Function at 0x41c3c0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x344
mov eax, dword [0x461660]
mov dword [esp + 0x340], eax
mov eax, dword [esp + 0x348]
test eax, eax
jne 0x41c3fa
mov eax, 0x10000
mov dword [0x4628d8], eax
mov ecx, dword [esp + 0x340]
call fcn.00428f7e
add esp, 0x344
ret
cmp dword [eax], 1
je 0x41c41c
mov eax, 0x80000
mov dword [0x4628d8], eax
mov ecx, dword [esp + 0x340]
call fcn.00428f7e
add esp, 0x344
ret
push ebx
push esi
push edi
mov edi, dword [eax + 4]
mov eax, dword [edi + 4]
or ebx, 0xffffffff
cmp eax, ebx
je 0x41c437
mov eax, dword [edi]
push eax
call fcn.00419bd0
add esp, 4
mov eax, dword [edi]
mov esi, dword [esp + 0x358]
mov dword [edi + 4], ebx
cmp esi, dword [eax + 4]
jl 0x41c452
mov eax, 0x10000
jmp 0x41c6b0
cmp esi, dword [eax + 0x10]
jge 0x41c460
push eax
call fcn.00419910
add esp, 4
mov ecx, dword [edi]
cmp dword [ecx + 0x10], esi
jge 0x41c47b
mov edx, dword [edi]
push edx
call fcn.00419960
mov eax, dword [edi]
mov ecx, dword [eax + 0x10]
add esp, 4
cmp ecx, esi
jl 0x41c467
lea ecx, [esp + 0x11c]
push ecx
push esi
mov ecx, edi
call fcn.00419d50
test byte [esp + 0x224], 0x10
je 0x41c4d9
mov ecx, dword [esp + 0x35c]
mov al, byte [ecx]
cmp al, 0x2f
je 0x41c4b0
cmp al, 0x5c
je 0x41c4b0
test al, al
je 0x41c4c2
cmp byte [ecx + 1], 0x3a
jne 0x41c4c2
push ecx
push 0
call fcn.0041a2d0
add esp, 8
xor eax, eax
jmp 0x41c6b0
push ecx
add edi, 0x140
push edi
call fcn.0041a2d0
add esp, 8
xor eax, eax
jmp 0x41c6b0
mov edx, dword [esp + 0x35c]
mov al, byte [edx]
test al, al
push ebp
mov ebp, edx
mov ecx, edx
je 0x41c503
jmp 0x41c4f0
cmp al, 0x2f
je 0x41c4f8
cmp al, 0x5c
jne 0x41c4fb
lea ebp, [ecx + 1]
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x41c4f0
lea esi, [esp + 0x1c]
mov eax, edx
sub esi, edx
jmp 0x41c510
mov cl, byte [eax]
mov byte [esi + eax], cl
inc eax
test cl, cl
jne 0x41c510
cmp ebp, edx
jne 0x41c583
mov byte [esp + 0x1c], cl
push ebp
lea ecx, [esp + 0x20]
push ecx
lea esi, [edi + 0x140]
push esi
lea edx, [esp + 0x258]
push str._s_s_s
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [esp + 0x30]
push eax
push esi
call fcn.0041a2d0
add esp, 0x1c
mov ecx, dword [esp + 0x228]
push 0
push ecx
push 2
push 0
push 0
push 0x40000000
lea edx, [esp + 0x264]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebp, eax
cmp ebp, ebx
jne 0x41c5d4
mov eax, 0x200
jmp 0x41c6af
mov eax, ebp
sub eax, edx
mov byte [esp + eax + 0x1c], 0
mov al, byte [esp + 0x1c]
cmp al, 0x2f
je 0x41c5a7
cmp al, 0x5c
je 0x41c5a7
test al, al
je 0x41c522
cmp byte [esp + 0x1d], 0x3a
jne 0x41c522
push ebp
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x254]
push str._s_s
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [esp + 0x2c]
push eax
push 0
call fcn.0041a2d0
add esp, 0x18
jmp 0x41c550
mov eax, dword [edi + 0x138]
mov ecx, dword [edi]
push eax
push ecx
call fcn.0041bd80
mov eax, dword [edi + 0x13c]
add esp, 8
test eax, eax
jne 0x41c603
push 0x4000
call fcn.0043b0c7
add esp, 4
mov dword [edi + 0x13c], eax
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [esp + 0x14], 0
mov eax, dword [edi + 0x13c]
mov ecx, dword [edi]
lea edx, [esp + 0x13]
push edx
push 0x4000
push eax
push ecx
call fcn.0041bf10
mov esi, eax
add esp, 0x10
cmp esi, 0xffffff96
je 0x41c666
test esi, esi
jl 0x41c65c
jle 0x41c650
mov eax, dword [edi + 0x13c]
push 0
lea edx, [esp + 0x1c]
push edx
push esi
push eax
push ebp
call ebx
test eax, eax
je 0x41c670
mov al, byte [esp + 0x13]
test al, al
jne 0x41c67a
test esi, esi
jne 0x41c611
mov dword [esp + 0x14], 0x5000000
jmp 0x41c699
mov dword [esp + 0x14], 0x1000
jmp 0x41c699
mov dword [esp + 0x14], 0x400
jmp 0x41c699
lea ecx, [esp + 0x23c]
push ecx
lea edx, [esp + 0x230]
push edx
lea eax, [esp + 0x23c]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [edi]
push ecx
call fcn.00419bd0
mov eax, dword [esp + 0x18]
add esp, 4
pop ebp
mov ecx, dword [esp + 0x34c]
pop edi
pop esi
pop ebx
mov dword [0x4628d8], eax
call fcn.00428f7e
add esp, 0x344
ret