Function at 0x410815
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x654
mov eax, dword [0x439030]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, ecx
cmp dword [edi + 4], 0xffffffff
je 0x41083d
mov ecx, dword [edi]
call fcn.00410087
mov ecx, dword [edi]
xor ebx, ebx
or dword [edi + 4], 0xffffffff
cmp dword [ecx + 4], ebx
jg 0x410862
mov eax, 0x10000
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041813f
mov esp, ebp
pop ebp
ret 0x10
cmp dword [ecx + 0x10], ebx
jle 0x410875
call fcn.0040faf9
jmp 0x410875
mov ecx, dword [edi]
call fcn.0040fb30
mov eax, dword [edi]
cmp dword [eax + 0x10], ebx
jl 0x41086e
lea eax, [ebp - 0x648]
mov ecx, edi
push eax
push ebx
call fcn.00410191
test byte [ebp - 0x43c], 0x10
movzx eax, word [esi]
je 0x4108c2
cmp eax, 0x2f
je 0x4108b5
cmp eax, 0x5c
je 0x4108b5
test ax, ax
je 0x4108ad
cmp word [esi + 2], 0x3a
je 0x4108b5
lea ecx, [edi + 0x244]
jmp 0x4108b7
xor ecx, ecx
mov edx, esi
call fcn.0041071f
xor eax, eax
jmp 0x41084f
push 0x5c
mov dword [ebp - 0x650], esi
mov ecx, esi
mov dword [ebp - 0x654], 0x2f
pop edx
jmp 0x4108f6
cmp ax, word [ebp - 0x654]
je 0x4108e7
cmp ax, dx
jne 0x4108f0
lea eax, [ecx + 2]
mov dword [ebp - 0x650], eax
add ecx, 2
movzx eax, word [ecx]
test ax, ax
jne 0x4108d9
push esi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov ecx, dword [ebp - 0x650]
cmp ecx, esi
jne 0x41091e
xor eax, eax
mov word [ebp - 0x210], ax
jmp 0x410960
mov eax, ecx
sub eax, esi
and eax, 0xfffffffe
cmp eax, 0x208
jae 0x410aad
xor edx, edx
mov word [ebp + eax - 0x210], dx
mov ax, word [ebp - 0x210]
push 0x2f
pop edx
cmp ax, dx
je 0x410988
push 0x5c
pop edx
cmp ax, dx
je 0x410988
test ax, ax
je 0x410960
cmp word [ebp - 0x20e], 0x3a
je 0x410988
push ecx
lea eax, [ebp - 0x210]
push eax
lea esi, [edi + 0x244]
push esi
lea eax, [ebp - 0x418]
push str._s_s_s
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x14
mov ecx, esi
jmp 0x4109a7
push ecx
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x418]
push str._s_s
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
xor ecx, ecx
lea edx, [ebp - 0x210]
call fcn.0041071f
push ebx
push dword [ebp - 0x43c]
lea eax, [ebp - 0x418]
push 2
push ebx
push ebx
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x650], eax
cmp eax, 0xffffffff
jne 0x4109e4
mov eax, 0x200
jmp 0x41084f
mov edx, dword [edi + 0x23c]
mov ecx, dword [edi]
call fcn.0040fd16
cmp dword [edi + 0x240], ebx
jne 0x410a0a
push 0x4000
call fcn.00417e2e
pop ecx
mov dword [edi + 0x240], eax
mov edx, dword [edi + 0x240]
lea eax, [ebp - 0x649]
mov ecx, dword [edi]
push eax
push 0x4000
call fcn.0040fe66
mov esi, eax
pop ecx
pop ecx
cmp esi, 0xffffff96
je 0x410a8e
test esi, esi
js 0x410a5d
jle 0x410a51
push ebx
lea eax, [ebp - 0x654]
push eax
push esi
push dword [edi + 0x240]
push dword [ebp - 0x650]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x410a64
cmp byte [ebp - 0x649], bl
jne 0x410a6b
test esi, esi
jne 0x410a0a
mov ebx, 0x5000000
jmp 0x410a93
mov ebx, 0x400
jmp 0x410a93
lea eax, [ebp - 0x428]
push eax
lea eax, [ebp - 0x438]
push eax
lea eax, [ebp - 0x430]
push eax
push dword [ebp - 0x650]
call dword [sym.imp.KERNEL32.dll_SetFileTime]
jmp 0x410a93
mov ebx, 0x1000
push dword [ebp - 0x650]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [edi]
call fcn.00410087
mov eax, ebx
jmp 0x41084f
call fcn.0041a2d3
int3