Function at 0x41cbe4
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x908], ebx
je 0x41ce6a
mov eax, dword [esi + 0x90c]
push edi
mov edi, eax
cmp eax, 0xffffffff
jne 0x41cc0d
mov edi, dword [ebp + 0xc]
xor ecx, ecx
cmp dword [ebp + 0x10], ebx
lea eax, [esi + 0x8e4]
sete cl
cmp byte [eax + 7], 0xff
lea ecx, [ecx + ecx + 2]
jne 0x41cc27
mov eax, dword [eax]
push ebx
push 0x80
push ecx
push ebx
push ebx
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp + 0xc], eax
cmp eax, 0xffffffff
je 0x41ce69
push 2
push ebx
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea ecx, [ebp - 0x10]
call fcn.0043f500
cmp edi, ebx
je 0x41cc92
cmp edi, 4
jne 0x41cca3
cmp byte [0x48fd93], 0xff
mov esi, 0x48fd8c
mov edi, esi
jne 0x41cc7a
mov edi, dword [0x48fd8c]
push 0
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0043f510
push eax
push edi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edi, dword [ebp + 8]
push edi
call fcn.0045f9f0
pop ecx
mov ebx, eax
jmp 0x41ce43
cmp edi, 3
jne 0x41ccf3
mov edi, dword [ebp + 8]
push 0x47ece8
push edi
call fcn.0045ea50
push 0x47ecd8
push edi
mov ebx, eax
call fcn.0045ea50
add esp, 0x10
test eax, eax
je 0x41ccd0
cmp eax, ebx
jae 0x41ccd0
mov ebx, eax
test ebx, ebx
je 0x41cce8
sub ebx, edi
push 1
lea ecx, [esi + 0x8bc]
call fcn.00440160
jmp 0x41ce38
push edi
call fcn.0045f9f0
pop ecx
mov ebx, eax
jmp 0x41ccd6
cmp edi, 2
jne 0x41cd13
mov edi, dword [ebp + 8]
push 0x481a54
push edi
call fcn.0045ea50
pop ecx
pop ecx
cmp eax, ebx
je 0x41cce8
sub eax, edi
lea ebx, [eax + 1]
jmp 0x41ccd6
cmp edi, 1
mov edi, dword [ebp + 8]
jne 0x41ce40
lea eax, [ebp + 0x10]
push eax
lea eax, [ebp + 8]
push eax
push edi
mov ecx, esi
mov dword [ebp + 0x10], ebx
call fcn.0041b6cf
push dword [ebp + 0x10]
lea ecx, [ebp - 0x18]
push dword [ebp + 8]
call fcn.0043fd90
mov esi, 0x48fd8c
push eax
mov ecx, esi
call fcn.0043f840
lea ecx, [ebp - 0x18]
call fcn.0043f790
mov ecx, esi
call fcn.0043f510
cmp byte [0x48fd93], 0xff
mov dword [ebp - 4], eax
mov ebx, esi
jne 0x41cd70
mov ebx, dword [0x48fd8c]
push 0
lea eax, [ebp - 4]
push eax
mov ecx, esi
call fcn.0043f510
push eax
push ebx
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov esi, str._____ORG:
push esi
push edi
call fcn.0045ea50
push 0x47ece8
push edi
mov dword [ebp + 8], eax
call fcn.0045ea50
add esp, 0x10
test eax, eax
je 0x41cdb0
cmp byte [eax - 1], 0xd
jne 0x41cdb0
dec eax
mov ebx, eax
sub ebx, edi
cmp dword [ebp + 8], 0
je 0x41ce43
test eax, eax
je 0x41cdc7
cmp eax, dword [ebp + 8]
jb 0x41ce43
push esi
call fcn.0045f9f0
mov esi, eax
add esi, dword [ebp + 8]
mov dword [esp], str.OOO____
push esi
call fcn.0045ea50
pop ecx
pop ecx
sub eax, esi
push eax
push esi
lea ecx, [ebp - 0x18]
call fcn.0043fd90
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x18]
call fcn.0041b3d4
pop ecx
push eax
lea ecx, [ebp - 0x10]
call fcn.0043f840
lea ecx, [ebp - 0x20]
call fcn.0043f790
push 1
lea ecx, [ebp - 0x10]
call fcn.00440160
lea ecx, [ebp - 0x10]
mov edi, eax
call fcn.0043f510
lea ecx, [ebp - 0x18]
mov ebx, eax
call fcn.0043f790
jmp 0x41ce43
mov cl, byte [edi]
cmp cl, 0x20
je 0x41ce37
cmp cl, 9
jne 0x41ce3d
inc ebx
cmp edi, eax
dec edi
jae 0x41ce2b
inc edi
jmp 0x41ce43
mov ebx, dword [ebp + 8]
test edi, edi
je 0x41ce58
push 0
lea eax, [ebp - 8]
push eax
push ebx
push edi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x10]
call fcn.0043f790
pop edi
pop esi
pop ebx
leave
ret 0xc