Function at 0x409eb0
Capabilities:
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x524157
mov eax, dword fs:[0]
push eax
sub esp, 0x710
mov eax, dword [0x581500]
xor eax, esp
mov dword [esp + 0x708], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x581500]
xor eax, esp
push eax
lea eax, [esp + 0x724]
mov dword fs:[0], eax
cmp byte [0x58e9a4], 0
mov eax, dword [esp + 0x734]
mov dword [esp + 0x20], eax
mov dword [esp + 0x18], ecx
jne 0x40a26c
call fcn.0040db40
cmp byte [eax + 0x96a], 0
je 0x40a26c
cmp byte [0x58e9a4], 0
jne 0x40a26c
call fcn.0040db40
cmp byte [eax + 0x128], 0
je 0x409f39
add eax, 0x18
jmp 0x409f3c
mov eax, dword [eax + 0x14]
lea esi, [eax + 4]
xor ebp, ebp
cmp esi, ebp
je 0x40a26c
cmp word [esi], bp
je 0x40a26c
lea ecx, [esp + 0x154]
call fcn.004114e0
mov eax, esi
lea edx, [esp + 0x154]
mov dword [esp + 0x72c], ebp
call fcn.00411710
push ebp
push ebp
push ebp
push ebp
push ebp
push str.ErrorLog
lea ecx, [esp + 0x44]
call fcn.0040e250
cmp byte [esp + 0x148], 0
lea eax, [esp + 0x38]
jne 0x409f98
mov eax, dword [esp + 0x34]
cmp word [eax + 4], 0x2e
lea ecx, [esp + 0x154]
jne 0x409fb2
lea edx, [esp + 0x2c]
push edx
call fcn.0040f590
jmp 0x409fbc
lea eax, [esp + 0x2c]
push eax
call fcn.0040e8e0
cmp byte [esp + 0x148], 0
mov dword [esp + 0x2c], vtable.t_str.0
jne 0x409fe3
mov eax, dword [esp + 0x34]
lea ecx, [esp + 0x38]
cmp eax, ecx
je 0x409fe3
push eax
call fcn.004faac5
add esp, 4
lea ecx, [esp + 0x154]
mov dword [esp + 0x72c], 1
call fcn.0040eb00
test al, al
je 0x40a260
push ebp
call fcn.004fb784
add esp, 4
lea ecx, [esp + 0x3a4]
mov esi, eax
mov edi, edx
call fcn.004114e0
push str._Y__M__D
push edi
push esi
lea esi, [esp + 0x3b0]
mov byte [esp + 0x738], 2
call fcn.00412160
push ebp
push ebp
push ebp
push ebp
mov ecx, esi
call fcn.00411da0
push eax
lea edx, [esp + 0x168]
push edx
lea ecx, [esp + 0x294]
call fcn.0040e510
mov bl, 3
lea ecx, [esp + 0x27c]
mov byte [esp + 0x72c], bl
call fcn.0040eb00
test al, al
jne 0x40a0c8
mov byte [esp + 0x28], al
mov dword [esp + 0x24], ebp
push ebp
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x284]
mov byte [esp + 0x734], 4
call fcn.0040f690
test al, al
jne 0x40a0ac
lea ecx, [esp + 0x24]
call fcn.004099e0
lea ecx, [esp + 0x24]
call fcn.00409930
jmp 0x40a248
lea eax, [esp + 0x27c]
call fcn.00410fb0
lea ecx, [esp + 0x24]
mov byte [esp + 0x72c], bl
call fcn.00409930
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x20]
push ebp
push ebp
push ebp
push str..log
push edx
lea eax, [esp + 0x290]
mov byte [ecx + 4], 0
push eax
lea ecx, [esp + 0x60c]
call fcn.0040e510
push ebp
push 0x80
push 4
push ebp
push ebp
push 4
lea ecx, [esp + 0x60c]
call fcn.00411da0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x40a21c
push 1
push ebp
call fcn.00413790
push 1
push ebp
call fcn.004137e0
add esp, 0x10
push 2
push 0
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x40a21c
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x40a17c
push 0
lea ecx, [esp + 0x1c]
push ecx
push 2
lea edx, [esp + 0x28]
push edx
push ebp
mov byte [esp + 0x30], 0xff
mov byte [esp + 0x31], 0xfe
mov dword [esp + 0x2c], 0
call ebx
cmp dword [esp + 0x18], 2
jne 0x40a21c
lea ecx, [esp + 0x4cc]
call fcn.004114e0
mov eax, dword [esp + 0x20]
push eax
lea edi, [esp + 0x4d0]
call fcn.00409c60
lea ecx, [esp + 0x2c]
call fcn.004114e0
push 0x55c17c
push 0
call fcn.004fb784
add esp, 4
push edx
push eax
lea esi, [esp + 0x38]
call fcn.00412160
push 0x55c0ec
mov ecx, edi
call fcn.00411da0
push eax
push 0x55c178
mov ecx, esi
call fcn.00411ca0
mov ecx, eax
call fcn.00411ca0
mov ecx, eax
call fcn.00411ca0
mov esi, dword [esp + 0x30]
push 0
lea ecx, [esp + 0x1c]
push ecx
add esi, esi
push esi
lea ecx, [esp + 0x38]
mov dword [esp + 0x24], 0
call fcn.00411da0
push eax
push ebp
call ebx
lea ecx, [esp + 0x2c]
cmp dword [esp + 0x18], esi
je 0x40a224
call fcn.00411680
mov ecx, edi
call fcn.00411680
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x40a23c
call fcn.00411680
lea ecx, [esp + 0x4cc]
call fcn.00411680
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x5f4]
call fcn.00411680
lea ecx, [esp + 0x27c]
call fcn.00411680
lea ecx, [esp + 0x3a4]
call fcn.00411680
lea ecx, [esp + 0x154]
call fcn.00411680
mov ecx, dword [esp + 0x724]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x708]
xor ecx, esp
call fcn.004fa259
add esp, 0x71c
ret 4