Function at 0x41840b
Capabilities:
Write file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov dword [esp], 0x479c2f19
xor ebp, ebp
mov esi, dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, 0xb7
mov eax, dword [esp]
cmp eax, 0x114a1482
jg 0x418488
cmp eax, 0xc093ec8f
jle 0x4184d6
cmp eax, 0xea07774d
jle 0x418568
cmp eax, 0xfaab98b6
jg 0x4186cd
cmp eax, 0xea07774e
je 0x418877
cmp eax, 0xee1424a0
je 0x418891
cmp eax, 0xef7afdb0
jne 0x418426
cmp dword [esp + 0x10], 0
mov eax, 0x7329b515
je 0x418c61
mov eax, 0x2fe8a95f
jmp 0x418c61
cmp eax, 0x5d69b17b
jg 0x41852c
cmp eax, 0x2fe8a95e
jle 0x4185b3
cmp eax, 0x4a65686b
jg 0x418711
cmp eax, 0x2fe8a95f
je 0x4188bb
cmp eax, 0x4222e7df
je 0x4188d7
cmp eax, 0x479c2f19
jne 0x418426
mov dword [esp], 0x78dde1e2
jmp 0x418426
cmp eax, 0x9a4cbdfa
jle 0x41861a
cmp eax, 0xb17f3e1c
jg 0x418764
cmp eax, 0x9a4cbdfb
je 0x418909
cmp eax, 0xa7806c70
je 0x418915
cmp eax, 0xae855736
jne 0x418426
mov eax, dword [esp + 8]
shl eax, 5
and eax, 0xffffe000
or eax, 0x39
mov dword [esp + 8], eax
mov dword [esp], 0x5e2bb1ef
jmp 0x418426
cmp eax, 0x712f0c56
jle 0x418675
cmp eax, 0x7ba2756a
jg 0x4187a2
cmp eax, 0x712f0c57
je 0x418796
cmp eax, 0x7329b515
je 0x418921
cmp eax, 0x78dde1e2
je 0x4189fb
jmp 0x418426
cmp eax, 0xd85d6efa
jle 0x4187cf
cmp eax, 0xd85d6efb
je 0x41894f
cmp eax, 0xe89a26c3
je 0x41896e
cmp eax, 0xe8ee3a89
jne 0x418426
imul ecx, dword [esp + 4], 0x7780
mov dword [esp + 4], ecx
mov eax, 0x4a65686c
cmp ecx, 0x51
jge 0x418b95
jmp 0x418c61
cmp eax, 0x16d8e9a4
jle 0x4187f9
cmp eax, 0x16d8e9a5
je 0x41898c
cmp eax, 0x1c6fec69
je 0x4189d1
cmp eax, 0x1f92b7a1
jne 0x418426
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x20]
push eax
push dword [esp + 0x44]
call fcn.004171b9
add esp, 0xc
push ebp
push 0x80
push 2
push ebp
push ebp
push 0x40000000
push dword [esp + 0x58]
call esi
mov dword [esp + 0x14], eax
mov dword [esp], 0xea07774e
jmp 0x418426
cmp eax, 0x8b851a82
jle 0x418827
cmp eax, 0x8b851a83
je 0x4189e5
cmp eax, 0x910cf1ef
je 0x418a07
cmp eax, 0x946f13c8
jne 0x418426
push 0
lea eax, [esp + 0x28]
push eax
push dword [esp + 0x28]
push dword [esp + 0x1c]
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp], 0x68e30b68
jmp 0x418426
cmp eax, 0x5f31ae80
jle 0x418855
cmp eax, 0x5f31ae81
je 0x418a30
cmp eax, 0x68e30b68
je 0x4188cb
cmp eax, 0x7112eeb4
jne 0x418426
mov eax, dword [esp + 4]
add eax, 0xfffffff4
shr eax, 0xc
imul ecx, eax, 0xb3
mov dword [esp + 4], ecx
mov eax, 0x4a65686c
cmp ecx, 0x78
jae 0x418c61
mov eax, 0x8b851a83
jmp 0x418c61
cmp eax, 0xfaab98b7
je 0x418a59
cmp eax, 0xff54a669
je 0x418a65
cmp eax, 0xd1edb13
jne 0x418426
mov eax, dword [esp + 4]
shl eax, 0xc
lea eax, [eax + eax*8]
or eax, 3
imul eax, eax, 0xbdb4
mov dword [esp + 4], eax
mov dword [esp], 0xbdb5ae49
jmp 0x418426
cmp eax, 0x4a65686c
je 0x418a84
cmp eax, 0x4a9c93e3
je 0x418aaa
cmp eax, 0x5c73a5bb
jne 0x418426
imul ebx, dword [esp + 4], 0xdbfc00
add ebx, 0xbdb400
mov dword [esp + 4], ebx
call fcn.0041bba7
mov eax, 0xd5ebcc3b
cmp ebx, 0xca
jge 0x418c61
mov eax, 0x4a65686c
jmp 0x418c61
cmp eax, 0xb17f3e1d
je 0x418b04
cmp eax, 0xb641496a
je 0x418b18
cmp eax, 0xbdb5ae49
jne 0x418426
imul eax, dword [esp + 4], 0x63f09
add eax, 0x9a
mov dword [esp + 4], eax
mov dword [esp], 0x4a65686c
jmp 0x418426
cmp eax, 0x7ba2756b
je 0x418b24
cmp eax, 0x7bb9a474
je 0x418b7c
cmp eax, 0x7ef4b7ec
jne 0x418426
mov dword [esp], 0xef7afdb0
jmp 0x418426
cmp eax, 0xd5a3cfe9
je 0x418b9f
cmp eax, 0xd5ebcc3b
jne 0x418c69
mov dword [esp + 0x1c], 0
mov dword [esp], 0x8b41b76d
jmp 0x418426
cmp eax, 0x114a1483
je 0x418bdd
cmp eax, 0x15dcb524
jne 0x418426
push dword [esp + 0x10]
call fcn.0043c186
add esp, 4
mov dword [esp], 0xd5a3cfe9
jmp 0x418426
cmp eax, 0x83cb686d
je 0x418bff
cmp eax, 0x8b41b76d
jne 0x418426
imul eax, dword [esp + 8], 0xe0
mov dword [esp + 8], eax
mov dword [esp], 0xa7806c70
jmp 0x418426
cmp eax, 0x5d69b17c
je 0x418c33
cmp eax, 0x5e2bb1ef
jne 0x418426
mov dword [esp], 0x9a4cbdfb
jmp 0x418426
imul eax, dword [esp + 8], 0x68
add eax, 0x543
mov dword [esp + 8], eax
mov dword [esp], 0xfaab98b7
jmp 0x418426
imul ecx, dword [esp + 4], 0x24c0
add ecx, 0xffffff91
mov dword [esp + 4], ecx
mov eax, 0xb17f3e1d
cmp ecx, 0xec
jge 0x418c61
mov eax, 0x1f92b7a1
jmp 0x418c61
mov eax, dword [esp + 8]
shr eax, 7
and eax, 0xfff
mov dword [esp + 8], eax
mov dword [esp], 0x15dcb524
jmp 0x418426
imul ecx, dword [esp + 4], 0x7e0
add ecx, 0xd4b
mov eax, ecx
shr eax, 4
mov dword [esp + 4], eax
mov eax, 0xd1edb13
cmp ecx, 0xb00
jae 0x418c61
mov eax, 0xd22e8f32
jmp 0x418c61
mov dword [esp], 0x946f13c8
jmp 0x418426
mov dword [esp], 0xb17f3e1d
jmp 0x418426
mov eax, dword [esp + 8]
add eax, edi
mov ecx, eax
imul ecx, eax
imul edx, ecx, 0x2425
dec edx
and eax, 0xfffffff8
shl eax, 6
mov dword [esp + 8], eax
mov eax, 0x114a1483
cmp ecx, edx
jne 0x418bd3
jmp 0x418c61
mov eax, dword [esp + 4]
shr eax, 8
imul eax, eax, 0xc8
mov dword [esp + 4], eax
push eax
call fcn.0040db83
add esp, 4
jmp 0x4189fb
imul eax, dword [esp + 4], 0x2b
add eax, 0xff5
mov dword [esp + 4], eax
push 0x15d3
push eax
call fcn.00414176
add esp, 8
jmp 0x4189fb
imul ebx, dword [esp + 4], 0x7e0
and ebx, 0xffffc000
mov dword [esp + 4], ebx
push ebx
push 0x5aae
push 0x1734
push 0x29af
call fcn.004125c4
add esp, 0x10
mov eax, 0x7112eeb4
cmp ebx, 0xcd
jge 0x418c61
mov eax, 0x4a9c93e3
jmp 0x418c61
mov dword [esp + 0x24], 0
mov dword [esp], 0xae855736
jmp 0x418426
imul eax, dword [esp + 4], 0x3bcd
add eax, 0x221
mov dword [esp + 4], eax
call fcn.00419369
mov dword [esp], 0xd5ebcc3b
jmp 0x418426
mov ecx, dword [esp + 4]
shl ecx, 0x11
add ecx, 0xf8ff2
mov dword [esp + 4], ecx
mov eax, 0x4a65686c
cmp ecx, 0x16
jge 0x418c61
mov eax, 0x5f31ae81
jmp 0x418c61
mov ecx, dword [esp + 4]
shr ecx, 0x13
and ecx, 0xfffffff8
mov dword [esp + 4], ecx
mov eax, 0x1f92b7a1
cmp ecx, 0x94
jb 0x418c61
mov eax, 0xd85d6efb
jmp 0x418c61
mov dword [esp], 0x83cb686d
jmp 0x418426
mov eax, dword [esp + 8]
shl eax, 8
add eax, 0xffff44e4
shr eax, 5
mov dword [esp + 8], eax
mov dword [esp], 0xb641496a
jmp 0x418426
cmp dword [esp + 0x20], 0
mov eax, 0xff54a669
jg 0x418a95
mov eax, 0x5d69b17c
cmp byte [esp + 0xf], 0
jne 0x418c61
mov eax, 0x5d69b17c
jmp 0x418c61
mov eax, dword [esp + 4]
shl eax, 9
add eax, 0xffb68000
mov ebx, 0xd5ebcc3b
and eax, 0xffffc000
mov dword [esp + 4], eax
je 0x418acb
mov ebx, 0xe8ee3a89
push eax
push 0x481e
push 0x4ea2
push 0x1e3
push 0x33e6
push 0x3b2b
push 0x2c23
push 0x1cdc
push 0x1bd3
call fcn.00414189
add esp, 0x24
mov dword [esp], ebx
jmp 0x418426
mov dword [esp + 0x18], 0
mov dword [esp], 0x1f92b7a1
jmp 0x418426
mov dword [esp], 0x1c6fec69
jmp 0x418426
imul ebx, dword [esp + 4], 0xdd60
add ebx, 0x4c19d7
mov dword [esp + 4], ebx
push ebx
push 0x55b5
push 0x4fa9
push 0x5ffa
call fcn.0040d8f5
add esp, 0x10
push ebx
push 0x23e7
push 0x2265
call fcn.0040d8d5
add esp, 0xc
mov eax, 0x4a65686c
cmp ebx, 0xb7
jb 0x418c61
mov eax, 0xb17f3e1d
jmp 0x418c61
imul ecx, dword [esp + 4], 0x49f000
mov dword [esp + 4], ecx
mov eax, 0xe89a26c3
test ecx, ecx
je 0x418c61
mov eax, 0xd5ebcc3b
jmp 0x418c61
imul ecx, dword [esp + 8], 0xa9
add ecx, 0x8aa2
imul eax, ecx, 0xb000
imul ecx, ecx
imul edx, ecx, 0x8799
dec edx
add eax, 0xf900
mov dword [esp + 8], eax
mov eax, 0x910cf1ef
cmp edx, ecx
je 0x418c61
mov eax, 0xc093ec90
jmp 0x418c61
mov ecx, dword [esp + 4]
shr ecx, 5
add ecx, 0xffffffb0
mov dword [esp + 4], ecx
mov eax, 0x7ba2756b
cmp ecx, 0xa4
jae 0x418c61
mov eax, 0x83cb686d
jmp 0x418c61
mov eax, dword [esp + 0x14]
cmp eax, 0xffffffff
setne al
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x10], ecx
cmp dword [esp + 0x10], 0
setne cl
and cl, al
mov byte [esp + 0xf], cl
mov eax, dword [esp + 0x18]
mov dword [esp + 0x20], eax
mov dword [esp], 0x712f0c57
jmp 0x418426
mov eax, dword [esp + 8]
lea ecx, [eax - 0x6c]
imul ecx, ecx
imul eax, eax, 0x36
add eax, 0x125a
imul edx, ecx, 0x3cd3
shr eax, 0xa
dec edx
mov dword [esp + 8], eax
mov eax, 0x4222e7df
cmp ecx, edx
je 0x418c61
mov eax, 0x7ef4b7ec
mov dword [esp], eax
jmp 0x418426
cmp eax, 0xc093ec90
jne 0x418426
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret