Function at 0x41cf90
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1f4
mov eax, dword [0x4e5b00]
xor eax, esp
mov dword [esp + 0x1f0], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push pe_nt_image_headers32
mov edi, edx
lea edx, [esp + 0x7c]
push edx
mov dword [esp + 0x28], eax
push 0
lea eax, [esp + 0x34]
push eax
push ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x24], ecx
call fcn.004222a0
mov esi, eax
add esp, 0x14
test esi, esi
jne 0x41d21f
push 0x2000
call fcn.0046110e
add esp, 4
mov dword [esp + 0x18], eax
test eax, eax
jne 0x41d012
lea eax, [esi - 0x68]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1f0]
xor ecx, esp
call fcn.004606fe
mov esp, ebp
pop ebp
ret
mov al, byte [esp + 0x78]
lea ecx, [esp + 0x78]
mov dword [esp + 0x14], ecx
test al, al
je 0x41d042
cmp al, 0x2f
je 0x41d02a
cmp al, 0x5c
jne 0x41d031
lea edx, [ecx + 1]
mov dword [esp + 0x14], edx
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x41d022
mov eax, dword [esp + 0x14]
cmp byte [eax], 0
jne 0x41d05d
mov ecx, dword [ebp + 0xc]
cmp dword [ecx], 0
jne 0x41d210
lea edx, [esp + 0x78]
push edx
call fcn.004b73eb
jmp 0x41d20d
push edi
push ebx
mov dword [esp + 0x24], 0
call fcn.004227b0
mov edi, dword [esp + 0x28]
add esp, 8
cmp dword [edi], 0
mov esi, eax
jne 0x41d111
test esi, esi
jne 0x41d207
mov eax, dword [esp + 0x10]
push 0x4cba04
push eax
call fcn.00461c5e
add esp, 8
test eax, eax
je 0x41d119
push eax
call fcn.00461d3f
add esp, 4
jmp 0x41d0b0
lea ecx, [esp + 0x178]
push ecx
push 0x4d0dd8
call fcn.00464d5e
add esp, 8
cmp eax, 1
jne 0x41d0f2
mov al, byte [esp + 0x178]
cmp al, 0x61
jl 0x41d0db
cmp al, 0x7a
jg 0x41d0db
sub al, 0x20
cmp al, 0x59
je 0x41d0e7
cmp al, 0x4e
je 0x41d0eb
cmp al, 0x41
jne 0x41d0b0
cmp al, 0x4e
jne 0x41d0f9
mov ecx, 1
jmp 0x41d0fd
push 1
call fcn.00461027
mov ecx, dword [esp + 0x1c]
cmp al, 0x41
jne 0x41d107
mov dword [edi], 1
test ecx, ecx
jne 0x41d1fd
jmp 0x41d119
test esi, esi
jne 0x41d207
mov edx, dword [esp + 0x10]
push 0x4cc38c
push edx
call fcn.00461c5e
mov edi, eax
add esp, 8
test edi, edi
jne 0x41d175
mov eax, dword [ebp + 0xc]
cmp dword [eax], edi
jne 0x41d16d
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x78]
cmp eax, ecx
je 0x41d16d
mov bl, byte [eax - 1]
mov edi, dword [esp + 0x10]
mov esi, eax
mov byte [esi - 1], 0
call fcn.0041cec0
push 0x4cc38c
push edi
mov byte [esi - 1], bl
call fcn.00461c5e
mov ebx, dword [esp + 0x2c]
add esp, 8
mov edi, eax
test edi, edi
je 0x41d1fd
mov edx, dword [esp + 0x18]
push edx
push ebx
call fcn.004229c0
mov esi, eax
add esp, 8
test esi, esi
jle 0x41d1a2
mov eax, dword [esp + 0x18]
push edi
push 1
push esi
push eax
call fcn.0046359b
add esp, 0x10
cmp eax, 1
je 0x41d175
or esi, 0xffffffff
test edi, edi
je 0x41d1af
push edi
call fcn.00461d3f
add esp, 4
test esi, esi
jne 0x41d207
mov ecx, dword [esp + 0x60]
mov edx, dword [esp + 0x64]
sub esp, 0x18
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [esp + 0x80]
mov dword [eax + 4], edx
mov edx, dword [esp + 0x84]
mov dword [eax + 8], ecx
mov ecx, dword [esp + 0x88]
mov dword [eax + 0xc], edx
mov edx, dword [esp + 0x8c]
mov dword [eax + 0x10], ecx
mov ecx, dword [esp + 0x50]
mov dword [eax + 0x14], edx
mov eax, dword [esp + 0x28]
call fcn.0041ce50
add esp, 0x18
push ebx
call fcn.00422bf0
mov esi, eax
jmp 0x41d20d
push ebx
call fcn.00422bf0
add esp, 4
mov eax, dword [esp + 0x18]
push eax
call fcn.004611d8
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x1fc]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004606fe
mov esp, ebp
pop ebp
ret