Function at 0x415150
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
mov ebx, ecx
push edi
mov ecx, 0x7cb478
call fcn.004d51e0
mov esi, dword [0x7c67dc]
mov ecx, dword [esi + 0xb0]
mov edx, dword [ecx + 0x34]
mov ebp, eax
mov eax, dword [esi + 0xb8]
fld dword [eax + 0x34]
mov eax, dword [esi + 0xb4]
mov ecx, dword [eax + 0x34]
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ecx
call sub.MSVCRT.dll__ftol
push eax
push 0x1e1
mov ecx, esi
call fcn.0040f930
fld dword [esp + 0x14]
push eax
call sub.MSVCRT.dll__ftol
mov edx, dword [eax*4 + 0x79449c]
mov ecx, dword [0x7c67dc]
push edx
call fcn.0040f930
fld dword [esp + 0x1c]
push eax
call sub.MSVCRT.dll__ftol
push eax
push str._FONT_COLOR_9F0000___d__s___s__d___FONT__BR__n
push ebp
call dword [sym.imp.MSVCRT.dll_sprintf]
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x34]
mov esi, dword [eax + 0x14]
add esp, 0x18
call fcn.004b1b80
mov ecx, dword [esi + 0x28]
mov edx, dword [0x7c67dc]
push eax
push ecx
mov ecx, dword [edx + 0x40]
call fcn.0040be50
mov edx, dword [ebx + 4]
test edx, edx
je 0x4152eb
or ecx, 0xffffffff
xor eax, eax
mov edi, edx
repne scasb al, byte es:[edi]
mov edi, dword [0x7c6568]
not ecx
dec ecx
mov esi, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
add esi, ecx
or ecx, 0xffffffff
mov edi, ebp
repne scasb al, byte es:[edi]
not ecx
dec ecx
add esi, ecx
or ecx, 0xffffffff
mov edi, str._P__n
repne scasb al, byte es:[edi]
mov eax, dword [ebx + 8]
not ecx
dec ecx
add esi, ecx
cmp esi, eax
jb 0x415270
add eax, 0x400
push eax
push edx
mov dword [ebx + 8], eax
call dword [sym.imp.MSVCRT.dll_realloc]
add esp, 8
test eax, eax
mov dword [ebx + 4], eax
jne 0x415270
mov eax, dword [ebx + 8]
push eax
push str.Your_journal_could_not_grow_to_size__d._r_n
call fcn.00477400
add esp, 8
or ecx, 0xffffffff
xor eax, eax
mov edi, ebp
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
or ecx, 0xffffffff
mov esi, edi
mov edi, dword [ebx + 4]
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [0x7c6568]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
or ecx, 0xffffffff
mov esi, edi
mov edi, dword [ebx + 4]
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
or ecx, 0xffffffff
mov edi, str._P__n
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
or ecx, 0xffffffff
mov esi, edi
mov edi, dword [ebx + 4]
repne scasb al, byte es:[edi]
mov ecx, edx
shr ecx, 2
dec edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 0
push 0x80
push 4
push 0
push 0
push 0xc0000000
push str.Journal.htm
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x4153a1
push 2
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [esp + 0x24]
push eax
or ecx, 0xffffffff
xor eax, eax
mov edi, ebp
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call ebp
mov edx, dword [0x7c6568]
push 0
lea ecx, [esp + 0x24]
push ecx
or ecx, 0xffffffff
xor eax, eax
mov edi, edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
push esi
call ebp
or ecx, 0xffffffff
xor eax, eax
mov edi, str._P__n
repne scasb al, byte es:[edi]
push 0
lea edx, [esp + 0x24]
push edx
not ecx
dec ecx
push ecx
push str._P__n
push esi
call ebp
push 0
lea eax, [esp + 0x24]
push eax
or ecx, 0xffffffff
xor eax, eax
mov edi, 0x776ca0
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push 0x776ca0
push esi
call ebp
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [0x7c6568]
push ecx
call fcn.004b2c30
xor edx, edx
mov dx, word [0x7d3442]
push edx
call fcn.00595370
add esp, 8
test eax, eax
je 0x4153e0
mov ecx, dword [0x7c67dc]
push 0
push 4
push 0x1e0
call fcn.0040f930
push eax
call fcn.005c00a0
add esp, 0xc
pop edi
pop esi
pop ebp
mov byte [ebx], 1
pop ebx
add esp, 8
ret 8