edx, [esp + 0x154]
mov dword [esp + 0x72c], ebp
call fcn.00417710
push ebp
push ebp
push ebp
push ebp
push ebp
push str.ErrorLog
lea ecx, [esp + 0x44]
call fcn.0041dc60
cmp byte [esp + 0x148], 0
lea eax, [esp + 0x38]
jne 0x416a28
mov eax, dword [esp + 0x34]
cmp word [eax + 4], 0x2e
lea ecx, [esp + 0x154]
jne 0x416a42
lea edx, [esp + 0x2c]
push edx
call fcn.0041f1b0
jmp 0x416a4c
lea eax, [esp + 0x2c]
push eax
call fcn.0041e2f0
cmp byte [esp + 0x148], 0
mov dword [esp + 0x2c], vtable.t_str.0
jne 0x416a73
mov eax, dword [esp + 0x34]
lea ecx, [esp + 0x38]
cmp eax, ecx
je 0x416a73
push eax
call fcn.004ed7b6
add esp, 4
lea ecx, [esp + 0x154]
mov dword [esp + 0x72c], 1
call fcn.0041e510
test al, al
je 0x416cf5
push ebp
call fcn.004ee71e
add esp, 4
lea ecx, [esp + 0x3a4]
mov esi, eax
mov edi, edx
call fcn.004174b0
push str._Y__M__D
push edi
push esi
lea esi, [esp + 0x3b0]
mov byte [esp + 0x738], 2
call fcn.004181b0
push ebp
push ebp
push ebp
push ebp
mov ecx, esi
call fcn.00417d60
push eax
lea edx, [esp + 0x168]
push edx
lea ecx, [esp + 0x294]
call fcn.0041df20
mov bl, 3
lea ecx, [esp + 0x27c]
mov byte [esp + 0x72c], bl
call fcn.0041e510
test al, al
jne 0x416b58
mov byte [esp + 0x28], al
mov dword [esp + 0x24], ebp
push ebp
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x284]
mov byte [esp + 0x734], 4
call fcn.0041f2b0
test al, al
jne 0x416b3c
lea ecx, [esp + 0x24]
call fcn.00416480
lea ecx, [esp + 0x24]
call fcn.004163d0
jmp 0x416cdd
lea eax, [esp + 0x27c]
call fcn.00420950
lea ecx, [esp + 0x24]
mov byte [esp + 0x72c], bl
call fcn.004163d0
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x20]
push ebp
push ebp
push ebp
push str..log
push edx
lea eax, [esp + 0x290]
mov byte [ecx + 4], 0
push eax
lea ecx, [esp + 0x60c]
call fcn.0041df20
push ebp
push 0x80
push 4
push ebp
push ebp
push 4
lea ecx, [esp + 0x60c]
call fcn.00417d60
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x416cb1
push 0x10000000
push 1
push ebp
call fcn.00424180
push 1
push ebp
call fcn.004241d0
add esp, 0x14
push 2
push 0
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x416cb1
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x416c11
push 0
lea ecx, [esp + 0x1c]
push ecx
push 2
lea edx, [esp + 0x28]
push edx
push ebp
mov byte [esp + 0x30], 0xff
mov byte [esp + 0x31], 0xfe
mov dword [esp + 0x2c], 0
call ebx
cmp dword [esp + 0x18], 2
jne 0x416cb1
lea ecx, [esp + 0x4cc]
call fcn.004174b0
mov eax, dword [esp + 0x20]
push eax
lea edi, [esp + 0x4d0]
call fcn.00416700
lea ecx, [esp + 0x2c]
call fcn.004174b0
push 0x5496dc
push 0
call fcn.004ee71e
add esp, 4
push edx
push eax
lea esi, [esp + 0x38]
call fcn.004181b0
push 0x54964c
mov ecx, edi
call fcn.00417d60
push eax
push 0x5496d8
mov ecx, esi
call fcn.00417d40
mov ecx, eax
call fcn.00417d40
mov ecx, eax
call fcn.00417d40
mov esi, dword [esp + 0x30]
push 0
lea ecx, [esp + 0x1c]
push ecx
add esi, esi
push esi
lea ecx, [esp + 0x38]
mov dword [esp + 0x24], 0
call fcn.00417d60
push eax
push ebp
call ebx
lea ecx, [esp + 0x2c]
cmp dword [esp + 0x18], esi
je 0x416cb9
call fcn.00417650
mov ecx, edi
call fcn.00417650
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x416cd1
call fcn.00417650
lea ecx, [esp + 0x4cc]
call fcn.00417650
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x5f4]
call fcn.00417650
lea ecx, [esp + 0x27c]
call fcn.00417650
lea ecx, [esp + 0x3a4]
call fcn.00417650
lea ecx, [esp + 0x154]
call fcn.00417650
mov ecx, dword [esp + 0x724]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x708]
xor ecx, esp
call fcn.004ecddb
add esp, 0x71c
ret 4