Function at 0x41d500
Capabilities:
Write file on windows

Disassembly:
sub esp, 0xac4
mov eax, dword [0x488e40]
xor eax, esp
mov dword [esp + 0xabc], eax
mov eax, dword [esp + 0xac8]
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov ecx, dword [esp + 0xadc]
push ecx
push edx
mov dword [esp + 0x24], eax
call fcn.0041e380
mov ebp, eax
lea eax, [esp + 0x30]
mov esi, str.Status
mov ecx, eax
add esp, 8
mov dword [esp + 0x20], ebp
mov edx, 0xa9f
sub esi, ecx
mov edi, edi
mov cl, byte [esi + eax]
test cl, cl
je 0x41d563
mov byte [eax], cl
sub edx, 1
add eax, 1
test edx, edx
jg 0x41d550
mov byte [eax], 0
lea eax, [esp + 0x28]
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x41d570
sub eax, edx
lea ecx, [esp + eax + 0x28]
mov ebx, 0x48a634
lea edx, [esp + 0xac7]
cmp ecx, edx
jae 0x41d5e8
mov byte [ecx], 0x2c
mov edi, dword [ebx]
add ecx, 1
lea eax, [esp + 0xac8]
sub eax, ecx
test eax, eax
mov esi, ecx
jle 0x41d5c8
sub eax, 1
test eax, eax
jle 0x41d5c5
lea ecx, [ecx]
mov dl, byte [edi]
test dl, dl
je 0x41d5c5
mov byte [esi], dl
sub eax, 1
add esi, 1
add edi, 1
test eax, eax
jg 0x41d5b0
mov byte [esi], 0
mov eax, ecx
lea esi, [eax + 1]
lea ecx, [ecx]
mov dl, byte [eax]
add eax, 1
test dl, dl
jne 0x41d5d0
sub eax, esi
add ebx, 4
add ecx, eax
cmp ebx, 0x48a684
jl 0x41d584
lea eax, [esp + 0xac8]
sub eax, ecx
test eax, eax
jle 0x41d619
sub eax, 1
test eax, eax
jle 0x41d616
mov esi, 0x47656c
sub esi, ecx
mov dl, byte [esi + ecx]
test dl, dl
je 0x41d616
mov byte [ecx], dl
sub eax, 1
add ecx, 1
test eax, eax
jg 0x41d603
mov byte [ecx], 0
lea eax, [esp + 0x28]
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x41d620
sub eax, edx
mov esi, eax
cmp esi, 0xffffffff
jne 0x41d64d
lea eax, [esp + 0x28]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x41d640
sub eax, edx
mov esi, eax
mov edx, dword [esp + 0x1c]
push 0
lea eax, [esp + 0x1c]
push eax
push esi
lea ecx, [esp + 0x34]
push ecx
push edx
mov dword [esp + 0x2c], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x41d67f
cmp dword [esp + 0x18], esi
je 0x41d693
push 0x1d
call dword [sym.imp.KERNEL32.dll_SetLastError]
test ebp, ebp
je 0x41d68c
push ebp
call fcn.00454dd4
add esp, 4
xor al, al
jmp 0x41dcea
cmp dword [ebp], 0
mov dword [esp + 0x18], ebp
je 0x41dcdb
mov eax, dword [esp + 0x18]
mov ebp, dword [eax]
mov ecx, dword [ebp + 0x20]
mov ecx, dword [ecx + 8]
or ecx, dword [ebp + 0x10]
lea edi, [esp + 0x28]
mov dword [esp + 0x24], ecx
mov dword [esp + 0x14], 0
jmp 0x41d6c6
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x14]
cmp eax, 0x14
ja case.default.0x41d6d3
jmp dword [eax*4 + 0x41dd1c]
test cl, 1
jne 0x41d70a
test cl, 0x40
je 0x41d6f4
lea edx, [esp + 0xac7]
cmp edi, edx
jae 0x41d70a
mov byte [edi], 0x2a
jmp 0x41d707
test cl, 0x10
je 0x41d70a
lea eax, [esp + 0xac7]
cmp edi, eax
jae 0x41d70a
mov byte [edi], 0x44
add edi, 1
test ecx, 0x80000
je 0x41d722
lea edx, [esp + 0xac7]
cmp edi, edx
jae 0x41d753
mov byte [edi], 0x3f
jmp 0x41d750
test ecx, 0x10000
je 0x41d73a
lea eax, [esp + 0xac7]
cmp edi, eax
jae 0x41d753
mov byte [edi], 0x21
jmp 0x41d750
test ecx, 0x100
je 0x41d753
lea edx, [esp + 0xac7]
cmp edi, edx
jae 0x41d753
mov byte [edi], 0x45
add edi, 1
test ecx, 0x2000
je 0x41d76c
lea eax, [esp + 0xac7]
cmp edi, eax
jae 0x41d76c
mov byte [edi], 0x36
add edi, 1
lea ecx, [esp + 0xac7]
cmp edi, ecx
jmp 0x41db5d
lea edx, [esp + 0xac7]
cmp edi, edx
jae 0x41d78b
mov byte [edi], 0x22
add edi, 1
mov eax, dword [esp + 0xadc]
push 1
lea ebx, [esp + 0xacc]
push eax
sub ebx, edi
mov eax, ebp
mov edx, ebx
call fcn.00425dc0
test edx, edx
mov esi, eax
mov ecx, edi
jle 0x41d7d4
sub edx, 1
test edx, edx
jle 0x41d7d1
mov al, byte [esi]
test al, al
je 0x41d7d1
cmp al, 0x20
jge 0x41d7c2
mov al, 4
mov byte [ecx], al
sub edx, 1
add ecx, 1
add esi, 1
test edx, edx
jg 0x41d7b6
mov byte [ecx], 0
mov eax, ebx
test eax, eax
mov esi, 0x474d00
mov ecx, edi
jle 0x41db62
sub eax, 1
test eax, eax
jle 0x41d825
lea esp, [esp]
cmp byte [ecx], 0
je 0x41d807
sub eax, 1
add ecx, 1
test eax, eax
jg 0x41d7f0
mov byte [ecx], 0
jmp 0x41db62
test eax, eax
jle 0x41d825
jmp 0x41d810
mov dl, byte [esi]
test dl, dl
je 0x41d825
mov byte [ecx], dl
sub eax, 1
add ecx, 1
add esi, 1
test eax, eax
jg 0x41d810
mov byte [ecx], 0
jmp 0x41db62
test ecx, 0x10000
jne 0x41dba3
push 4
push 1
lea ecx, [esp + 0xad0]
sub ecx, edi
mov ebx, edi
mov eax, ebp
call fcn.00425e00
jmp 0x41db62
push 4
push 0
jmp 0x41d83d
mov ecx, dword [ebp + 0x20]
mov edx, dword [ecx + 0x24]
push edx
push 0x4790d8
lea esi, [esp + 0xad0]
sub esi, edi
call fcn.00416ab0
add esp, 8
jmp 0x41db62
lea eax, [esp + 0xac8]
sub eax, edi
push eax
mov ecx, edi
mov eax, ebp
call fcn.00425fd0
jmp 0x41db62
mov ecx, dword [ebp + 0x20]
mov edx, dword [ecx + 0x34]
push edx
push str.0x_08X
jmp 0x41d866
mov eax, dword [ebp + 0x20]
mov ecx, dword [eax + 0x38]
push ecx
push str.0x_08X
jmp 0x41d866
lea ecx, [esp + 0xac8]
sub ecx, edi
mov eax, edi
mov edx, ebp
call fcn.004260a0
jmp 0x41db62
lea ecx, [esp + 0xac8]
sub ecx, edi
mov edx, edi
mov eax, ebp
call fcn.004263b0
jmp 0x41db62
lea edx, [esp + 0xac7]
cmp edi, edx
jae 0x41d8ef
mov byte [edi], 0x22
add edi, 1
lea ebx, [esp + 0xac8]
sub ebx, edi
push ebp
mov eax, ebx
mov esi, edi
call fcn.004264d0
mov eax, ebx
test eax, eax
mov esi, 0x474d00
mov ecx, edi
jle 0x41db62
sub eax, 1
test eax, eax
jle 0x41d955
lea ebx, [ebx]
cmp byte [ecx], 0
je 0x41d937
sub eax, 1
add ecx, 1
test eax, eax
jg 0x41d920
mov byte [ecx], 0
jmp 0x41db62
test eax, eax
jle 0x41d955
jmp 0x41d940
mov dl, byte [esi]
test dl, dl
je 0x41d955
mov byte [ecx], dl
sub eax, 1
add ecx, 1
add esi, 1
test eax, eax
jg 0x41d940
mov byte [ecx], 0
jmp 0x41db62
mov eax, dword [ebp + 0x20]
mov ecx, dword [eax + 0x40]
mov edx, dword [eax + 0x44]
mov ebx, ecx
lea esi, [esp + 0xac8]
and ebx, edx
sub esi, edi
cmp ebx, 0xffffffff
jne 0x41d9ab
test esi, esi
mov eax, edi
jle 0x41db62
add esi, ebx
test esi, esi
jle 0x41d9a3
mov edx, str.Unknown
sub edx, edi
nop
mov cl, byte [edx + eax]
test cl, cl
je 0x41d9a3
mov byte [eax], cl
sub esi, 1
add eax, 1
test esi, esi
jg 0x41d990
mov byte [eax], 0
jmp 0x41db62
test dword [eax + 8], 0x2000
push edx
push ecx
je 0x41d9c8
push str.0x_016I64X
call fcn.00416ab0
add esp, 0xc
jmp 0x41db62
push str.0x_08I64X
call fcn.00416ab0
add esp, 0xc
jmp 0x41db62
mov eax, dword [ebp + 0x20]
mov ecx, dword [eax + 0x48]
mov edx, dword [eax + 0x4c]
mov eax, dword [eax + 8]
lea esi, [esp + 0xac8]
sub esi, edi
test eax, 0x800
je 0x41da10
and ecx, edx
cmp ecx, 0xffffffff
je 0x41da19
mov ecx, esi
mov eax, str.Data_file
mov edx, edi
call fcn.00416b40
jmp 0x41db62
mov ebx, ecx
and ebx, edx
cmp ebx, 0xffffffff
jne 0x41da4c
test esi, esi
mov eax, edi
jle 0x41db62
add esi, 0xffffffff
test esi, esi
jle 0x41da44
mov edx, str.Unknown
sub edx, edi
mov cl, byte [edx + eax]
test cl, cl
je 0x41da44
mov byte [eax], cl
sub esi, 1
add eax, 1
test esi, esi
jg 0x41da31
mov byte [eax], 0
jmp 0x41db62
test eax, 0x2000
push edx
push ecx
je 0x41d9c8
push str.0x_016I64X
call fcn.00416ab0
add esp, 0xc
jmp 0x41db62
mov eax, dword [ebp + 0x20]
mov ecx, dword [eax + 0x50]
push ecx
push str.0x_08X
jmp 0x41d866
mov eax, dword [ebp + 0x20]
mov ecx, dword [eax + 0x10]
lea edx, [esp + 0xac8]
sub edx, edi
test ecx, ecx
mov eax, edi
je 0x41da9f
push edx
call fcn.00416730
add esp, 4
jmp 0x41db62
test edx, edx
jle 0x41db62
add edx, 0xffffffff
test edx, edx
jle 0x41dac8
mov esi, str.Not_Loaded
sub esi, edi
mov cl, byte [esi + eax]
test cl, cl
je 0x41dac8
mov byte [eax], cl
sub edx, 1
add eax, 1
test edx, edx
jg 0x41dab5
mov byte [eax], 0
jmp 0x41db62
mov ecx, dword [ebp + 0x20]
mov eax, dword [ecx + 0x68]
mov ecx, dword [ecx + 0x64]
lea edx, [esp + 0xac8]
sub edx, edi
push edx
push edi
mov edx, ebp
call fcn.00426690
jmp 0x41db62
mov ecx, dword [ebp + 0x20]
lea eax, [esp + 0xac8]
sub eax, edi
push eax
mov eax, dword [ecx + 0x70]
mov ecx, dword [ecx + 0x6c]
push edi
mov edx, ebp
call fcn.00426690
jmp 0x41db62
mov ecx, dword [ebp + 0x20]
mov eax, dword [ecx + 0x54]
movzx edx, ax
push edx
shr eax, 0x10
push eax
lea esi, [esp + 0xad0]
push str._u._u
sub esi, edi
call fcn.00416ab0
add esp, 0xc
jmp 0x41db62
mov eax, dword [ebp + 0x20]
mov eax, dword [eax + 0x58]
movzx ecx, ax
push ecx
jmp 0x41db14
mov edx, dword [ebp + 0x20]
mov eax, dword [edx + 0x5c]
movzx ecx, ax
push ecx
jmp 0x41db14
mov edx, dword [ebp + 0x20]
mov eax, dword [edx + 0x60]
movzx ecx, ax
push ecx
jmp 0x41db14
lea edx, [esp + 0xac7]
cmp edi, edx
ja 0x41db62
mov byte [edi], 0
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x41db67
sub eax, edx
add edi, eax
mov eax, dword [esp + 0x14]
cmp eax, 0x14
jge 0x41db8e
lea ecx, [esp + 0xac7]
cmp edi, ecx
jae 0x41db8e
mov byte [edi], 0x2c
add edi, 1
add eax, 1
cmp eax, 0x15
mov dword [esp + 0x14], eax
jl 0x41d6c2
jmp 0x41dc3a
lea edx, [esp + 0xac7]
cmp edi, edx
jae 0x41dbb4
mov byte [edi], 0x22
add edi, 1
mov ecx, dword [ebp + 0x20]
mov esi, dword [ecx + 0x80]
lea eax, [esp + 0xac8]
sub eax, edi
test eax, eax
mov ecx, edi
jle 0x41dbeb
sub eax, 1
test eax, eax
jle 0x41dbe8
mov dl, byte [esi]
test dl, dl
je 0x41dbe8
mov byte [ecx], dl
sub eax, 1
add ecx, 1
add esi, 1
test eax, eax
jg 0x41dbd3
mov byte [ecx], 0
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x41dbf0
sub eax, edx
add edi, eax
lea edx, [esp + 0xac7]
cmp edi, edx
jae 0x41dc0e
mov byte [edi], 0x22
add edi, 1
mov eax, 3
lea ecx, [esp + 0xac7]
cmp edi, ecx
jae 0x41dc2c
mov byte [edi], 0x2c
add eax, 1
add edi, 1
cmp eax, 0x15
jl 0x41dc13
lea edx, [esp + 0xac7]
cmp edi, edx
ja 0x41dc3a
mov byte [edi], 0
lea eax, [esp + 0xac8]
sub eax, edi
test eax, eax
jle 0x41dc6b
sub eax, 1
test eax, eax
jle 0x41dc68
mov edx, 0x47656c
sub edx, edi
mov cl, byte [edx + edi]
test cl, cl
je 0x41dc68
mov byte [edi], cl
sub eax, 1
add edi, 1
test eax, eax
jg 0x41dc55
mov byte [edi], 0
lea eax, [esp + 0x28]
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x41dc72
sub eax, edx
mov esi, eax
cmp esi, 0xffffffff
jne 0x41dc9d
lea eax, [esp + 0x28]
lea edx, [eax + 1]
jmp 0x41dc90
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x41dc90
sub eax, edx
mov esi, eax
mov edx, dword [esp + 0x1c]
push 0
lea eax, [esp + 0x18]
push eax
push esi
lea ecx, [esp + 0x34]
push ecx
push edx
mov dword [esp + 0x28], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x41dd0b
cmp dword [esp + 0x14], esi
jne 0x41dd03
mov eax, dword [esp + 0x18]
add eax, 4
cmp dword [eax], 0
mov dword [esp + 0x18], eax
jne 0x41d6a1
mov ecx, dword [esp + 0x20]
push ecx
call fcn.00454dd4
add esp, 4
mov al, 1
mov ecx, dword [esp + 0xacc]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00454016
add esp, 0xac4
ret
push 0x1d
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [esp + 0x20]
push eax
call fcn.00454dd4
add esp, 4
xor al, al
jmp 0x41dcea