Function at 0x410dd4
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28c
push ebx
push esi
push edi
cmp dword [0x462344], 0
jne 0x410dff
push 0x4e3f40
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [0x462344], eax
cmp dword [0x462344], 0
jne 0x410e25
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._r_nCRITICAL_BUF_FAILURE_TK11._d
call fcn.00452380
add esp, 8
jmp 0x411122
xor eax, eax
mov ax, word [0x462324]
test eax, eax
je 0x410e8a
mov dword [0x462350], 0
push 0x46234c
mov eax, dword [0x462344]
push eax
call fcn.0044b485
add esp, 8
mov eax, dword [0x462344]
mov eax, dword [eax + 0x64]
mov dword [0x462348], eax
cmp dword [0x45e03c], 0
je 0x410e85
mov eax, dword [0x462348]
push eax
mov eax, dword [0x46234c]
push eax
push str._r_nFetch_TKA_Offline_s_d_ts_X
call fcn.00452380
add esp, 0xc
jmp 0x411122
lea edi, [ebp - 0x280]
xor eax, eax
mov ecx, 0x20
rep stosd dword es:[edi], eax
mov byte [ebp - 0x280], 0x87
mov byte [ebp - 0x27f], 0x91
mov eax, dword [0x462304]
mov dword [ebp - 0x27c], eax
mov edi, 0x9854e0
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov edx, edi
lea edi, [ebp - 0x274]
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [0x5dfaa0]
mov dword [ebp - 0x230], eax
mov eax, dword [0x462344]
mov byte [eax], 0xff
mov eax, dword [0x462344]
mov byte [eax + 1], 0xee
cmp dword [0x462198], 0
jne 0x410f14
push 0
push 0x462198
call fcn.0042b8a3
add esp, 8
cmp dword [0x462198], 0
je 0x410f68
cmp dword [0x46219c], 0
je 0x410f68
push str._r_nCalling_xMitBuf_TKA_now...
call fcn.00452380
add esp, 4
push 1
lea eax, [ebp - 0x28c]
push eax
push 0x4e3f40
mov eax, dword [0x462344]
push eax
push 0x80
lea eax, [ebp - 0x280]
push eax
push 0xb4bbc0
call fcn.00437f8d
add esp, 0x1c
cmp dword [0x45e03c], 0
je 0x410f93
mov eax, dword [0x462344]
mov eax, dword [eax + 0x10]
push eax
mov eax, dword [0x462344]
mov eax, dword [eax]
push eax
push str._r_n9187:__X___d
call fcn.00452380
add esp, 0xc
mov eax, dword [0x462344]
cmp dword [eax], 0x44443333
jne 0x411122
mov edi, 0x9a3940
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov edx, edi
lea edi, [ebp - 0x200]
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x200]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
lea eax, [ecx - 1]
mov dword [ebp - 0x288], eax
cmp dword [ebp - 0x288], 0
je 0x411122
mov eax, dword [0x462344]
cmp dword [eax + 0x10], 0x4e3f40
jae 0x411122
dec dword [ebp - 0x288]
mov eax, dword [ebp - 0x288]
movsx eax, byte [ebp + eax - 0x200]
cmp eax, 0x5c
je 0x41103d
lea edi, [ebp - 0x200]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
mov ax, word [0x46d328]
mov word [edi - 1], ax
mov edx, str.STLWA_NT.TKA
lea edi, [ebp - 0x200]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov eax, dword [edx]
mov dword [edi], eax
mov eax, dword [edx + 4]
mov dword [edi + 4], eax
mov eax, dword [edx + 8]
mov dword [edi + 8], eax
mov al, byte [edx + 0xc]
mov byte [edi + 0xc], al
push 0
push 0
push 2
push 0
push 1
push 0xc0000000
lea eax, [ebp - 0x200]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x284], eax
cmp dword [0x45e03c], 0
je 0x4110b2
lea eax, [ebp - 0x200]
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._r_n__d__Creating__s
call fcn.00452380
add esp, 0xc
cmp dword [ebp - 0x284], 0xffffffff
je 0x411115
push 0
lea eax, [ebp - 0x288]
push eax
mov eax, dword [0x462344]
mov eax, dword [eax + 0x10]
push eax
mov eax, dword [0x462344]
push eax
mov eax, dword [ebp - 0x284]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [0x462350], 0x68
mov eax, dword [0x462344]
mov eax, dword [eax + 0x10]
mov dword [0x46234c], eax
mov eax, dword [ebp - 0x284]
push eax
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov eax, dword [ebp - 0x284]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x462344]
mov eax, dword [eax + 0x64]
mov dword [0x462348], eax
pop edi
pop esi
pop ebx
leave
ret