Function at 0x401a60
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x1b0]
sub esp, 0x230
mov eax, dword [0x40f3f0]
push ebx
push esi
push edi
push 0x2711
mov dword [ebp + 0x1ac], eax
call fcn.00403a83
test eax, eax
setne bl
mov byte [ebp - 0x70], bl
push 0x87
push dword [ebp - 0x70]
mov dword [ebp - 0x74], eax
call fcn.00401a42
add esp, 0xc
test bl, bl
je 0x401b35
push dword [ebp + 0x1b8]
mov esi, 0x2710
push esi
push 1
push dword [ebp - 0x74]
call fcn.00403a37
add esp, 0x10
mov edi, eax
cmp edi, esi
jne 0x401b08
push dword [ebp + 0x1bc]
push esi
push 1
push dword [ebp - 0x74]
call fcn.00403902
cmp eax, esi
sete bl
mov byte [ebp - 0x70], bl
push 0x90
push dword [ebp - 0x70]
call fcn.00401a42
push dword [ebp + 0x1b8]
push esi
push 1
push dword [ebp - 0x74]
call fcn.00403a37
add esp, 0x28
test bl, bl
mov edi, eax
jne 0x401ac4
test bl, bl
je 0x401b35
push dword [ebp + 0x1bc]
push edi
push 1
push dword [ebp - 0x74]
call fcn.00403902
cmp eax, edi
sete bl
mov byte [ebp - 0x70], bl
push 0x97
push dword [ebp - 0x70]
call fcn.00401a42
add esp, 0x18
xor esi, esi
cmp dword [ebp + 0x1bc], esi
je 0x401b4b
push dword [ebp + 0x1bc]
call fcn.004037aa
pop ecx
cmp dword [ebp + 0x1b8], esi
je 0x401b5f
push dword [ebp + 0x1b8]
call fcn.004037aa
pop ecx
test bl, bl
je 0x401e47
push 0x40c424
push dword [ebp + 0x1c0]
mov dword [ebp - 0x78], esi
call fcn.0040374b
mov edi, eax
test edi, edi
setne bl
mov byte [ebp - 0x70], bl
push 0xad
push dword [ebp - 0x70]
mov dword [ebp - 0x7c], edi
call fcn.00401a42
add esp, 0x10
test bl, bl
je 0x401d03
push 2
push 0
push edi
call fcn.004036a6
mov ebx, eax
neg ebx
sbb bl, bl
inc bl
mov byte [ebp - 0x70], bl
push 0xb3
push dword [ebp - 0x70]
call fcn.00401a42
add esp, 0x14
test bl, bl
je 0x401d03
push edi
call fcn.004035d6
mov esi, eax
test esi, esi
setne bl
mov byte [ebp - 0x70], bl
push 0xba
push dword [ebp - 0x70]
call fcn.00401a42
add esp, 0xc
test bl, bl
je 0x401d09
push 0
lea eax, [esi - 8]
push eax
push edi
call fcn.004036a6
mov ebx, eax
neg ebx
sbb bl, bl
inc bl
mov byte [ebp - 0x70], bl
push 0xc0
push dword [ebp - 0x70]
call fcn.00401a42
add esp, 0x14
test bl, bl
je 0x401d09
push 0x10
lea eax, [ebp + 0x19c]
push 0
push eax
call fcn.00403200
push edi
push 8
lea eax, [ebp + 0x19c]
push 1
push eax
call fcn.00403a37
add esp, 0x1c
test eax, eax
je 0x401c5f
lea eax, [ebp + 0x19c]
push eax
call fcn.004033e7
mov dword [ebp + 0x1bc], eax
jmp 0x401c6e
push 0xcd
push 0
xor bl, bl
call fcn.00401a42
pop ecx
test bl, bl
pop ecx
je 0x401d09
push dword [ebp + 0x1bc]
call fcn.004033d5
test eax, eax
setne bl
mov byte [ebp - 0x70], bl
push 0xd5
push dword [ebp - 0x70]
mov dword [ebp - 0x78], eax
call fcn.00401a42
add esp, 0xc
test bl, bl
je 0x401d09
mov eax, esi
sub eax, dword [ebp + 0x1bc]
push 0
sub eax, 8
push eax
push edi
call fcn.004036a6
mov ebx, eax
neg ebx
sbb bl, bl
inc bl
mov byte [ebp - 0x70], bl
push 0xdb
push dword [ebp - 0x70]
call fcn.00401a42
add esp, 0x14
test bl, bl
je 0x401d09
push edi
push dword [ebp + 0x1bc]
push 1
push dword [ebp - 0x78]
call fcn.00403a37
cmp eax, dword [ebp + 0x1bc]
push 0xe1
sete bl
mov byte [ebp - 0x70], bl
push dword [ebp - 0x70]
call fcn.00401a42
add esp, 0x18
jmp 0x401d09
mov esi, dword [ebp + 0x1bc]
and dword [ebp - 0x80], 0
test bl, bl
je 0x401df4
push str.cabinet.dll
push dword [ebp + 0x1c4]
lea eax, [ebp - 0x6c]
push str._s_s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push 0
push 0x80
push 2
push 0
push 1
push 0x40000000
lea eax, [ebp - 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x80], eax
jne 0x401d77
call edi
push eax
lea eax, [ebp - 0x6c]
push eax
push str.CreateFile__s_error__d
push str.Extract
call fcn.00401219
add esp, 0x10
xor bl, bl
test bl, bl
je 0x401df1
push 0
lea eax, [ebp + 0x1b8]
push eax
push dword [ebp + 0x1bc]
push dword [ebp - 0x78]
push dword [ebp - 0x80]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x401db5
call edi
push eax
lea eax, [ebp - 0x6c]
push eax
push str.WriteFile__s_error__d
push str.Extract
call fcn.00401219
add esp, 0x10
xor bl, bl
test bl, bl
je 0x401df1
push 0
push 0
push dword [ebp - 0x7c]
call fcn.004036a6
sub esi, dword [ebp + 0x1bc]
add esp, 0xc
sub esi, 8
push esi
push dword [ebp - 0x7c]
call fcn.00402d00
test eax, eax
setne bl
mov byte [ebp - 0x70], bl
push 0x101
push dword [ebp - 0x70]
call fcn.00401a42
pop ecx
pop ecx
mov edi, dword [ebp - 0x7c]
cmp dword [ebp - 0x78], 0
je 0x401e03
push dword [ebp - 0x78]
call fcn.004032bd
pop ecx
test edi, edi
je 0x401e0e
push edi
call fcn.004037aa
pop ecx
cmp dword [ebp - 0x80], 0
je 0x401e1d
push dword [ebp - 0x80]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
je 0x401e47
push dword [ebp + 0x1c4]
push dword [ebp + 0x1c0]
call fcn.00402560
mov bl, al
mov byte [ebp - 0x70], bl
push 0x115
push dword [ebp - 0x70]
call fcn.00401a42
add esp, 0x10
cmp dword [ebp - 0x74], 0
je 0x401e56
push dword [ebp - 0x74]
call fcn.004032b8
pop ecx
mov ecx, dword [ebp + 0x1ac]
pop edi
pop esi
mov al, bl
pop ebx
call fcn.004031e9
add ebp, 0x1b0
leave
ret