Function at 0x491ad0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x4340
call fcn.004959d0
mov eax, dword [0x4f3958]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, ecx
cmp eax, 3
je 0x491b21
cmp eax, 2
je 0x491bde
cmp eax, 1
je 0x491bde
pop edi
pop esi
mov eax, 0x10000
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004951ca
mov esp, ebp
pop ebp
ret 0x10
mov eax, dword [ebx + 4]
mov esi, dword [ebp + 8]
cmp esi, eax
je 0x491b80
cmp eax, 0xffffffff
je 0x491b3b
mov eax, dword [ebx]
push eax
call fcn.0048fad0
add esp, 4
mov eax, dword [ebx]
mov dword [ebx + 4], 0xffffffff
cmp esi, dword [eax + 4]
jge 0x491b09
cmp esi, dword [eax + 0x10]
jge 0x491b57
push eax
call fcn.0048f830
add esp, 4
mov ecx, dword [ebx]
cmp dword [ecx + 0x10], esi
jge 0x491b72
mov edi, edi
mov edx, dword [ebx]
push edx
call fcn.0048f880
mov eax, dword [ebx]
add esp, 4
cmp dword [eax + 0x10], esi
jl 0x491b60
mov ecx, dword [ebx]
push ecx
call fcn.004911d0
add esp, 4
mov dword [ebx + 4], esi
mov edx, dword [ebp + 0x10]
mov eax, dword [ebx]
push edx
push edi
push eax
call fcn.004912e0
mov esi, eax
add esp, 0xc
test esi, esi
jle 0x491bae
pop edi
pop esi
mov eax, 0x600
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004951ca
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [ebx]
push ecx
call fcn.0048fad0
add esp, 4
mov eax, esi
neg eax
pop edi
sbb eax, eax
pop esi
mov dword [ebx + 4], 0xffffffff
and eax, 0x5000000
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004951ca
mov esp, ebp
pop ebp
ret 0x10
or esi, 0xffffffff
cmp dword [ebx + 4], esi
je 0x491bf1
mov edx, dword [ebx]
push edx
call fcn.0048fad0
add esp, 4
mov eax, dword [ebx]
mov dword [ebx + 4], esi
mov esi, dword [ebp + 8]
cmp esi, dword [eax + 4]
jge 0x491b09
cmp esi, dword [eax + 0x10]
jge 0x491c10
push eax
call fcn.0048f830
add esp, 4
mov eax, dword [ebx]
cmp dword [eax + 0x10], esi
jge 0x491c29
mov ecx, dword [ebx]
push ecx
call fcn.0048f880
mov edx, dword [ebx]
add esp, 4
cmp dword [edx + 0x10], esi
jl 0x491c17
lea eax, [ebp - 0x4338]
push eax
push esi
mov ecx, ebx
call fcn.00491530
test byte [ebp - 0x4230], 0x10
je 0x491c85
cmp dword [ebp + 0x14], 1
je 0x491c70
lea ecx, [ebp - 0x4334]
push ecx
mov esi, 0x103
lea edi, [ebp - 0x20c]
call fcn.0048ef70
mov edx, edi
push edx
add ebx, 0x138
push ebx
call fcn.00491a00
add esp, 0xc
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004951ca
mov esp, ebp
pop ebp
ret 0x10
cmp dword [ebp + 0x14], 1
mov esi, edi
je 0x491d7d
movzx eax, word [edi]
mov ecx, edi
test ax, ax
je 0x491d60
movzx eax, ax
cmp ax, 0x2f
je 0x491cae
cmp ax, 0x5c
jne 0x491cb1
lea esi, [ecx + 2]
movzx eax, word [ecx + 2]
add ecx, 2
test ax, ax
jne 0x491ca2
cmp esi, edi
je 0x491d60
push edi
push 0x208
lea eax, [ebp - 0x20c]
push eax
call fcn.0040a360
sub esi, edi
sar esi, 1
xor ecx, ecx
mov word [ebp + esi*2 - 0x20e], cx
mov ax, word [ebp - 0x20c]
cmp ax, 0x2f
je 0x491d08
cmp ax, 0x5c
je 0x491d08
cmp word [ebp - 0x20a], 0x3a
mov byte [ebp - 0x4339], cl
jne 0x491d0f
mov byte [ebp - 0x4339], 1
lea edx, [ebp - 0x20c]
push 0x4d7814
push edx
call fcn.00495298
mov esi, eax
lea eax, [ebp - 0x20c]
push 0x4cff6c
push eax
call fcn.00495298
add esp, 0x10
test eax, eax
setne cl
test esi, esi
setne dl
or cl, dl
or cl, byte [ebp - 0x4339]
jne 0x491d60
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebx + 0x138]
push ecx
call fcn.00491a00
add esp, 8
mov edx, dword [ebp - 0x4230]
push 0
push edx
push 2
push 0
push 0
push 0x40000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x491d9a
pop edi
pop esi
mov eax, 0x200
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004951ca
mov esp, ebp
pop ebp
ret 0x10
mov eax, dword [ebx]
push eax
call fcn.004911d0
mov edx, dword [ebx]
push 0x4000
lea ecx, [ebp - 0x420c]
push ecx
push edx
mov byte [ebp - 0x4339], 0
call fcn.004912e0
add esp, 0x10
test eax, eax
jl 0x491dff
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
je 0x491e06
push 0
lea ecx, [ebp - 0x4340]
push ecx
push eax
lea edx, [ebp - 0x420c]
push edx
push esi
call edi
test eax, eax
je 0x491dff
mov ecx, dword [ebx]
push 0x4000
lea eax, [ebp - 0x420c]
push eax
push ecx
call fcn.004912e0
add esp, 0xc
test eax, eax
jge 0x491dca
mov byte [ebp - 0x4339], 1
push esi
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 1
jne 0x491e37
cmp byte [ebp - 0x4339], 0
jne 0x491e37
lea edx, [ebp - 0x421c]
push edx
lea eax, [ebp - 0x422c]
push eax
lea ecx, [ebp - 0x4224]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
cmp dword [ebp + 0x14], 1
je 0x491e44
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebx]
push edx
call fcn.0048fad0
movzx eax, byte [ebp - 0x4339]
mov ecx, dword [ebp - 4]
add esp, 4
neg eax
pop edi
sbb eax, eax
pop esi
xor ecx, ebp
and eax, 0x400
pop ebx
call fcn.004951ca
mov esp, ebp
pop ebp
ret 0x10