Function at 0x40c5b1
Capabilities:
Write file on windows

Disassembly:
push 0xec
mov eax, 0x4497d4
call fcn.0041902e
mov dword [ebp - 0xc8], ecx
mov eax, dword [ebp + 0xc]
xor ebx, ebx
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0xc4], eax
mov dword [ebp - 0xb4], ecx
cmp dword [eax + 0x10], ebx
jne 0x40c5e9
mov eax, 0xa0
jmp 0x40ca92
call fcn.00411b9b
push 0x24
call fcn.0041877c
mov edi, eax
mov dword [edi + 0x1c], ebx
mov dword [ebp - 0x98], edi
mov ecx, dword [ebp + 8]
mov eax, 0x100000
mov dword [ebp - 4], ebx
mov dword [edi + 0x10], ecx
mov dword [edi], 0x411ca0
mov dword [edi + 4], 0x411d00
mov dword [edi + 8], 0x411d10
mov dword [edi + 0xc], 0x411d60
mov dword [edi + 0x18], ebx
push eax
mov dword [edi + 0x14], ebx
push 0x463a50
mov dword [edi + 0x20], eax
call dword [0x463a50]
add esp, 0xc
mov dword [edi + 0x1c], eax
test eax, eax
jne 0x40c650
push 0xe
pop ebx
jmp 0x40ca86
push 0x80
call fcn.0041877c
push 0x80
mov esi, eax
push ebx
push esi
mov dword [ebp - 0xa0], esi
call fcn.00430b10
mov edx, 0x463a50
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x4c], edx
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.0040f6c9
push edx
push edx
mov edx, edi
call fcn.004114ec
mov ebx, eax
add esp, 0x18
test ebx, ebx
je 0x40c6a7
mov edx, 0x463a50
mov ecx, esi
call fcn.0040f704
jmp 0x40cb2c
or dword [ebp - 0xc0], 0xffffffff
xor ecx, ecx
mov eax, ecx
mov dword [ebp - 0xb0], ecx
mov ebx, ecx
mov dword [ebp - 0xbc], ecx
mov dword [ebp - 0xa4], eax
cmp dword [esi + 0x40], ecx
jbe 0x40ca58
mov ecx, eax
mov edx, 0x80
and ecx, 7
sar edx, cl
mov ecx, eax
mov eax, dword [esi + 0x48]
shr ecx, 3
test byte [ecx + eax], dl
jne 0x40ca42
push dword [ebp - 0xa4]
mov edx, esi
lea ecx, [ebp - 0x84]
call fcn.0040c1fe
pop ecx
mov eax, dword [ebp - 0xb4]
mov byte [ebp - 4], 2
mov eax, dword [eax + 0x24]
test eax, eax
je 0x40c75f
mov esi, dword [esi + 0x44]
mov ecx, dword [ebp - 0xa4]
mov edx, dword [esi + ecx*8 + 8]
sub edx, dword [esi + ecx*8]
mov eax, dword [esi + ecx*8 + 0xc]
sbb eax, dword [esi + ecx*8 + 4]
mov dword [ebp - 0x88], eax
mov eax, dword [ebp - 0xb4]
mov dword [ebp - 0x8c], edx
lea edx, [ebp - 0x8c]
push edx
lea edx, [ebp - 0x84]
mov ecx, dword [eax + 0x24]
push edx
mov eax, dword [ecx]
call dword [eax + 8]
test al, al
je 0x40ca2d
mov esi, dword [ebp - 0xa0]
xor eax, eax
mov edx, edi
mov dword [ebp - 0xb8], eax
mov ecx, esi
mov dword [ebp - 0xac], eax
mov eax, 0x463a50
push eax
push eax
lea eax, [ebp - 0xac]
push eax
lea eax, [ebp - 0xb8]
push eax
lea eax, [ebp - 0xbc]
push eax
lea eax, [ebp - 0xb0]
push eax
lea eax, [ebp - 0xc0]
push eax
push dword [ebp - 0xa4]
call fcn.0041184d
mov ebx, eax
add esp, 0x20
test ebx, ebx
jne 0x40cb21
lea eax, [ebp - 0x84]
push eax
lea ecx, [ebp - 0xf8]
call fcn.004048ac
mov dword [ebp - 0xa8], ebx
push dword [ebp - 0xc4]
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x64]
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x50], ebx
call fcn.00404916
lea eax, [ebp - 0xf8]
mov byte [ebp - 4], 5
push eax
lea ecx, [ebp - 0x64]
call fcn.00404499
push eax
lea ecx, [ebp - 0xe0]
mov dword [ebp - 0xd0], ebx
mov dword [ebp - 0xcc], ebx
call fcn.00404916
lea ecx, [ebp - 0x64]
call fcn.00404c58
cmp dword [ebp - 0xcc], 8
lea ebx, [ebp - 0xe0]
jb 0x40c82b
mov ebx, dword [ebp - 0xe0]
lea eax, [ebp - 0xa8]
push eax
lea ecx, [ebp - 0x40]
call fcn.0040f2b0
mov byte [ebp - 4], 7
xor ecx, ecx
mov eax, dword [ebp - 0x40]
mov word [eax], cx
test ebx, ebx
je 0x40c86c
xor edx, edx
mov ecx, ebx
mov eax, edx
cmp word [ebx], dx
je 0x40c86c
lea ecx, [ecx + 2]
inc eax
cmp word [ecx], dx
jne 0x40c855
test eax, eax
je 0x40c86c
push eax
push ebx
lea ecx, [ebp - 0x40]
call fcn.0040f52c
lea ecx, [ebp - 0xe0]
call fcn.00404c58
lea ecx, [ebp - 0xf8]
call fcn.00404c58
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x3c]
lea eax, [ecx + eax*2]
mov edx, eax
mov dword [ebp - 0xa8], eax
call fcn.0040cf63
mov edx, eax
mov eax, dword [ebp - 0x40]
mov ecx, edx
mov dword [ebp - 0x20], eax
sub ecx, eax
mov dword [ebp - 0x1c], edx
sar ecx, 1
cmp ecx, 1
jbe 0x40c8c9
lea ebx, [edx - 2]
mov cx, word [ebx]
call fcn.0040ed73
test al, al
je 0x40c8c9
push 0x3a
pop eax
cmp ax, word [edx - 4]
je 0x40c8c9
mov dword [ebp - 0x1c], ebx
mov ebx, dword [ebp - 0xa8]
mov edx, ebx
mov ecx, dword [ebp - 0x40]
call fcn.0040cf63
and dword [ebp - 0xa8], 0
lea ecx, [ebp - 0x6c]
mov dword [ebp - 0x94], eax
lea eax, [ebp - 0xa8]
push eax
mov dword [ebp - 0x90], ebx
call fcn.0040f2b0
mov eax, dword [ebp - 0x6c]
xor ecx, ecx
mov word [eax], cx
lea edx, [ebp - 0x6c]
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x20]
call fcn.0040ce9d
mov ebx, eax
lea ecx, [ebp - 0x6c]
test ebx, ebx
js 0x40c925
call fcn.0040f010
mov ebx, eax
lea ecx, [ebp - 0x6c]
push 0
mov byte [ebp - 4], 0xb
call fcn.0040f433
mov ecx, dword [ebp - 0x60]
test ecx, ecx
je 0x40c93e
mov eax, dword [ecx]
push ecx
call dword [eax + 4]
pop ecx
test ebx, ebx
jne 0x40caeb
or dword [ebp - 0x9c], 0xffffffff
lea edx, [ebp - 0x94]
lea ecx, [ebp - 0xe0]
call fcn.0040cc5f
mov esi, eax
lea edx, [ebp - 0x20]
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x64]
call fcn.0040cc5f
lea ecx, [ebp - 0x9c]
mov byte [ebp - 4], 0xe
push ecx
push ecx
mov edx, esi
mov ecx, eax
call fcn.00411d85
pop ecx
pop ecx
lea ecx, [ebp - 0x64]
mov ebx, eax
call fcn.00404c58
lea ecx, [ebp - 0xe0]
mov byte [ebp - 4], 0xb
call fcn.00404c58
test ebx, ebx
jne 0x40cae7
lea eax, [ebp - 0x9c]
xor esi, esi
push eax
push dword [ebp - 0xc8]
mov dword [ebp - 0x18], esi
push ecx
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x14], esi
call fcn.0040cd30
cmp dword [ebp - 0xac], esi
jne 0x40c9d3
mov byte [ebp - 4], 0xf
jmp 0x40ca06
push esi
lea eax, [ebp - 0x44]
mov dword [ebp - 0x44], esi
push eax
push dword [ebp - 0xac]
mov eax, dword [ebp - 0xb8]
add eax, dword [ebp - 0xb0]
push eax
push dword [ebp - 0x9c]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40ca9a
mov byte [ebp - 4], 0x11
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x40ca12
call fcn.00404312
push esi
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 2
call fcn.0040f433
mov ecx, dword [ebp - 0x34]
test ecx, ecx
je 0x40ca2d
mov eax, dword [ecx]
push ecx
call dword [eax + 4]
pop ecx
lea ecx, [ebp - 0x84]
mov byte [ebp - 4], 1
call fcn.00404c58
mov esi, dword [ebp - 0xa0]
mov eax, dword [ebp - 0xa4]
inc eax
mov dword [ebp - 0xa4], eax
cmp eax, dword [esi + 0x40]
jb 0x40c6cf
push dword [ebp - 0xb0]
push 0x463a50
call dword [0x463a54]
push dword [edi + 0x1c]
push 0x463a50
call dword [0x463a54]
add esp, 0x10
mov edx, 0x463a50
mov ecx, esi
call fcn.0040f704
push 0x24
push edi
call fcn.004187ac
pop ecx
pop ecx
mov eax, ebx
call fcn.00418fd8
ret 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov byte [ebp - 4], 0x10
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x40cab2
call fcn.00404312
push esi
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 2
call fcn.0040f433
mov ecx, dword [ebp - 0x34]
test ecx, ecx
je 0x40cacd
mov eax, dword [ecx]
push ecx
call dword [eax + 4]
pop ecx
lea ecx, [ebp - 0x84]
mov byte [ebp - 4], 1
call fcn.00404c58
mov esi, dword [ebp - 0xa0]
jmp 0x40ca58
push 0
jmp 0x40cab3
push 0
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 2
or ebx, 0x20000000
call fcn.0040f433
mov ecx, dword [ebp - 0x34]
test ecx, ecx
je 0x40cb0d
mov eax, dword [ecx]
push ecx
call dword [eax + 4]
pop ecx
lea ecx, [ebp - 0x84]
mov byte [ebp - 4], 1
call fcn.00404c58
jmp 0x40ca58
lea ecx, [ebp - 0x84]
call fcn.00404c58
mov ecx, ebx
call fcn.0040c0e3
mov ebx, eax
jmp 0x40ca7a