Function at 0x404320
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x19c
mov eax, dword [0x431008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x147]
push esi
push edi
push 0x9c
push 0
push eax
mov edi, ecx
mov byte [ebp - 0x195], 1
mov word [ebp - 0x194], 0x908
call fcn.0040eec0
mov ax, word [ebp - 0x194]
add esp, 0xc
mov word [ebp - 0x147], ax
mov eax, dword [ebx + 0x114]
mov dword [ebp - 0x14c], 0xff00
mov byte [ebp - 0x148], 2
cmp eax, 0xffffffff
je 0x4043a7
push 0
lea ecx, [ebp - 0x190]
push ecx
push 0xa1
lea ecx, [ebp - 0x14c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0xa1
lea eax, [ebp - 0xa8]
push 0
push eax
call fcn.0040eec0
movzx eax, word [ebx + 0x124]
add esp, 0xc
cmp dword [ebx + 0x110], 0xffffffff
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
mov dword [ebp - 0x190], eax
je 0x4045ee
push eax
lea eax, [ebp - 0xa8]
push eax
push dword [ebx + 0x10c]
call dword [sym.imp.HID.DLL_HidD_GetFeature]
movzx eax, al
test eax, eax
je 0x4045ee
cmp dword [ebp - 0x190], 0
jbe 0x4045ee
mov eax, dword [edi]
mov ecx, 0x102
mov dword [ebp - 0x190], 0x301
mov edx, 0xc216
mov dword [ebp - 0x194], 0x209
mov eax, dword [eax]
cmp dword [eax + 0x348], 1
cmove ecx, dword [ebp - 0x190]
cmp byte [ebp - 0xa3], 0xff
movzx eax, cx
mov dword [ebp - 0x19c], eax
mov dword [ebp - 0x190], edx
je 0x40447f
movzx eax, word [ebp - 0xa0]
movzx edx, word [ebp - 0xa2]
mov dword [ebp - 0x19c], eax
movzx eax, word [ebp - 0x92]
mov dword [ebp - 0x190], eax
movzx eax, word [ebp - 0x90]
mov dword [ebp - 0x194], eax
mov al, byte [ebp - 0x9e]
mov byte [ebp - 0x195], al
movzx eax, dx
push eax
push str._04X
lea eax, [ebp - 0xa8]
push 0xa1
push eax
call fcn.00401b10
add esp, 0x10
lea eax, [ebp - 0xa8]
push eax
mov eax, dword [edi]
push 0
push 0xc
mov eax, dword [eax]
push dword [eax + 0x68]
call esi
mov ecx, dword [ebp - 0x19c]
movzx eax, cx
push eax
push str._04X
lea eax, [ebp - 0xa8]
push 0xa1
push eax
call fcn.00401b10
add esp, 0x10
lea eax, [ebp - 0xa8]
push eax
mov eax, dword [edi]
push 0
push 0xc
mov eax, dword [eax]
push dword [eax + 0x6c]
call esi
mov eax, dword [ebp - 0x190]
movzx esi, ax
lea eax, [ebp - 0xa8]
push esi
push str._04X
push 0xa1
push eax
call fcn.00401b10
add esp, 0x10
lea eax, [ebp - 0xa8]
push eax
mov eax, dword [edi]
push 0
push 0xc
mov eax, dword [eax]
push dword [eax + 0x78]
call dword [sym.imp.USER32.dll_SendMessageA]
movzx eax, word [ebp - 0x194]
push eax
push str._04X
lea eax, [ebp - 0xa8]
push 0xa1
push eax
call fcn.00401b10
add esp, 0x10
lea eax, [ebp - 0xa8]
push eax
mov eax, dword [edi]
push 0
push 0xc
mov eax, dword [eax]
push dword [eax + 0x7c]
call dword [sym.imp.USER32.dll_SendMessageA]
push esi
push str._04X
lea eax, [ebp - 0xa8]
push 0xa1
push eax
call fcn.00401b10
add esp, 0x10
lea eax, [ebp - 0xa8]
push eax
mov eax, dword [edi]
push 0
push 0xc
mov eax, dword [eax]
push dword [eax + 0x88]
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
call esi
mov cl, byte [ebp - 0x194]
mov al, byte [ebp - 0x193]
mov byte [ebp - 0x194], al
mov byte [ebp - 0x193], cl
movzx eax, word [ebp - 0x194]
push eax
push str._04X
lea eax, [ebp - 0xa8]
push 0xa1
push eax
call fcn.00401b10
add esp, 0x10
lea eax, [ebp - 0xa8]
push eax
mov eax, dword [edi]
push 0
push 0xc
mov eax, dword [eax]
push dword [eax + 0x8c]
call esi
push 0xa1
lea eax, [ebp - 0xa8]
push 0
push eax
call fcn.0040eec0
push 0x9b
lea eax, [ebp - 0x146]
push 0
push eax
call fcn.0040eec0
mov eax, dword [ebx + 0x114]
add esp, 0x18
mov dword [ebp - 0x14c], 0xab00
mov word [ebp - 0x148], 0x9101
cmp eax, 0xffffffff
je 0x404651
push 0
lea ecx, [ebp - 0x190]
push ecx
push 0xa1
lea ecx, [ebp - 0x14c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0xa1
call fcn.0040d8dd
push 0xa1
push 0
push eax
mov dword [ebp - 0x194], eax
call fcn.0040eec0
movzx eax, word [ebx + 0x124]
add esp, 0x10
cmp dword [ebx + 0x110], 0xffffffff
mov dword [ebp - 0x190], eax
je 0x4046c8
push eax
push dword [ebp - 0x194]
push dword [ebx + 0x10c]
call dword [sym.imp.HID.DLL_HidD_GetFeature]
movzx eax, al
test eax, eax
je 0x4046c8
mov ecx, dword [ebp - 0x194]
movsx eax, byte [ecx + 4]
sub eax, 2
push eax
mov dword [ebp - 0x190], eax
lea eax, [ecx + 5]
push eax
lea eax, [ebp - 0xa8]
push eax
call fcn.00410be0
add esp, 0xc
push dword [ebp - 0x194]
call fcn.0040d5dd
add esp, 4
cmp dword [ebp - 0x190], 0
jbe 0x404745
push 0x40
lea eax, [ebp - 0x18c]
push 0
push eax
call fcn.0040eec0
lea ecx, [ebp - 0xa8]
add esp, 0xc
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x404700
push 0
sub ecx, edx
sar ecx, 1
push 0
lea eax, [ecx + ecx]
push eax
lea eax, [ebp - 0x18c]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0xa8]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea eax, [ebp - 0x18c]
push eax
mov eax, dword [edi]
push 0
push 0xc
mov eax, dword [eax]
push dword [eax + 0x70]
call esi
push 0xa1
lea eax, [ebp - 0xa8]
push 0
push eax
call fcn.0040eec0
push 0x9b
lea eax, [ebp - 0x146]
push 0
push eax
call fcn.0040eec0
mov eax, dword [ebx + 0x114]
add esp, 0x18
mov dword [ebp - 0x14c], 0xab00
mov word [ebp - 0x148], 0xa101
cmp eax, 0xffffffff
je 0x4047a8
push 0
lea ecx, [ebp - 0x190]
push ecx
push 0xa1
lea ecx, [ebp - 0x14c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0xa1
call fcn.0040d8dd
push 0xa1
push 0
push eax
mov dword [ebp - 0x194], eax
call fcn.0040eec0
movzx eax, word [ebx + 0x124]
add esp, 0x10
cmp dword [ebx + 0x110], 0xffffffff
mov dword [ebp - 0x190], eax
je 0x40481f
push eax
push dword [ebp - 0x194]
push dword [ebx + 0x10c]
call dword [sym.imp.HID.DLL_HidD_GetFeature]
movzx eax, al
test eax, eax
je 0x40481f
mov ecx, dword [ebp - 0x194]
movsx eax, byte [ecx + 4]
sub eax, 2
push eax
mov dword [ebp - 0x190], eax
lea eax, [ecx + 5]
push eax
lea eax, [ebp - 0xa8]
push eax
call fcn.00410be0
add esp, 0xc
push dword [ebp - 0x194]
call fcn.0040d5dd
add esp, 4
cmp dword [ebp - 0x190], 0
jbe 0x40489a
push 0x40
lea eax, [ebp - 0x18c]
push 0
push eax
call fcn.0040eec0
lea ecx, [ebp - 0xa8]
add esp, 0xc
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x404852
push 0
sub ecx, edx
sar ecx, 1
push 0
lea eax, [ecx + ecx]
push eax
lea eax, [ebp - 0x18c]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0xa8]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea eax, [ebp - 0x18c]
push eax
mov eax, dword [edi]
push 0
push 0xc
mov eax, dword [eax]
push dword [eax + 0x80]
call esi
push 0xa1
lea eax, [ebp - 0xa8]
push 0
push eax
call fcn.0040eec0
push 0x9b
lea eax, [ebp - 0x146]
push 0
push eax
call fcn.0040eec0
mov eax, dword [ebx + 0x114]
add esp, 0x18
mov dword [ebp - 0x14c], 0xab00
mov word [ebp - 0x148], 0xb101
cmp eax, 0xffffffff
je 0x4048fd
push 0
lea ecx, [ebp - 0x190]
push ecx
push 0xa1
lea ecx, [ebp - 0x14c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0xa1
call fcn.0040d8dd
push 0xa1
push 0
push eax
mov dword [ebp - 0x194], eax
call fcn.0040eec0
movzx eax, word [ebx + 0x124]
add esp, 0x10
cmp dword [ebx + 0x110], 0xffffffff
mov dword [ebp - 0x190], eax
je 0x404974
push eax
push dword [ebp - 0x194]
push dword [ebx + 0x10c]
call dword [sym.imp.HID.DLL_HidD_GetFeature]
movzx eax, al
test eax, eax
je 0x404974
mov ecx, dword [ebp - 0x194]
movsx eax, byte [ecx + 4]
sub eax, 2
push eax
mov dword [ebp - 0x190], eax
lea eax, [ecx + 5]
push eax
lea eax, [ebp - 0xa8]
push eax
call fcn.00410be0
add esp, 0xc
push dword [ebp - 0x194]
call fcn.0040d5dd
add esp, 4
cmp dword [ebp - 0x190], 0
jbe 0x4049ef
push 0x40
lea eax, [ebp - 0x18c]
push 0
push eax
call fcn.0040eec0
lea ecx, [ebp - 0xa8]
add esp, 0xc
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4049a7
push 0
sub ecx, edx
sar ecx, 1
push 0
lea eax, [ecx + ecx]
push eax
lea eax, [ebp - 0x18c]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0xa8]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea eax, [ebp - 0x18c]
push eax
mov eax, dword [edi]
push 0
push 0xc
mov eax, dword [eax]
push dword [eax + 0x90]
call esi
push 0xa1
lea eax, [ebp - 0xa8]
push 0
push eax
call fcn.0040eec0
mov eax, dword [edi]
add esp, 0xc
mov ebx, dword [eax]
mov eax, dword [ebx + 0x348]
cmp eax, 1
jne 0x404a1b
mov edx, 0x42ced8
jmp 0x404a37
cmp eax, 2
jne 0x404a27
mov edx, 0x42cee0
jmp 0x404a37
cmp eax, 3
mov edx, 0x42cee8
mov ecx, 0x42cbf5
cmovne edx, ecx
push dword [ebx + 0x350]
mov ecx, dword [ebx + 0x34c]
mov eax, 0x42ce84
cmp byte [ebp - 0x195], 0xff
mov ebx, 0x42ce94
cmovne eax, ebx
test cl, 2
push eax
mov eax, 0x42cea4
mov ebx, 0x42ceb0
cmove eax, ebx
test cl, 1
push eax
mov ecx, 0x42cec8
mov eax, 0x42cebc
cmove eax, ecx
push eax
push edx
push str._s___s___s___s_
lea eax, [ebp - 0xa8]
push 0xa1
push eax
call fcn.00401b10
add esp, 0x20
lea eax, [ebp - 0xa8]
push eax
mov eax, dword [edi]
push 0
push 0xc
mov eax, dword [eax]
push dword [eax + 0x98]
call esi
mov eax, dword [edi]
mov eax, dword [eax]
push dword [eax + 0x350]
lea eax, [ebp - 0xa8]
push 0x42cf08
push 0xa1
push eax
call fcn.00401b10
add esp, 0x10
lea eax, [ebp - 0xa8]
push eax
mov eax, dword [edi]
push 0
push 0xc
mov eax, dword [eax]
push dword [eax + 0xa4]
call esi
mov eax, dword [edi]
mov ebx, dword [sym.imp.USER32.dll_EnableWindow]
push 1
mov eax, dword [eax]
push dword [eax + 0x2d4]
call ebx
mov eax, dword [edi]
push 1
mov eax, dword [eax]
push dword [eax + 0x2d8]
call ebx
mov eax, dword [edi]
push 1
mov eax, dword [eax]
push dword [eax + 0x2dc]
call ebx
mov eax, dword [edi]
push 1
mov eax, dword [eax]
push dword [eax + 0x2e0]
call ebx
mov eax, dword [edi]
push 1
mov eax, dword [eax]
push dword [eax + 0x2ec]
call ebx
mov eax, dword [edi]
push 1
mov eax, dword [eax]
push dword [eax + 0x2f0]
call ebx
push 0
mov eax, dword [edi]
mov eax, dword [eax]
push dword [eax + 0x30c]
call ebx
mov eax, dword [edi]
push 0
mov eax, dword [eax]
push dword [eax + 0x318]
call ebx
mov eax, dword [edi]
push 0
mov eax, dword [eax]
push dword [eax + 0x324]
call ebx
mov eax, dword [edi]
push 0
mov eax, dword [eax]
push dword [eax + 0x310]
call ebx
mov eax, dword [edi]
push 0
mov eax, dword [eax]
push dword [eax + 0x31c]
call ebx
mov eax, dword [edi]
push 0
mov eax, dword [eax]
push dword [eax + 0x328]
call ebx
mov eax, dword [edi]
push 1
mov eax, dword [eax]
push dword [eax + 0x320]
call ebx
mov eax, dword [edi]
push 1
mov eax, dword [eax]
push dword [eax + 0x32c]
call ebx
mov eax, dword [edi]
mov ecx, dword [eax]
mov eax, dword [ecx + 0x348]
cmp eax, 2
jne 0x404c46
push 0x42cbf5
push 0
push 0xc
push dword [ecx + 0x88]
call esi
mov eax, dword [edi]
push 0x42cbf5
push 0
push 0xc
mov eax, dword [eax]
push dword [eax + 0x8c]
call esi
mov eax, dword [edi]
push 0x42cbf5
push 0
push 0xc
mov eax, dword [eax]
push dword [eax + 0x90]
call esi
mov eax, dword [edi]
push 0
mov eax, dword [eax]
push dword [eax + 0x2dc]
call ebx
mov eax, dword [edi]
push 0
mov eax, dword [eax]
push dword [eax + 0x2e0]
call ebx
mov eax, dword [edi]
push 0
mov eax, dword [eax]
push dword [eax + 0x2f0]
call ebx
mov eax, dword [edi]
push 0
mov eax, dword [eax]
push dword [eax + 0x324]
call ebx
mov eax, dword [edi]
push 0
mov eax, dword [eax]
push dword [eax + 0x328]
jmp 0x404d5b
cmp eax, 1
jne 0x404d6b
push 0x42cbf5
push 0
push 0xc
push dword [ecx + 0x78]
call esi
mov eax, dword [edi]
push 0x42cbf5
push 0
push 0xc
mov eax, dword [eax]
push dword [eax + 0x7c]
call esi
mov eax, dword [edi]
push 0x42cbf5
push 0
push 0xc
mov eax, dword [eax]
push dword [eax + 0x80]
call esi
mov eax, dword [edi]
push 0x42cbf5
push 0
push 0xc
mov eax, dword [eax]
push dword [eax + 0x88]
call esi
mov eax, dword [edi]
push 0x42cbf5
push 0
push 0xc
mov eax, dword [eax]
push dword [eax + 0x8c]
call esi
mov eax, dword [edi]
push 0x42cbf5
push 0
push 0xc
mov eax, dword [eax]
push dword [eax + 0x90]
call esi
mov eax, dword [edi]
push 0
mov eax, dword [eax]
push dword [eax + 0x2d4]
call ebx
mov eax, dword [edi]
push 0
mov eax, dword [eax]
push dword [eax + 0x2d8]
call ebx
mov eax, dword [edi]
push 0
mov eax, dword [eax]
push dword [eax + 0x2dc]
call ebx
mov eax, dword [edi]
push 0
mov eax, dword [eax]
push dword [eax + 0x2e0]
call ebx
mov eax, dword [edi]
push 0
mov eax, dword [eax]
push dword [eax + 0x2ec]
call ebx
mov eax, dword [edi]
push 0
mov eax, dword [eax]
push dword [eax + 0x2f0]
call ebx
mov eax, dword [edi]
push 0
mov eax, dword [eax]
push dword [eax + 0x318]
call ebx
mov eax, dword [edi]
push 0
mov eax, dword [eax]
push dword [eax + 0x324]
call ebx
push 0
mov eax, dword [edi]
mov eax, dword [eax]
push dword [eax + 0x31c]
call ebx
mov eax, dword [edi]
push 0
mov eax, dword [eax]
push dword [eax + 0x328]
call ebx
mov eax, dword [edi]
push 0
mov eax, dword [eax]
push dword [eax + 0x320]
call ebx
mov eax, dword [edi]
push 0
mov eax, dword [eax]
push dword [eax + 0x32c]
call ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040d5cc
mov esp, ebp
pop ebp
ret 4