Function at 0x41ecc3
Capabilities:
Write file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov dword [esp], 0x7b829d7e
xor ebx, ebx
mov ebp, 0x7fffffc0
mov eax, dword [esp]
cmp eax, 0xf0558410
jle 0x41ed56
cmp eax, 0x41e179c2
jg 0x41ee01
cmp eax, 0x11f24230
jle 0x41ef18
cmp eax, 0x1f64fb15
jle 0x41ef88
cmp eax, 0x1f64fb16
je 0x41f339
cmp eax, 0x3361bb01
je 0x41f441
cmp eax, 0x375c1a1a
jne 0x41ecd8
mov eax, dword [esp + 8]
shr eax, 4
add eax, 0x32
mov ecx, eax
shl ecx, 5
imul eax, eax
imul edx, eax, 0x1caf
dec edx
add ecx, 0xffffff24
mov dword [esp + 8], ecx
mov ecx, 0xbde0d5d0
cmp edx, eax
je 0x41ed51
mov ecx, 0x83fc6d78
mov dword [esp], ecx
jmp 0x41ecd8
cmp eax, 0xc3c216cd
jg 0x41edba
cmp eax, 0x8eaab81c
jg 0x41ee75
cmp eax, 0x8410c220
jle 0x41efaa
cmp eax, 0x8410c221
je 0x41f15d
cmp eax, 0x84554dd1
je 0x41f24c
cmp eax, 0x8c9a7c36
jne 0x41ecd8
cmp dword [esp + 0x20], 0
mov eax, 0xa87d953
jg 0x41eda5
mov eax, 0xd914716f
cmp byte [esp + 0xf], 0
jne 0x41f4e2
mov eax, 0xd914716f
jmp 0x41f4e2
cmp eax, 0xe2e8a62f
jg 0x41eeb5
cmp eax, 0xd914716e
jle 0x41efd8
cmp eax, 0xd914716f
je 0x41f186
cmp eax, 0xd9df720d
je 0x41f281
cmp eax, 0xdea971bc
jne 0x41ecd8
imul eax, dword [esp + 4], 0xbe000
add eax, 0xffffffa3
jmp 0x41f205
cmp eax, 0x719fe0fe
jg 0x41ef50
cmp eax, 0x524f7fc5
jle 0x41f0c4
cmp eax, 0x524f7fc6
je 0x41f368
cmp eax, 0x630b484b
je 0x41f499
cmp eax, 0x6d1dd2ca
jne 0x41ecd8
mov eax, dword [esp + 8]
shr eax, 6
imul ecx, eax, 0xeb
imul ecx, ecx
imul edx, ecx, 0x62e3
dec edx
imul eax, eax, 0x75800000
or eax, 0x220
mov dword [esp + 8], eax
mov eax, 0x7f31619f
cmp ecx, edx
je 0x41f4e2
mov eax, 0x164f71a1
jmp 0x41f4e2
cmp eax, 0xba19f149
jle 0x41f002
cmp eax, 0xba19f14a
je 0x41f1bf
cmp eax, 0xbde0d5d0
je 0x41f2d4
cmp eax, 0xc02aa3de
jne 0x41ecd8
mov dword [esp + 0x24], 0
mov dword [esp], 0x84554dd1
jmp 0x41ecd8
cmp eax, 0xe5444043
jle 0x41f06a
cmp eax, 0xe5444044
je 0x41f1f9
cmp eax, 0xe57461c3
je 0x41f301
cmp eax, 0xede0b7b1
jne 0x41ecd8
mov ecx, dword [esp + 8]
shr ecx, 8
imul eax, ecx, 0x2c5c
imul ecx, ecx
imul edx, ecx, 0x7455
dec edx
add eax, 0xffff7a3e
mov dword [esp + 8], eax
mov eax, 0xc790f37e
cmp ecx, edx
je 0x41f4e2
mov eax, 0x11f24231
jmp 0x41f4e2
cmp eax, 0x6c7ffcb
jle 0x41f0a2
cmp eax, 0x6c7ffcc
je 0x41f215
cmp eax, 0x6f32ba4
je 0x41f41b
cmp eax, 0xa87d953
jne 0x41ecd8
mov dword [esp], 0xc02aa3de
jmp 0x41ecd8
cmp eax, 0x7a18dbdc
jle 0x41f0fa
cmp eax, 0x7a18dbdd
je 0x41f382
cmp eax, 0x7f31619f
je 0x41f4c4
cmp eax, 0x7b829d7e
jne 0x41ecd8
mov dword [esp], 0xe2e8a630
jmp 0x41ecd8
cmp eax, 0x164f71a1
je 0x41f435
cmp eax, 0x1b9c2852
jne 0x41f511
mov dword [esp], 0x1f64fb16
jmp 0x41ecd8
cmp eax, 0x826ee42d
je 0x41f396
cmp eax, 0x83fc6d78
jne 0x41ecd8
push dword [esp + 0x10]
call fcn.0044f149
add esp, 4
mov dword [esp], 0x719fe0ff
jmp 0x41ecd8
cmp eax, 0xc3c216ce
je 0x41f3c0
cmp eax, 0xc790f37e
jne 0x41f51e
mov eax, dword [esp + 0x18]
mov dword [esp + 0x20], eax
mov dword [esp], 0x6d1dd2ca
jmp 0x41ecd8
cmp eax, 0x8eaab81d
je 0x41f3d6
cmp eax, 0xa0519cc0
jne 0x41ecd8
mov eax, dword [esp + 4]
shr eax, 2
and eax, 0x1ffff
imul esi, eax, 0x4ec168
mov dword [esp + 4], esi
push 0x47c
push 0x270a
push 0x49f8
push 0x296e
push 0x221b
push esi
push 0x461f
call fcn.00416ec2
add esp, 0x1c
push esi
call fcn.00417151
add esp, 4
mov dword [esp], 0x8410c221
jmp 0x41ecd8
cmp eax, 0xe2e8a630
je 0x41f40f
cmp eax, 0xe38d4443
jne 0x41ecd8
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x20]
push eax
push dword [esp + 0x44]
call fcn.0041d01b
add esp, 0xc
mov dword [esp], 0x630b484b
jmp 0x41ecd8
cmp eax, 0xf0558411
je 0x41f472
cmp eax, 0xf884d28d
jne 0x41ecd8
mov dword [esp], 0x6f32ba4
jmp 0x41ecd8
cmp eax, 0x41e179c3
je 0x41f4ea
cmp eax, 0x444b1400
jne 0x41ecd8
mov eax, dword [esp + 0x14]
cmp eax, 0xffffffff
setne byte [esp + 0xd]
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x10], eax
mov dword [esp], 0x8eaab81d
jmp 0x41ecd8
cmp eax, 0x719fe0ff
je 0x41f4f6
cmp eax, 0x79322a22
jne 0x41ecd8
mov eax, dword [esp + 4]
lea esi, [eax*4 - 0x163de0]
and esi, 0xffffe000
add esi, 0xffffff47
mov dword [esp + 4], esi
push esi
push 0x2930
push 0xd59
call fcn.00417399
add esp, 0xc
push esi
push 0x299b
push 0x5a12
call fcn.00417399
add esp, 0xc
mov dword [esp], 0x826ee42d
jmp 0x41ecd8
push ebx
push 0x80
push 2
push ebx
push ebx
push 0x40000000
push dword [esp + 0x58]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esp + 0x14], eax
mov dword [esp], 0xe57461c3
jmp 0x41ecd8
mov eax, dword [esp + 8]
add eax, 0x61
shr eax, 0xb
mov ecx, eax
imul ecx, eax
imul edx, ecx, 0x3c8b
dec edx
shl eax, 0xf
add eax, 0xff9e0000
mov dword [esp + 8], eax
mov eax, 0xba19f14a
cmp ecx, edx
je 0x41f4e2
mov eax, 0xf884d28d
jmp 0x41f4e2
imul eax, dword [esp + 4], 0x64
add eax, 0xffffd82e
mov dword [esp + 4], eax
mov esi, 0x8c9a7c36
js 0x41f1d9
mov esi, 0x3361bb01
push eax
push 0x4ba2
push 0x4849
push 0x6bc
call fcn.004208f6
add esp, 0x10
mov dword [esp], esi
jmp 0x41ecd8
mov eax, dword [esp + 4]
shl eax, 9
add eax, 0xb7a
mov dword [esp + 4], eax
mov dword [esp], 0x444b1400
jmp 0x41ecd8
mov eax, dword [esp + 4]
shl eax, 5
add eax, 0xffffec00
shr eax, 0xb
add eax, 0xf7
mov dword [esp + 4], eax
push eax
push 0x193
push 0x2f4b
call fcn.004138cc
add esp, 0xc
mov dword [esp], 0xa0519cc0
jmp 0x41ecd8
imul eax, dword [esp + 8], 0xc4
shr eax, 2
mov ecx, eax
imul ecx, eax
imul edx, ecx, 0x5e61
add eax, 0x51
dec edx
mov dword [esp + 8], eax
mov eax, 0xf0558411
cmp edx, ecx
je 0x41f4e2
mov eax, 0x1b9c2852
jmp 0x41f4e2
imul edi, dword [esp + 4], 0xac000
mov esi, edi
shr esi, 2
mov dword [esp + 4], esi
push 0xd5f
push esi
push 0x209a
push 0x31d2
call fcn.0041cde6
add esp, 0x10
push 0x154c
push 0x4705
push esi
push 0xdd4
call fcn.00417156
add esp, 0x10
mov eax, 0xe38d4443
test edi, edi
jne 0x41f405
jmp 0x41f4e2
mov eax, dword [esp + 4]
shr eax, 0x1b
add eax, 0x7d
mov dword [esp + 4], eax
push 0x4cba
push eax
push 0x146
call fcn.0041b089
add esp, 0xc
mov dword [esp], 0xd9df720d
jmp 0x41ecd8
mov eax, dword [esp + 8]
imul ecx, eax, 0x95
imul ecx, ecx
imul eax, eax, 0x2540
imul edx, ecx, 0x6629
add eax, 0x46
dec edx
mov dword [esp + 8], eax
mov eax, 0xe38d4443
cmp edx, ecx
je 0x41f4e2
mov eax, 0x444b1400
jmp 0x41f4e2
push 0
lea eax, [esp + 0x28]
push eax
push dword [esp + 0x28]
push dword [esp + 0x1c]
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp], 0x375c1a1a
jmp 0x41ecd8
mov al, byte [esp + 0xd]
and al, byte [esp + 0xe]
and al, 1
mov byte [esp + 0xf], al
mov dword [esp], 0xc790f37e
jmp 0x41ecd8
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], ebx
mov dword [esp], 0x41e179c3
jmp 0x41ecd8
imul ecx, dword [esp + 4], 0x8c
add ecx, 0xffffff83
mov dword [esp + 4], ecx
mov eax, 0xc3c216ce
cmp ecx, 0xe4
jae 0x41f4e2
mov eax, 0xe38d4443
jmp 0x41f4e2
cmp dword [esp + 0x10], 0
setne byte [esp + 0xe]
mov dword [esp], 0x524f7fc6
jmp 0x41ecd8
mov eax, dword [esp + 8]
mov ecx, eax
shl ecx, 8
sub ecx, eax
shr ecx, 0x17
imul eax, ecx, 0x2b000000
imul ecx, ecx
imul edx, ecx, 0x55a5
dec edx
mov dword [esp + 8], eax
mov eax, 0x7a18dbdd
cmp edx, ecx
je 0x41f4e2
mov eax, 0xc3c216ce
jmp 0x41f4e2
mov dword [esp], 0x7a18dbdd
jmp 0x41ecd8
cmp dword [esp + 0x10], 0
mov eax, 0xede0b7b1
je 0x41f4e2
mov eax, 0x83fc6d78
jmp 0x41f4e2
mov dword [esp], 0x8c9a7c36
jmp 0x41ecd8
imul esi, dword [esp + 4], 0x7f00
add esi, 0xff200
mov dword [esp + 4], esi
push 0xee4
push 0x29f3
push esi
call fcn.00419255
add esp, 0xc
mov eax, 0xe5444044
cmp esi, 0x5e
jge 0x41f4dd
jmp 0x41f4e2
mov eax, dword [esp + 4]
shl eax, 2
and eax, 0x3fff8
imul eax, eax, 0x144000
add eax, 0xffe30000
mov dword [esp + 4], eax
mov dword [esp], 0xab04b21d
jmp 0x41ecd8
mov eax, dword [esp + 8]
imul ecx, eax, 0x67
imul ecx, ecx
imul eax, eax, 0xce000
imul edx, ecx, 0x2875
dec edx
mov dword [esp + 8], eax
mov eax, 0x7a18dbdd
cmp edx, ecx
je 0x41f4e2
mov eax, 0x8410c221
jmp 0x41f4e2
imul ecx, dword [esp + 4], 0x8a
add ecx, 0xffffffeb
mov dword [esp + 4], ecx
mov eax, 0x79322a22
cmp ecx, 0x1f
jge 0x41f4e2
mov eax, 0xc790f37e
mov dword [esp], eax
jmp 0x41ecd8
mov dword [esp], 0xe38d4443
jmp 0x41ecd8
mov eax, dword [esp + 8]
and eax, ebp
add eax, 0xffffdcc0
mov dword [esp + 8], eax
mov dword [esp], 0x11f24231
jmp 0x41ecd8
cmp eax, 0x11f24231
jne 0x41ecd8
jmp 0x41f54c
cmp eax, 0xc7e3c84f
jne 0x41ecd8
mov eax, dword [esp + 4]
add eax, 0x3a
shr eax, 7
lea ecx, [eax + eax*4]
lea eax, [eax + ecx*2]
shr eax, 8
imul eax, eax, 0xa3
mov dword [esp + 4], eax
push eax
call fcn.0041a15f
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret