Function at 0x409e94
Capabilities:
Write file on windows

Disassembly:
push 0xec
mov eax, 0x42c186
call fcn.004119a1
mov dword [ebp - 0xa8], ecx
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0x98], ecx
test esi, esi
je 0x40a2cc
xor ebx, ebx
cmp dword [eax + 0x10], ebx
je 0x40a2cc
call fcn.0040ce7d
push 0x10001c
call fcn.0040479c
mov edi, eax
pop ecx
test edi, edi
je 0x409ef8
push 0x10001c
push ebx
push edi
call fcn.00415940
add esp, 0xc
jmp 0x409efa
mov edi, ebx
mov dword [ebp - 0x78], edi
mov dword [ebp - 4], ebx
mov dword [edi + 0x10], esi
mov dword [edi], 0x40cf85
mov dword [edi + 4], 0x40cfd8
mov dword [edi + 8], 0x40cfe8
mov dword [edi + 0xc], 0x40d032
push 0x50
mov dword [edi + 0x18], ebx
mov dword [edi + 0x14], ebx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x38], ebx
call fcn.0040479c
mov ebx, eax
pop ecx
test ebx, ebx
je 0x409f47
push 0x50
push 0
push ebx
call fcn.00415940
add esp, 0xc
jmp 0x409f49
xor ebx, ebx
mov edx, 0x43e898
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x3c], edx
mov ecx, ebx
mov byte [ebp - 4], 1
call fcn.0040aff5
push edx
push edx
mov edx, edi
call fcn.0040c7ec
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x409f81
mov edx, 0x43e898
mov ecx, ebx
call fcn.0040b024
jmp 0x40a2c1
or dword [ebp - 0xa0], 0xffffffff
xor eax, eax
mov ecx, eax
mov dword [ebp - 0x90], eax
mov esi, eax
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0x80], ecx
cmp dword [ebx + 0x1c], eax
jbe 0x40a279
mov dword [ebp - 0x8c], eax
mov eax, dword [ebx + 0x10]
add eax, dword [ebp - 0x8c]
mov dword [ebp - 0x84], eax
cmp byte [eax + 0x19], 0
jne 0x40a21f
push ecx
mov edx, ebx
lea ecx, [ebp - 0x54]
call fcn.00409b08
pop ecx
mov eax, dword [ebp - 0x98]
mov byte [ebp - 4], 2
mov edx, dword [eax + 0x24]
test edx, edx
je 0x40a00b
mov ecx, dword [ebp - 0x84]
mov eax, dword [ecx + 8]
mov dword [ebp - 0x5c], eax
mov eax, dword [ecx + 0xc]
lea ecx, [ebp - 0x5c]
push ecx
mov dword [ebp - 0x58], eax
lea ecx, [ebp - 0x54]
mov eax, dword [edx]
push ecx
mov ecx, edx
call dword [eax + 8]
test al, al
je 0x40a20f
and dword [ebp - 0x84], 0
mov eax, 0x43e898
push eax
and dword [ebp - 0x88], 0
mov edx, edi
push eax
lea eax, [ebp - 0x88]
mov ecx, ebx
push eax
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x9c]
push eax
lea eax, [ebp - 0x90]
push eax
lea eax, [ebp - 0xa0]
push eax
push dword [ebp - 0x80]
call fcn.0040cb08
mov esi, eax
add esp, 0x20
test esi, esi
jne 0x40a2b5
lea eax, [ebp - 0x54]
push eax
lea ecx, [ebp - 0xc0]
call fcn.00404f09
mov edx, dword [ebp - 0xa4]
lea eax, [ebp - 0xc0]
push eax
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], 3
call fcn.0040ae3c
pop ecx
push esi
push 1
lea ecx, [ebp - 0xc0]
mov byte [ebp - 4], 5
call fcn.00402111
lea eax, [ebp - 0xf8]
push eax
lea ecx, [ebp - 0x74]
call fcn.004128f0
push eax
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 6
call fcn.00404f09
push esi
push 1
lea ecx, [ebp - 0xf8]
call fcn.00402111
mov dword [ebp - 0x94], esi
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x30]
cmp dword [ebp - 0x1c], 8
lea edx, [ebp - 0x94]
mov eax, dword [ebp - 0x20]
cmovae ecx, dword [ebp - 0x30]
push edx
lea eax, [ecx + eax*2]
lea ecx, [ebp - 0x30]
cmovae ecx, dword [ebp - 0x30]
push eax
push ecx
lea ecx, [ebp - 0xe0]
call fcn.0040a43e
mov ecx, eax
mov byte [ebp - 4], 0xa
call fcn.0040a544
lea ecx, [ebp - 0xe0]
mov esi, eax
call fcn.0040ada2
mov byte [ebp - 4], 8
mov eax, dword [ebp - 0x94]
test eax, eax
je 0x40a124
mov ecx, dword [eax]
push eax
call dword [ecx + 4]
pop ecx
test esi, esi
jne 0x40a2ad
or dword [ebp - 0x7c], 0xffffffff
lea eax, [ebp - 0xd8]
push eax
lea ecx, [ebp - 0x74]
call fcn.00412330
mov esi, eax
lea eax, [ebp - 0xc0]
mov byte [ebp - 4], 0xb
push eax
lea ecx, [ebp - 0x74]
call fcn.004128f0
lea ecx, [ebp - 0x7c]
mov byte [ebp - 4], 0xc
push ecx
push ecx
mov edx, esi
mov ecx, eax
call fcn.0040d052
pop ecx
pop ecx
push 0
push 1
lea ecx, [ebp - 0xc0]
mov esi, eax
call fcn.00402111
push 0
push 1
lea ecx, [ebp - 0xd8]
mov byte [ebp - 4], 8
call fcn.00402111
test esi, esi
jne 0x40a251
lea eax, [ebp - 0x7c]
xor ecx, ecx
push eax
push dword [ebp - 0xa8]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], ecx
push ecx
lea ecx, [ebp - 0x18]
call fcn.0040a698
cmp dword [ebp - 0x88], esi
jne 0x40a1bd
mov byte [ebp - 4], 0xd
jmp 0x40a1eb
and dword [ebp - 0x34], 0
lea eax, [ebp - 0x34]
push 0
push eax
push dword [ebp - 0x88]
mov eax, dword [ebp - 0x84]
add eax, dword [ebp - 0x90]
push eax
push dword [ebp - 0x7c]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40a239
mov byte [ebp - 4], 0xf
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x40a1f7
call fcn.004038ea
push 0
push 1
lea ecx, [ebp - 0x30]
call fcn.00402111
push 0
push 1
lea ecx, [ebp - 0x74]
call fcn.00402111
push 0
push 1
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], 1
call fcn.00402111
mov eax, dword [ebp - 0x80]
add dword [ebp - 0x8c], 0x20
inc eax
mov dword [ebp - 0x80], eax
cmp eax, dword [ebx + 0x1c]
jae 0x40a279
mov ecx, eax
jmp 0x409fac
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov byte [ebp - 4], 0xe
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x40a251
call fcn.004038ea
push 0
push 1
lea ecx, [ebp - 0x30]
call fcn.00402111
push 0
push 1
lea ecx, [ebp - 0x74]
call fcn.00402111
push 0
push 1
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], 1
call fcn.00402111
push dword [ebp - 0x90]
push 0x43e898
call dword [0x43e89c]
pop ecx
pop ecx
test ebx, ebx
je 0x40a29c
mov edx, 0x43e898
mov ecx, ebx
call fcn.0040b024
push 0x10001c
push edi
call fcn.00411216
pop ecx
pop ecx
mov eax, esi
jmp 0x40a2d1
or esi, 0x20000000
jmp 0x40a251
push 0
push 1
lea ecx, [ebp - 0x54]
call fcn.00402111
mov ecx, esi
call fcn.004099f9
mov esi, eax
jmp 0x40a28c
mov eax, 0xa0
call fcn.0041194b
ret 0xc