Function at 0x41b2a0
Capabilities:
Write file on windows

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
mov ebx, ecx
mov eax, ebp
push esi
cdq
idiv dword [ebx + 0x13c]
mov ecx, dword [ebx + 0x138]
push edi
xor edi, edi
mov eax, edx
cdq
xor eax, edx
sub eax, edx
mov eax, dword [ecx + eax*4]
cmp eax, edi
je 0x41b414
cmp ebp, dword [eax]
je 0x41b2dd
mov eax, dword [eax + 0x14]
cmp eax, edi
jne 0x41b2cd
jmp 0x41b414
mov cx, word [eax + 0x10]
cmp cx, di
je 0x41b3aa
dec ecx
cmp cx, di
mov word [eax + 0x10], cx
jne 0x41b3aa
mov eax, dword [ebx + 0x168]
mov ecx, dword [ebx + 0x164]
cmp ecx, eax
jne 0x41b367
lea edx, [eax*8]
mov eax, dword [ebx + 0x160]
push edx
push eax
call dword [sym.imp.MSVCRT.dll_realloc]
mov ecx, dword [ebx + 0x16c]
mov edx, dword [ebx + 0x170]
add esp, 8
cmp ecx, edx
mov dword [ebx + 0x160], eax
jg 0x41b359
mov edx, dword [ebx + 0x168]
mov esi, eax
lea edi, [eax + edx*4]
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebx + 0x168]
mov ecx, dword [ebx + 0x16c]
add ecx, eax
xor edi, edi
mov dword [ebx + 0x16c], ecx
mov ecx, dword [ebx + 0x168]
shl ecx, 1
mov dword [ebx + 0x168], ecx
mov eax, dword [ebx + 0x164]
mov edx, dword [ebx + 0x16c]
inc eax
mov dword [ebx + 0x164], eax
mov eax, dword [ebx + 0x160]
mov dword [eax + edx*4], ebp
mov esi, dword [ebx + 0x16c]
mov eax, dword [ebx + 0x168]
inc esi
mov ecx, esi
mov dword [ebx + 0x16c], esi
cmp ecx, eax
jne 0x41b3aa
cmp dword [ebx + 0x164], eax
jge 0x41b3aa
mov dword [ebx + 0x16c], edi
cmp dword [esp + 0x18], edi
je 0x41b414
mov eax, ebp
mov ecx, dword [ebx + 0x138]
cdq
idiv dword [ebx + 0x13c]
mov eax, edx
cdq
xor eax, edx
sub eax, edx
mov esi, dword [ecx + eax*4]
cmp esi, edi
je 0x41b414
cmp ebp, dword [esi]
je 0x41b3da
mov esi, dword [esi + 0x14]
cmp esi, edi
jne 0x41b3cd
jmp 0x41b414
test byte [ebx + 0x120], 1
jne 0x41b414
mov edx, dword [esi + 0xc]
mov eax, dword [ebx + 0x10c]
push edi
push edi
push edx
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov edx, dword [esi + 8]
mov eax, dword [esi + 4]
lea ecx, [esp + 0x14]
push edi
add edx, 0x20
push ecx
mov ecx, dword [ebx + 0x10c]
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [ebx + 0x12c]
mov eax, dword [ebx + 0x128]
cmp edx, eax
jle 0x41b56e
mov eax, dword [ebx + 0x164]
or ebp, 0xffffffff
cmp eax, edi
je 0x41b56e
mov edx, dword [ebx + 0x168]
mov eax, dword [ebx + 0x16c]
cmp eax, edx
jne 0x41b44f
mov dword [ebx + 0x16c], edi
mov eax, dword [ebx + 0x164]
dec eax
mov dword [ebx + 0x164], eax
mov eax, dword [ebx + 0x170]
lea ecx, [eax + 1]
cmp ecx, edx
mov dword [ebx + 0x170], ecx
jne 0x41b475
mov dword [ebx + 0x170], edi
mov ecx, dword [ebx + 0x160]
mov esi, dword [ecx + eax*4]
mov eax, esi
cdq
idiv dword [ebx + 0x13c]
mov eax, edx
cdq
xor eax, edx
sub eax, edx
mov edx, dword [ebx + 0x138]
mov eax, dword [edx + eax*4]
cmp eax, edi
je 0x41b55a
cmp esi, dword [eax]
je 0x41b4af
mov eax, dword [eax + 0x14]
cmp eax, edi
jne 0x41b49f
jmp 0x41b55a
cmp word [eax + 0x10], di
jne 0x41b55a
mov ecx, dword [eax + 8]
mov edx, dword [ebx + 0x12c]
sub edx, ecx
mov dword [ebx + 0x12c], edx
mov edx, dword [eax + 4]
push edx
call fcn.0041e706
mov eax, esi
mov ecx, dword [ebx + 0x138]
cdq
idiv dword [ebx + 0x13c]
add esp, 4
mov eax, edx
cdq
xor eax, edx
sub eax, edx
mov ecx, dword [ecx + eax*4]
cmp ecx, edi
je 0x41b55a
mov dword [ebx + 0x148], ebp
mov dword [ebx + 0x14c], ebp
lea ebp, [ebx + 0x150]
xor edx, edx
mov dword [ebp], edx
mov dword [ebp + 4], edx
mov dword [ebp + 8], edx
mov dword [ebp + 0xc], edx
mov edx, dword [ecx]
cmp edx, esi
jne 0x41b528
mov edx, dword [ebx + 0x138]
mov esi, dword [ecx + 0x14]
push ecx
mov dword [edx + eax*4], esi
jmp 0x41b545
mov eax, dword [ecx + 0x14]
cmp eax, edi
je 0x41b55a
cmp dword [eax], esi
je 0x41b53e
mov ecx, eax
mov eax, dword [eax + 0x14]
cmp eax, edi
jne 0x41b52f
jmp 0x41b55a
mov edx, dword [eax + 0x14]
push eax
mov dword [ecx + 0x14], edx
call fcn.0041e706
mov eax, dword [ebx + 0x140]
add esp, 4
dec eax
mov dword [ebx + 0x140], eax
mov eax, dword [ebx + 0x12c]
mov ecx, dword [ebx + 0x128]
cmp eax, ecx
jg 0x41b428
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 8