Function at 0x41b1a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x634bf8
push 0x547619
mov eax, dword fs:[0]
push eax
sub esp, 0xc5c
mov eax, dword [0x669404]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x20], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov eax, dword [ebp + 8]
mov ebx, ecx
test eax, eax
je 0x41b1e5
mov byte [eax], 0
cmp byte [0x6792bb], 0
jne 0x41b203
push 0x104
push 0x673990
push 0x400000
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0xc3c]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx ecx, word [ebp - 0xc30]
push ecx
movzx edx, word [ebp - 0xc32]
push edx
movzx eax, word [ebp - 0xc34]
push eax
movzx ecx, word [ebp - 0xc36]
push ecx
movzx edx, word [ebp - 0xc3a]
push edx
movzx eax, word [ebp - 0xc3c]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push str.P_d_T_d_D_04ld__02ld__02ld_T_02ld__02ld__02ld
push 0x100
lea ecx, [ebp - 0x63c]
push ecx
mov esi, dword [sym.imp.MSVCR100.dll__snprintf]
call esi
add esp, 0x2c
lea edx, [ebp - 0x63c]
push edx
push 0x673990
push str._sCRASH_REPORT__s.txt
push 0x100
lea eax, [ebp - 0x12c]
push eax
call esi
add esp, 0x14
mov ecx, 2
cmp eax, ecx
jle 0x41b2be
jmp 0x41b2a0
mov dl, byte [ebp + ecx - 0x12c]
cmp dl, 0x2f
je 0x41b2b1
cmp dl, 0x3a
jne 0x41b2b9
mov byte [ebp + ecx - 0x12c], 0x5f
inc ecx
cmp ecx, eax
jl 0x41b2a0
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
lea ecx, [ebp - 0x12c]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
mov dword [ebp - 0xc48], edi
cmp edi, 0xffffffff
je 0x41b5a5
mov edx, dword [ebx]
mov dword [ebp - 0xc40], edx
mov ebx, dword [ebx + 4]
mov dword [ebp - 0xc44], ebx
push 0x208
push 0
lea eax, [ebp - 0x53c]
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
mov esi, 0x615ebc
push 0x1c
lea ecx, [ebp - 0xc68]
push ecx
mov edx, dword [ebx + 0xb8]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x41b380
push 0x206
lea eax, [ebp - 0x53c]
push eax
mov ecx, dword [ebp - 0xc64]
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x41b380
lea eax, [ebp - 0x53c]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x41b357
mov edi, edi
dec eax
lea ecx, [ebp - 0x53c]
cmp eax, ecx
je 0x41b370
cmp byte [eax], 0x5c
jne 0x41b360
cmp byte [eax], 0x5c
jne 0x41b378
inc eax
jmp 0x41b37e
lea eax, [ebp - 0x53c]
mov esi, eax
push 0x208
push 0
lea edx, [ebp - 0x334]
push edx
call sub.MSVCR100.dll_memset
add esp, 0xc
push 0x206
lea eax, [ebp - 0x334]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x41b3c0
push 0x615ebc
lea ecx, [ebp - 0x334]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x334]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x41b3c6
lea ecx, [ecx]
dec eax
lea ecx, [ebp - 0x334]
cmp eax, ecx
je 0x41b3e0
cmp byte [eax], 0x5c
jne 0x41b3d0
cmp byte [eax], 0x5c
jne 0x41b3e8
inc eax
jmp 0x41b3ee
lea eax, [ebp - 0x334]
push eax
lea edx, [ebp - 0x844]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x844]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41b402
lea esp, [esp]
dec eax
lea edx, [ebp - 0x844]
cmp eax, edx
je 0x41b420
cmp byte [eax], 0x2e
jne 0x41b410
cmp byte [eax], 0x2e
jne 0x41b428
mov byte [eax], 0
mov eax, dword [ebp - 0xc40]
mov ecx, dword [eax]
mov edx, dword [ebx + 0xb8]
push edx
mov eax, dword [ebx + 0xbc]
push eax
push esi
push ecx
call fcn.0041ad60
push eax
lea ecx, [ebp - 0x844]
push ecx
push str._s_caused__s__0x_08x___r_nin_module__s_at__04x:_08x._r_n_r_n
push edi
call fcn.0041a080
add esp, 0x20
call fcn.0041ab80
mov ecx, dword [ebp - 0xc40]
cmp dword [ecx], 0xc0000005
jne 0x41b4b0
cmp dword [ecx + 0x10], 2
jb 0x41b4b0
mov eax, str.Read_from
cmp dword [ecx + 0x14], 0
je 0x41b484
mov eax, str.Write_to
mov edx, dword [ecx + 0x18]
push edx
push eax
push str._s_location__08x_caused_an_access_violation._r_n
lea eax, [ebp - 0xc2c]
push eax
call dword [sym.imp.MSVCR100.dll_sprintf]
lea ecx, [ebp - 0xc2c]
push ecx
push 0x616a28
push edi
call fcn.0041a080
add esp, 0x1c
mov esi, ebx
call fcn.0041b100
push str._r_nBytes_at_CS:EIP:_r_n
push edi
call fcn.0041a080
add esp, 8
mov edx, dword [ebx + 0xb8]
mov dword [ebp - 0xc4c], edx
xor ebx, ebx
lea esi, [ebx - 2]
mov dword [ebp - 0xc40], ebx
cmp ebx, 0x10
jge 0x41b535
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0xc4c]
movzx ecx, byte [ebx + eax]
push ecx
push str._02x
push edi
call fcn.0041a080
add esp, 0xc
mov dword [ebp - 4], esi
inc ebx
jmp 0x41b4d6
mov edx, dword [ebp - 0xc44]
mov eax, dword [edx + 0xc4]
push eax
push edi
call fcn.0041af40
push edi
call fcn.0041a4c0
add esp, 0xc
lea ecx, [ebp - 0x12c]
push ecx
push str._r_n__end_of__s___r_n
push edi
call fcn.0041a080
add esp, 0xc
cmp dword [0x6792bc], 0
jle 0x41b59a
push 0
lea edx, [ebp - 0xc44]
push edx
push 0x671990
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push 0x671990
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [0x6792bc], 0
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x41b5aa
mov eax, 0x80004005
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x20]
xor ecx, ebp
call fcn.00546bdc
mov esp, ebp
pop ebp
ret