Function at 0x417270
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [0x41ddbc]
mov dword [ebp - 0x20], eax
mov ax, word [0x41ddc0]
mov word [ebp - 0x22], ax
mov si, word [0x41ddd4]
mov eax, dword [ebp - 0xc]
mov ax, word [eax*2 + 0x41b47c]
mov word [ebp - 0x1a], ax
mov eax, dword [ebp + 8]
mov ax, word [eax*2 + 0x41b47c]
mov word [ebp - 0x1c], ax
mov eax, dword [0x41b59c]
cmp byte [eax], 0
jne 0x4175e8
lea ecx, [ebp - 0x22]
lea edx, [ebp - 0x20]
mov ax, word [ebp - 0xc]
call fcn.00416b14
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov dx, word [ebp - 0x20]
and dx, word [ebp - 0x1a]
movzx edx, dx
shl edx, 3
add eax, edx
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movsx ebx, byte [eax]
cmp bx, 0x10
jbe 0x417362
cmp bx, 0x10
jbe 0x417362
cmp bx, 0x63
jne 0x417317
mov dword [ebp - 0x10], 1
jmp 0x4175e8
lea ecx, [ebp - 0x22]
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 0x18]
movsx eax, byte [eax + 1]
call fcn.00416b58
sub bx, 0x10
lea ecx, [ebp - 0x22]
lea edx, [ebp - 0x20]
mov eax, ebx
call fcn.00416b14
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 4]
movzx edx, bx
movzx edx, word [edx*2 + 0x41b47c]
and edx, dword [ebp - 0x20]
shl edx, 3
add eax, edx
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movsx ebx, byte [eax]
cmp bx, 0x10
ja 0x417305
lea ecx, [ebp - 0x22]
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 0x18]
movsx eax, byte [eax + 1]
call fcn.00416b58
cmp bx, 0x10
jne 0x4173d8
movzx eax, si
mov edx, dword [0x41ddc8]
mov ecx, dword [ebp - 0x18]
mov cl, byte [ecx + 2]
mov byte [edx + eax], cl
inc esi
cmp si, 0x8000
jne 0x4172be
push 0
lea eax, [ebp - 0x28]
push eax
movzx eax, si
push eax
mov eax, dword [0x41ddc8]
push eax
mov eax, dword [0x41b704]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_WriteFile_1
movzx ebx, si
mov eax, ebx
call fcn.004196d4
mov ecx, dword [0x41b62c]
mov edx, ebx
mov eax, dword [0x41ddc8]
call fcn.0041982c
xor esi, esi
jmp 0x4172be
cmp bx, 0xf
je 0x4175ca
lea ecx, [ebp - 0x22]
lea edx, [ebp - 0x20]
mov eax, ebx
call fcn.00416b14
mov eax, dword [ebp - 0x18]
mov ax, word [eax + 2]
movzx edx, bx
mov dx, word [edx*2 + 0x41b47c]
and dx, word [ebp - 0x20]
add ax, dx
mov word [ebp - 0x12], ax
lea ecx, [ebp - 0x22]
lea edx, [ebp - 0x20]
mov eax, ebx
call fcn.00416b58
lea ecx, [ebp - 0x22]
lea edx, [ebp - 0x20]
mov ax, word [ebp + 8]
call fcn.00416b14
mov eax, dword [ebp - 8]
mov eax, dword [eax]
movzx edx, word [ebp - 0x1c]
and edx, dword [ebp - 0x20]
shl edx, 3
add eax, edx
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movsx ebx, byte [eax]
cmp bx, 0x10
jbe 0x4174a9
cmp bx, 0x63
jne 0x41745a
mov dword [ebp - 0x10], 1
jmp 0x4175e8
lea ecx, [ebp - 0x22]
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 0x18]
movsx eax, byte [eax + 1]
call fcn.00416b58
sub bx, 0x10
lea ecx, [ebp - 0x22]
lea edx, [ebp - 0x20]
mov eax, ebx
call fcn.00416b14
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 4]
movzx edx, bx
mov dx, word [edx*2 + 0x41b47c]
and dx, word [ebp - 0x20]
movzx edx, dx
shl edx, 3
add eax, edx
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movsx ebx, byte [eax]
cmp bx, 0x10
ja 0x417448
lea ecx, [ebp - 0x22]
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 0x18]
movsx eax, byte [eax + 1]
call fcn.00416b58
lea ecx, [ebp - 0x22]
lea edx, [ebp - 0x20]
mov eax, ebx
call fcn.00416b14
mov eax, dword [ebp - 0x18]
mov edi, esi
sub di, word [eax + 2]
movzx eax, bx
mov ax, word [eax*2 + 0x41b47c]
and ax, word [ebp - 0x20]
sub di, ax
lea ecx, [ebp - 0x22]
lea edx, [ebp - 0x20]
mov eax, ebx
call fcn.00416b58
and di, 0x7fff
cmp si, di
jae 0x417503
mov bx, 0x8000
sub bx, di
jmp 0x41750a
mov bx, 0x8000
sub bx, si
cmp bx, word [ebp - 0x12]
jbe 0x417514
mov bx, word [ebp - 0x12]
sub word [ebp - 0x12], bx
movzx edx, si
movzx eax, di
sub edx, eax
movzx ecx, bx
cmp edx, ecx
jl 0x41754e
movzx edx, si
mov ecx, dword [0x41ddc8]
lea edx, [ecx + edx]
push edx
mov edx, dword [0x41ddc8]
lea eax, [edx + eax]
movzx ecx, bx
pop edx
call fcn.00402b8c
add si, bx
add di, bx
jmp 0x41756e
movzx eax, di
mov edx, dword [0x41ddc8]
mov al, byte [edx + eax]
movzx edx, si
mov ecx, dword [0x41ddc8]
mov byte [ecx + edx], al
inc esi
inc edi
dec ebx
test bx, bx
ja 0x41754e
cmp si, 0x8000
jne 0x4175b0
push 0
lea eax, [ebp - 0x28]
push eax
movzx eax, si
push eax
mov eax, dword [0x41ddc8]
push eax
mov eax, dword [0x41b704]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_WriteFile_1
movzx ebx, si
mov eax, ebx
call fcn.004196d4
mov ecx, dword [0x41b62c]
mov edx, ebx
mov eax, dword [0x41ddc8]
call fcn.0041982c
xor esi, esi
mov eax, dword [0x41b59c]
cmp byte [eax], 0
jne 0x4175e8
cmp word [ebp - 0x12], 0
jne 0x4174f0
jmp 0x4172be
mov word [0x41ddd4], si
mov eax, dword [ebp - 0x20]
mov dword [0x41ddbc], eax
mov ax, word [ebp - 0x22]
mov word [0x41ddc0], ax
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4