Function at 0x411540
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x918
mov eax, dword [0x488e40]
xor eax, esp
mov dword [esp + 0x914], eax
push ebx
push ebp
mov ebp, dword [esp + 0x924]
push esi
push edi
push ebp
mov edi, str._Search_Order__r_n_______________________________________________________________________________r_n_Legend:_F__File_____________________E__Error__path_not_valid__________________r_n_______________________________________________________________________________r_n_r_n_r_n
mov dword [esp + 0x18], ebp
mov esi, ecx
call fcn.00416f60
mov edi, dword [esi + 0x70]
xor ebx, ebx
add esp, 4
cmp edi, ebx
mov dword [esp + 0x18], edi
je 0x411762
mov eax, dword [edi + 4]
cmp eax, 9
jge 0x411595
mov esi, dword [eax*4 + 0x48a5d8]
jmp 0x41159a
mov esi, str.Unknown
lea eax, [esp + 0x1c]
mov ecx, 0x907
mov dl, byte [esi]
cmp dl, bl
je 0x4115b8
mov byte [eax], dl
sub ecx, 1
add eax, 1
add esi, 1
cmp ecx, ebx
jg 0x4115a3
mov byte [eax], bl
mov esi, 0x47656c
lea ecx, [esp + 0x1c]
mov eax, 0x907
cmp byte [ecx], bl
je 0x4115d8
sub eax, 1
add ecx, 1
cmp eax, ebx
jg 0x4115c8
jmp 0x4115f5
cmp eax, ebx
jle 0x4115f5
lea esp, [esp]
mov dl, byte [esi]
cmp dl, bl
je 0x4115f5
mov byte [ecx], dl
sub eax, 1
add ecx, 1
add esi, 1
cmp eax, ebx
jg 0x4115e0
lea eax, [esp + 0x1c]
mov byte [ecx], bl
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x411600
sub eax, edx
mov esi, eax
cmp esi, 0xffffffff
jne 0x41162d
lea eax, [esp + 0x1c]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x411620
sub eax, edx
mov esi, eax
push ebx
lea eax, [esp + 0x14]
push eax
push esi
lea ecx, [esp + 0x28]
push ecx
push ebp
mov dword [esp + 0x24], ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x41175e
cmp dword [esp + 0x10], esi
jne 0x411756
mov ebp, dword [edi + 8]
cmp ebp, ebx
je 0x411741
movzx eax, word [ebp + 4]
test al, 8
lea edx, [ebp + 8]
mov esi, 0x908
lea edi, [esp + 0x1c]
push edx
je 0x4116ab
movzx ecx, word [ebp + 6]
lea edx, [ecx + ebp + 8]
mov ecx, eax
and cl, 2
neg cl
push edx
sbb ecx, ecx
and al, 4
and ecx, 0x25
add ecx, 0x20
neg al
push ecx
sbb eax, eax
and eax, 0x26
add eax, 0x20
push eax
push str._____c_c___s___s_r_n
call fcn.00416ab0
add esp, 0x14
jmp 0x4116d5
mov ecx, eax
and cl, 2
neg cl
sbb ecx, ecx
and al, 4
and ecx, 0x25
add ecx, 0x20
neg al
push ecx
sbb eax, eax
and eax, 0x26
add eax, 0x20
push eax
push str._____c_c___s_r_n
call fcn.00416ab0
add esp, 0x10
lea eax, [esp + 0x1c]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x4116e0
sub eax, edx
mov esi, eax
cmp esi, 0xffffffff
jne 0x41170d
lea eax, [esp + 0x1c]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x411700
sub eax, edx
mov esi, eax
mov ecx, dword [esp + 0x14]
push ebx
lea edx, [esp + 0x14]
push edx
push esi
lea eax, [esp + 0x28]
push eax
push ecx
mov dword [esp + 0x24], ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x41175e
cmp dword [esp + 0x10], esi
jne 0x411756
mov ebp, dword [ebp]
cmp ebp, ebx
jne 0x411661
mov edi, dword [esp + 0x18]
mov eax, dword [edi]
cmp eax, ebx
mov ebp, dword [esp + 0x14]
mov dword [esp + 0x18], eax
je 0x411762
mov edi, eax
jmp 0x411584
push 0x1d
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor al, al
jmp 0x41179c
push ebx
lea edx, [esp + 0x14]
push edx
push 2
push 0x47656c
push ebp
mov dword [esp + 0x24], ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x411791
cmp dword [esp + 0x10], 2
jne 0x411789
mov al, 1
jmp 0x411793
push 0x1d
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor al, al
xor ecx, ecx
cmp al, bl
setne cl
mov al, cl
mov ecx, dword [esp + 0x924]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00454016
add esp, 0x918
ret