Function at 0x40e4a0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x344
mov eax, dword [0x449274]
mov dword [esp + 0x340], eax
mov eax, dword [esp + 0x348]
test eax, eax
jne 0x40e4da
mov eax, 0x10000
mov dword [0x44a1ac], eax
mov ecx, dword [esp + 0x340]
call fcn.0041c871
add esp, 0x344
ret
cmp dword [eax], 1
je 0x40e4fc
mov eax, 0x80000
mov dword [0x44a1ac], eax
mov ecx, dword [esp + 0x340]
call fcn.0041c871
add esp, 0x344
ret
push ebx
push esi
push edi
mov edi, dword [eax + 4]
mov eax, dword [edi + 4]
or ebx, 0xffffffff
cmp eax, ebx
je 0x40e517
mov eax, dword [edi]
push eax
call fcn.0040bc10
add esp, 4
mov eax, dword [edi]
mov esi, dword [esp + 0x358]
mov dword [edi + 4], ebx
cmp esi, dword [eax + 4]
jl 0x40e532
mov eax, 0x10000
jmp 0x40e790
cmp esi, dword [eax + 0x10]
jge 0x40e540
push eax
call fcn.0040b950
add esp, 4
mov ecx, dword [edi]
cmp dword [ecx + 0x10], esi
jge 0x40e55b
mov edx, dword [edi]
push edx
call fcn.0040b9a0
mov eax, dword [edi]
mov ecx, dword [eax + 0x10]
add esp, 4
cmp ecx, esi
jl 0x40e547
lea ecx, [esp + 0x11c]
push ecx
push esi
mov ecx, edi
call fcn.0040bdf0
test byte [esp + 0x224], 0x10
je 0x40e5b9
mov ecx, dword [esp + 0x35c]
mov al, byte [ecx]
cmp al, 0x2f
je 0x40e590
cmp al, 0x5c
je 0x40e590
test al, al
je 0x40e5a2
cmp byte [ecx + 1], 0x3a
jne 0x40e5a2
push ecx
push 0
call fcn.0040c370
add esp, 8
xor eax, eax
jmp 0x40e790
push ecx
add edi, 0x140
push edi
call fcn.0040c370
add esp, 8
xor eax, eax
jmp 0x40e790
mov edx, dword [esp + 0x35c]
mov al, byte [edx]
test al, al
push ebp
mov ebp, edx
mov ecx, edx
je 0x40e5e3
jmp 0x40e5d0
cmp al, 0x2f
je 0x40e5d8
cmp al, 0x5c
jne 0x40e5db
lea ebp, [ecx + 1]
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x40e5d0
lea esi, [esp + 0x1c]
mov eax, edx
sub esi, edx
jmp 0x40e5f0
mov cl, byte [eax]
mov byte [esi + eax], cl
inc eax
test cl, cl
jne 0x40e5f0
cmp ebp, edx
jne 0x40e663
mov byte [esp + 0x1c], cl
push ebp
lea ecx, [esp + 0x20]
push ecx
lea esi, [edi + 0x140]
push esi
lea edx, [esp + 0x258]
push str._s_s_s
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [esp + 0x30]
push eax
push esi
call fcn.0040c370
add esp, 0x1c
mov ecx, dword [esp + 0x228]
push 0
push ecx
push 2
push 0
push 0
push 0x40000000
lea edx, [esp + 0x264]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebp, eax
cmp ebp, ebx
jne 0x40e6b4
mov eax, 0x200
jmp 0x40e78f
mov eax, ebp
sub eax, edx
mov byte [esp + eax + 0x1c], 0
mov al, byte [esp + 0x1c]
cmp al, 0x2f
je 0x40e687
cmp al, 0x5c
je 0x40e687
test al, al
je 0x40e602
cmp byte [esp + 0x1d], 0x3a
jne 0x40e602
push ebp
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x254]
push str._s_s
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [esp + 0x2c]
push eax
push 0
call fcn.0040c370
add esp, 0x18
jmp 0x40e630
mov eax, dword [edi + 0x138]
mov ecx, dword [edi]
push eax
push ecx
call fcn.0040de60
mov eax, dword [edi + 0x13c]
add esp, 8
test eax, eax
jne 0x40e6e3
push 0x4000
call fcn.00429fca
add esp, 4
mov dword [edi + 0x13c], eax
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [esp + 0x14], 0
mov eax, dword [edi + 0x13c]
mov ecx, dword [edi]
lea edx, [esp + 0x13]
push edx
push 0x4000
push eax
push ecx
call fcn.0040dff0
mov esi, eax
add esp, 0x10
cmp esi, 0xffffff96
je 0x40e746
test esi, esi
jl 0x40e73c
jle 0x40e730
mov eax, dword [edi + 0x13c]
push 0
lea edx, [esp + 0x1c]
push edx
push esi
push eax
push ebp
call ebx
test eax, eax
je 0x40e750
mov al, byte [esp + 0x13]
test al, al
jne 0x40e75a
test esi, esi
jne 0x40e6f1
mov dword [esp + 0x14], 0x5000000
jmp 0x40e779
mov dword [esp + 0x14], 0x1000
jmp 0x40e779
mov dword [esp + 0x14], 0x400
jmp 0x40e779
lea ecx, [esp + 0x23c]
push ecx
lea edx, [esp + 0x230]
push edx
lea eax, [esp + 0x23c]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [edi]
push ecx
call fcn.0040bc10
mov eax, dword [esp + 0x18]
add esp, 4
pop ebp
mov ecx, dword [esp + 0x34c]
pop edi
pop esi
pop ebx
mov dword [0x44a1ac], eax
call fcn.0041c871
add esp, 0x344
ret