Function at 0x409fa0
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x41a8
call fcn.0040df50
mov eax, dword [0x422830]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
lea eax, [esi + 0x1c0]
cmp dword [eax], 0
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], 0x428078
mov dword [esi + 4], 0x428060
mov dword [esi + 8], 0x42804c
mov dword [esi + 0x3c], 0x42802c
mov dword [esi + 0x40], 0x428000
mov dword [esi + 0x44], 0x42801c
mov dword [esi + 0x48], 0x42800c
mov dword [esi + 0x4c], 0x428000
je 0x40a028
and dword [eax], 0
lea ebx, [esi + 0x4ae8]
mov eax, dword [ebx]
test eax, eax
je 0x40a020
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
push dword [ebx]
call edi
push 0x1e
call dword [sym.imp.KERNEL32.dll_Sleep]
push dword [esi + 0x3628]
mov ecx, esi
push dword [esi + 0x3624]
call fcn.004090c2
mov eax, dword [esi + 0xd8]
test eax, eax
je 0x40a048
push eax
call edi
mov eax, dword [esi + 0xdc]
test eax, eax
je 0x40a055
push eax
call edi
mov eax, dword [esi + 0x4aec]
test eax, eax
je 0x40a062
push eax
call edi
mov eax, dword [esi + 0x4af0]
test eax, eax
je 0x40a06f
push eax
call edi
cmp dword [esi + 0xe0], 0
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
je 0x40a0ce
mov ecx, dword [esi + 0x270]
test ecx, ecx
je 0x40a0a1
push 0x41a0
lea eax, [ebp - 0x41a4]
push eax
call fcn.0041073b
mov dword [ebp - 0x41a8], eax
jmp 0x40a0a8
and dword [ebp - 0x41a8], 0
push 0
lea eax, [ebp - 0x41a8]
push eax
push dword [ebp - 0x41a8]
lea eax, [ebp - 0x41a4]
push eax
push dword [esi + 0xe0]
call ebx
push dword [esi + 0xe0]
call edi
cmp dword [esi + 0xe4], 0
je 0x40a127
mov ecx, dword [esi + 0x274]
test ecx, ecx
je 0x40a0fa
push 0x41a0
lea eax, [ebp - 0x41a4]
push eax
call fcn.0041073b
mov dword [ebp - 0x41a8], eax
jmp 0x40a101
and dword [ebp - 0x41a8], 0
push 0
lea eax, [ebp - 0x41a8]
push eax
push dword [ebp - 0x41a8]
lea eax, [ebp - 0x41a4]
push eax
push dword [esi + 0xe4]
call ebx
push dword [esi + 0xe4]
call edi
cmp dword [esi + 0xe8], 0
je 0x40a180
mov ecx, dword [esi + 0x270]
test ecx, ecx
je 0x40a153
push 0x41a0
lea eax, [ebp - 0x41a4]
push eax
call fcn.0041077c
mov dword [ebp - 0x41a8], eax
jmp 0x40a15a
and dword [ebp - 0x41a8], 0
push 0
lea eax, [ebp - 0x41a8]
push eax
push dword [ebp - 0x41a8]
lea eax, [ebp - 0x41a4]
push eax
push dword [esi + 0xe8]
call ebx
push dword [esi + 0xe8]
call edi
cmp dword [esi + 0xec], 0
je 0x40a1d9
mov ecx, dword [esi + 0x274]
test ecx, ecx
je 0x40a1ac
push 0x41a0
lea eax, [ebp - 0x41a4]
push eax
call fcn.0041077c
mov dword [ebp - 0x41a8], eax
jmp 0x40a1b3
and dword [ebp - 0x41a8], 0
push 0
lea eax, [ebp - 0x41a8]
push eax
push dword [ebp - 0x41a8]
lea eax, [ebp - 0x41a4]
push eax
push dword [esi + 0xec]
call ebx
push dword [esi + 0xec]
call edi
lea edi, [esi + 0x80]
mov ecx, dword [edi]
test ecx, ecx
je 0x40a1ee
mov eax, dword [ecx]
push 1
call dword [eax]
and dword [edi], 0
lea edi, [esi + 0x4b00]
mov eax, dword [edi]
test eax, eax
je 0x40a20b
mov edx, dword [eax]
lea ecx, [esi + 0x3c]
push ecx
push eax
call dword [edx + 0x1c]
and dword [esi + 0x208], 0
mov edi, dword [edi]
test edi, edi
je 0x40a217
mov eax, dword [edi]
push edi
call dword [eax + 8]
mov eax, dword [esi + 0x4afc]
test eax, eax
je 0x40a227
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esi + 0x4af8]
test eax, eax
je 0x40a237
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea ecx, [esi + 0x244]
call fcn.004119d2
lea ecx, [esi + 0x1c4]
call fcn.004068b0
lea ecx, [esi + 0x110]
call fcn.0040681b
lea ecx, [esi + 0x88]
call fcn.0041145f
mov ecx, esi
call fcn.0040eaf1
lea ecx, [esi + 0x50]
call fcn.0040848c
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040de61
leave
ret