Function at 0x41e689
Capabilities:
Write file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x2c
mov dword [esp], 0x7b829d7e
mov ebx, dword [esp + 0x24]
xor ebp, ebp
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp]
cmp eax, 0x11f24230
jg 0x41e6f1
cmp eax, 0xd914716e
jle 0x41e74e
cmp eax, 0xede0b7b0
jg 0x41e7d8
cmp eax, 0xe38d4442
jg 0x41e8d0
cmp eax, 0xd914716f
je 0x41ea0f
cmp eax, 0xe2e8a630
jne 0x41e6a3
mov dword [esp + 0x18], 0
mov dword [esp], 0x7a18dbdd
jmp 0x41e6a3
cmp eax, 0x524f7fc5
jle 0x41e794
cmp eax, 0x79322a21
jg 0x41e820
cmp eax, 0x6d1dd2c9
jg 0x41e8f2
cmp eax, 0x524f7fc6
je 0x41ea6a
cmp eax, 0x630b484b
jne 0x41e6a3
cmp dword [esp + 0x1c], 0
mov eax, 0xc3c216ce
jg 0x41e739
mov eax, 0xa87d953
cmp byte [esp + 0xb], 0
jne 0x41ec7a
mov eax, 0xa87d953
jmp 0x41ec7a
cmp eax, 0x8eaab81c
jle 0x41e846
cmp eax, 0xc3c216cd
jg 0x41e948
cmp eax, 0x8eaab81d
je 0x41ea76
cmp eax, 0xc02aa3de
jne 0x41e6a3
cmp dword [esp + 0xc], 0
mov eax, 0x84554dd1
je 0x41ec7a
mov eax, 0x1b9c2852
jmp 0x41ec7a
cmp eax, 0x1f64fb15
jle 0x41e897
cmp eax, 0x41e179c2
jg 0x41e980
cmp eax, 0x1f64fb16
je 0x41ea8a
cmp eax, 0x375c1a1a
jne 0x41e6a3
shl ebx, 9
mov eax, 0xe38d4443
je 0x41ec7a
mov eax, 0x11f24231
jmp 0x41ec7a
cmp eax, 0x6f32ba3
jg 0x41e9b4
cmp eax, 0xede0b7b1
je 0x41ead6
cmp eax, 0xf884d28d
jne 0x41e6a3
imul ebx, ebx, 0x4b90
add ebx, 0x10c2
mov eax, 0x41e179c3
cmp ebx, 0xf2
jge 0x41ec7a
mov eax, 0xd914716f
jmp 0x41ec7a
cmp eax, 0x7b829d7d
jg 0x41e9d6
cmp eax, 0x79322a22
je 0x41eb06
cmp eax, 0x7a18dbdd
je 0x41eb14
jmp 0x41e6a3
cmp eax, 0x84554dd0
jg 0x41e9f8
cmp eax, 0x83fc6d78
je 0x41eb20
cmp eax, 0x8410c221
jne 0x41e6a3
mov eax, dword [esp + 4]
imul ecx, eax, 0x73
imul ecx, ecx
imul eax, eax, 0x7300
imul edx, ecx, 0x3107
dec edx
or eax, 0x7f
mov dword [esp + 4], eax
mov eax, 0xf884d28d
cmp ecx, edx
jne 0x41e93e
jmp 0x41ec7a
cmp eax, 0x11f24231
je 0x41eb3e
cmp eax, 0x164f71a1
je 0x41eb65
cmp eax, 0x1b9c2852
jne 0x41e6a3
push dword [esp + 0xc]
call fcn.0044fd4c
add esp, 4
mov dword [esp], 0x1f64fb16
jmp 0x41e6a3
cmp eax, 0xe38d4443
je 0x41eb71
cmp eax, 0xe57461c3
jne 0x41e6a3
mov dword [esp], 0x8eaab81d
jmp 0x41e6a3
cmp eax, 0x6d1dd2ca
je 0x41ebc1
cmp eax, 0x719fe0ff
jne 0x41e6a3
lea eax, [ebx + ebx*2]
shl eax, 3
sub eax, ebx
mov ebx, eax
add ebx, 0xfffffbe0
push ebx
push 0x24d0
push 0x6206
push 0x4eaf
call fcn.00418b98
add esp, 0x10
mov eax, 0xede0b7b1
cmp ebx, 0x33
je 0x41ec7a
mov eax, 0xe38d4443
jmp 0x41ec7a
cmp eax, 0xc3c216ce
je 0x41ebec
cmp eax, 0xc790f37e
jne 0x41e6a3
mov eax, dword [esp + 4]
lea eax, [eax + eax*2]
shl eax, 0xd
add eax, 0xffff1540
shr eax, 0xf
mov dword [esp + 4], eax
mov dword [esp], 0x524f7fc6
jmp 0x41e6a3
cmp eax, 0x41e179c3
je 0x41ec2f
cmp eax, 0x444b1400
jne 0x41e6a3
imul eax, dword [esp + 4], 0xc8
add eax, 0xffffff95
shr eax, 0xe
mov dword [esp + 4], eax
mov dword [esp], 0x630b484b
jmp 0x41e6a3
cmp eax, 0x6f32ba4
je 0x41ec59
cmp eax, 0xa87d953
jne 0x41e6a3
mov dword [esp], 0xc02aa3de
jmp 0x41e6a3
cmp eax, 0x7f31619f
je 0x41ec82
cmp eax, 0x7b829d7e
jne 0x41e6a3
mov dword [esp], 0xe2e8a630
jmp 0x41e6a3
cmp eax, 0x8c9a7c36
jne 0x41eca6
mov dword [esp], 0x1b9c2852
jmp 0x41e6a3
shl ebx, 8
add ebx, 0xfffffffb
push 0x34e4
push ebx
push 0x1b15
push 0xa07
call fcn.0041cc3c
add esp, 0x10
push 0x34a0
push 0x8e
push ebx
push 0x2afd
push 0x3f2e
push 0x45dc
push 0xd19
push 0x5fca
push 0x1722
call fcn.00419bd5
add esp, 0x24
mov dword [esp], 0x6f32ba4
jmp 0x41e6a3
mov dword [esp], 0x164f71a1
jmp 0x41e6a3
mov dword [esp + 0x20], 0
mov dword [esp], 0xc790f37e
jmp 0x41e6a3
imul ecx, dword [esp + 4], 0x4305
add ecx, 0x5cb8
mov eax, ecx
imul eax, ecx
shl ecx, 4
and ecx, 0x7ffffff0
imul edx, eax, 0x7d87
dec edx
lea esi, [ecx + ecx*2]
shl esi, 3
sub esi, ecx
add esi, 0x75e
mov dword [esp + 4], esi
mov ecx, 0x630b484b
cmp eax, edx
je 0x41ec27
mov ecx, 0x84554dd1
jmp 0x41ec27
and ebx, 0xfffffff0
shl ebx, 0x19
or ebx, 0xba
push ebx
call fcn.0041be40
add esp, 4
mov eax, 0x7f31619f
cmp ebx, 0xf5
jae 0x41ec7a
mov eax, 0x79322a22
jmp 0x41ec7a
shl ebx, 0xe
add ebx, 0xffee4000
call fcn.0041f66b
mov dword [esp], 0x41e179c3
jmp 0x41e6a3
imul ebx, ebx, 0x8c000
mov eax, 0x41e179c3
cmp ebx, 0x4d
jl 0x41ec7a
mov eax, 0x375c1a1a
jmp 0x41ec7a
imul ebx, ebx, 0x2bcb
add ebx, 0xffffa021
mov eax, 0xe38d4443
cmp ebx, 0xd9
jb 0x41ec7a
mov eax, 0x41e179c3
jmp 0x41ec7a
mov dword [esp], 0x6d1dd2ca
jmp 0x41e6a3
push ebp
push 0x80
push 2
push ebp
push ebp
push 0x40000000
push dword [esp + 0x5c]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
cmp eax, 0xffffffff
setne al
mov ecx, dword [esp + 0x18]
mov dword [esp + 0xc], ecx
cmp dword [esp + 0xc], ebp
setne cl
and cl, al
mov byte [esp + 0xb], cl
mov eax, dword [esp + 0x14]
mov dword [esp + 0x1c], eax
mov dword [esp], 0x444b1400
jmp 0x41e6a3
push 0
lea eax, [esp + 0x24]
push eax
push dword [esp + 0x24]
push dword [esp + 0x18]
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [esp + 0x10]
call edi
mov dword [esp], 0x8c9a7c36
jmp 0x41e6a3
mov eax, dword [esp + 4]
shr eax, 0x10
mov ecx, eax
shl ecx, 8
sub ecx, eax
sub ecx, eax
imul eax, eax
imul edx, eax, 0x2d8d
add ecx, 0xa4
dec edx
shr ecx, 2
add ecx, 0xffffff1a
mov dword [esp + 4], ecx
mov ecx, 0xe2e8a630
cmp eax, edx
je 0x41ec27
mov ecx, 0xe57461c3
mov dword [esp], ecx
jmp 0x41e6a3
mov dword [esp + 0x14], 0
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x1c]
push eax
push dword [esp + 0x48]
call fcn.0041cc97
add esp, 0xc
mov dword [esp], 0x8410c221
jmp 0x41e6a3
imul ebx, ebx, 0xfa0
add ebx, 0xfffff840
mov eax, 0x41e179c3
cmp ebx, 0x5c800
jae 0x41ec77
mov eax, 0xe2e8a630
shr ebx, 0xb
mov dword [esp], eax
jmp 0x41e6a3
shl ebx, 0xf
add ebx, 0x930000
push dword [esp + 0x2c]
push ebx
push 0x16
call fcn.0041974f
add esp, 0xc
mov dword [esp], 0xe38d4443
jmp 0x41e6a3
cmp eax, 0x84554dd1
jne 0x41e6a3
mov dword [esp + 0x24], ebx
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret