Function at 0x404d5a
Capabilities:
Write file on windows

Disassembly:
push ebp
sub esp, 0x68
push 0x1c
mov eax, 0x460690
call fcn.00446960
lea ecx, [ebp]
call fcn.00421743
xor ebx, ebx
push 0x47ebb4
lea ecx, [ebp + 0x64]
mov dword [ebp - 4], ebx
call fcn.0040349b
mov eax, dword [ebp + 0x64]
mov byte [ebp - 4], 1
cmp dword [eax - 0xc], ebx
jne 0x404dbd
lea ecx, [eax - 0x10]
call fcn.004010f6
xor esi, esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp]
call fcn.00421873
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add ebp, 0x6c
leave
ret 4
xor edi, edi
inc edi
push edi
lea eax, [ebp + 0x68]
push eax
lea ecx, [ebp + 0x64]
call fcn.004038d8
mov esi, 0x4663f4
push esi
mov ecx, eax
mov byte [ebp - 4], 2
call fcn.0040324d
mov ecx, dword [ebp + 0x68]
test eax, eax
setne byte [ebp + 0x5f]
add ecx, 0xfffffff0
mov byte [ebp - 4], 1
call fcn.004010f6
cmp byte [ebp + 0x5f], 0
je 0x404e02
push esi
lea ecx, [ebp + 0x64]
call fcn.00403b47
push str.VDESK_ABCHINA
lea ecx, [ebp + 0x64]
call fcn.00403b47
push str..CFG
lea ecx, [ebp + 0x64]
call fcn.00403b47
mov esi, dword [ebp + 0x64]
push 0x46642c
lea eax, [ebp + 0x60]
push esi
push eax
mov dword [ebp + 0x60], ebx
call fcn.00448e74
add esp, 0xc
test eax, eax
je 0x404e47
lea ecx, [esi - 0x10]
call fcn.004010f6
mov esi, edi
jmp 0x404d9a
cmp dword [ebp + 0x60], ebx
jne 0x404e54
lea ecx, [esi - 0x10]
jmp 0x404d93
lea ecx, [ebp]
call fcn.0042174f
push str.VDESK_CONFIG
lea ecx, [ebp - 0x28]
call fcn.00403c42
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp]
mov byte [ebp - 4], 3
call fcn.004217f1
push ebx
push edi
lea ecx, [ebp - 0x28]
mov dword [ebp + 0x68], eax
mov byte [ebp - 4], 1
call fcn.004014e8
cmp dword [ebp + 0x68], ebx
jne 0x404e9a
push dword [ebp + 0x60]
call fcn.00448a77
pop ecx
jmp 0x404e4c
cmp dword [ebp + 0x74], ebx
je 0x404ee0
push 0x466428
lea ecx, [ebp + 0x20]
call fcn.00403c42
push str.USE_VDESK
lea ecx, [ebp + 0x3c]
mov byte [ebp - 4], 4
call fcn.00403c42
mov ecx, dword [ebp + 0x68]
lea eax, [ebp + 0x20]
push eax
lea eax, [ebp + 0x3c]
push eax
mov byte [ebp - 4], 5
call fcn.00421568
push ebx
push edi
lea ecx, [ebp + 0x3c]
call fcn.004014e8
lea ecx, [ebp + 0x20]
jmp 0x404f1f
push 0x4663f8
lea ecx, [ebp + 0x3c]
call fcn.00403c42
push str.USE_VDESK
lea ecx, [ebp + 0x20]
mov byte [ebp - 4], 6
call fcn.00403c42
mov ecx, dword [ebp + 0x68]
lea eax, [ebp + 0x3c]
push eax
lea eax, [ebp + 0x20]
push eax
mov byte [ebp - 4], 7
call fcn.00421568
push ebx
push edi
lea ecx, [ebp + 0x20]
call fcn.004014e8
lea ecx, [ebp + 0x3c]
push ebx
push edi
mov byte [ebp - 4], 1
call fcn.004014e8
push ebx
lea ecx, [ebp]
call fcn.0041fe77
mov edi, eax
cmp edi, ebx
je 0x404e8f
push edi
call fcn.00429370
push edi
push ebx
push eax
mov dword [ebp + 0x74], eax
call fcn.00446500
add esp, 0x10
push dword [ebp + 0x74]
lea ecx, [ebp]
call fcn.0041fe77
mov eax, edi
cdq
and edx, 7
add eax, edx
sar eax, 3
lea esi, [eax*8 + 8]
push esi
call fcn.00429370
push esi
mov ebx, eax
push 0
push ebx
mov dword [ebp + 0x58], ebx
call fcn.00446500
push edi
push dword [ebp + 0x74]
push esi
push ebx
call fcn.0044604f
add esp, 0x20
push esi
push edi
push 8
lea eax, [ebx + edi]
push eax
call fcn.00410b9f
test al, al
jne 0x404fd1
push ebx
call fcn.00429365
xor esi, esi
cmp dword [ebp + 0x74], esi
pop ecx
je 0x404fb8
push dword [ebp + 0x74]
call fcn.00429365
pop ecx
push dword [ebp + 0x60]
call fcn.00448a77
pop ecx
mov ecx, dword [ebp + 0x64]
add ecx, 0xfffffff0
call fcn.004010f6
jmp 0x404d9a
push esi
call fcn.00429370
push esi
xor edi, edi
push edi
push eax
mov dword [ebp + 0x68], eax
call fcn.00446500
add esp, 0x10
mov ebx, 0x100
lea eax, [ebx + edi]
cmp eax, esi
jle 0x404ff7
mov ebx, esi
sub ebx, edi
mov eax, dword [ebp + 0x58]
push str.EnterSafe_2010Feitian__0
add eax, edi
push ebx
push eax
mov eax, dword [ebp + 0x68]
add eax, edi
push eax
call fcn.004108bb
add edi, ebx
cmp ebx, 0x100
jge 0x404fec
push dword [ebp + 0x60]
push esi
xor esi, esi
inc esi
push esi
push dword [ebp + 0x68]
call fcn.0044905d
push dword [ebp + 0x68]
call fcn.00429365
add esp, 0x14
cmp dword [ebp + 0x74], 0
jmp 0x404fad