Function at 0x4197e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x434c
call fcn.00444f60
mov eax, dword [0x496684]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov ebx, ecx
or esi, 0xffffffff
push edi
mov dword [ebp - 0x4348], ebx
mov dword [ebp - 0x4344], eax
cmp dword [ebx + 4], esi
je 0x41981a
mov edi, dword [ebx]
call fcn.00418eb0
mov edi, dword [ebp + 8]
mov dword [ebx + 4], esi
mov esi, dword [ebx]
cmp edi, dword [esi + 4]
jl 0x41983f
mov eax, 0x10000
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042ca72
mov esp, ebp
pop ebp
ret 8
cmp edi, dword [esi + 0x10]
jge 0x419849
call fcn.00418910
mov ecx, dword [ebx]
cmp dword [ecx + 0x10], edi
jge 0x41989d
mov esi, dword [ebx]
test esi, esi
je 0x419896
cmp dword [esi + 0x18], 0
je 0x419896
mov eax, dword [esi + 0x10]
inc eax
cmp eax, dword [esi + 4]
je 0x419896
mov edx, dword [esi + 0x50]
add edx, dword [esi + 0x4c]
mov ecx, dword [esi + 0x48]
push 0
mov dword [esi + 0x10], eax
lea edx, [edx + ecx + 0x2e]
add dword [esi + 0x14], edx
push 0
lea eax, [esi + 0x78]
push eax
lea ecx, [esi + 0x28]
push ecx
mov eax, esi
call fcn.00418510
add esp, 0x10
neg eax
sbb eax, eax
inc eax
mov dword [esi + 0x18], eax
mov edx, dword [ebx]
cmp dword [edx + 0x10], edi
jl 0x419850
push edi
lea edx, [ebp - 0x4340]
mov ecx, ebx
call fcn.00418fc0
test byte [ebp - 0x4238], 0x10
je 0x4198ef
lea eax, [ebp - 0x433c]
push eax
lea esi, [ebp - 0x210]
call fcn.00417e80
mov ecx, esi
add esp, 4
push ecx
lea ecx, [ebx + 0x138]
call fcn.00419710
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042ca72
mov esp, ebp
pop ebp
ret 8
mov edi, dword [ebp - 0x4344]
movzx eax, word [edi]
mov esi, edi
mov ecx, edi
test ax, ax
je 0x4199ca
cmp ax, 0x2f
je 0x419911
cmp ax, 0x5c
jne 0x419914
lea esi, [ecx + 2]
movzx eax, word [ecx + 2]
add ecx, 2
test ax, ax
jne 0x419905
cmp esi, edi
je 0x4199ca
lea edx, [ebp - 0x210]
mov eax, edi
sub edx, edi
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x419932
sub esi, edi
sar esi, 1
xor edx, edx
mov word [ebp + esi*2 - 0x212], dx
mov ax, word [ebp - 0x210]
cmp ax, 0x2f
je 0x419970
cmp ax, 0x5c
je 0x419970
cmp word [ebp - 0x20e], 0x3a
je 0x419970
xor bl, bl
jmp 0x419972
mov bl, 1
lea eax, [ebp - 0x210]
push 0x48ca1c
push eax
call fcn.004310ef
lea ecx, [ebp - 0x210]
push 0x48ca24
push ecx
mov esi, eax
call fcn.004310ef
add esp, 0x10
test eax, eax
setne dl
test esi, esi
setne al
or dl, al
or dl, bl
jne 0x4199c4
lea ecx, [ebp - 0x210]
push ecx
mov ecx, dword [ebp - 0x4348]
add ecx, 0x138
call fcn.00419710
add esp, 4
mov ebx, dword [ebp - 0x4348]
mov edx, dword [ebp - 0x4238]
push 0
push edx
push 2
push 0
push 0
push 0x40000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x419a04
mov eax, 0x200
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042ca72
mov esp, ebp
pop ebp
ret 8
mov ebx, dword [ebx]
call fcn.00418c00
mov edi, dword [ebp - 0x4348]
lea eax, [ebp - 0x4210]
push eax
mov eax, dword [edi]
mov ecx, 0x4000
xor bl, bl
call fcn.00418d10
add esp, 4
test eax, eax
js 0x419a65
je 0x419a67
push 0
lea ecx, [ebp - 0x4344]
push ecx
push eax
lea edx, [ebp - 0x4210]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x419a65
lea eax, [ebp - 0x4210]
push eax
mov eax, dword [edi]
mov ecx, 0x4000
call fcn.00418d10
add esp, 4
test eax, eax
jns 0x419a2d
mov bl, 1
push esi
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 1
jne 0x419a93
test bl, bl
jne 0x419a93
lea ecx, [ebp - 0x4224]
push ecx
lea edx, [ebp - 0x4234]
push edx
lea eax, [ebp - 0x422c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [edi]
call fcn.00418eb0
mov ecx, dword [ebp - 4]
movzx eax, bl
neg eax
pop edi
sbb eax, eax
pop esi
xor ecx, ebp
and eax, 0x400
pop ebx
call fcn.0042ca72
mov esp, ebp
pop ebp
ret 8