Function at 0x4a4c50
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc0
mov eax, dword [0x5322a8]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, ecx
push esi
push edi
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0xa4], ebx
test ebx, ebx
je 0x4a5372
push 0x80
call fcn.004e4240
push 0x80
mov esi, eax
push 0
push esi
mov dword [ebp - 0xb8], esi
call fcn.004e7d90
mov edi, dword [ebx + 0x34]
mov ecx, dword [ebx + 0x30]
add esp, 0x10
mov edx, esi
call fcn.004a4bd0
test eax, eax
je 0x4a535c
lea ecx, [ebp - 0x9c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push 0x208
mov dword [ebp - 0xac], eax
call fcn.004e4240
push 0x208
mov edi, eax
push 0
push edi
mov dword [ebp - 0xbc], edi
call fcn.004e7d90
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
push 0x53b7d0
push str._sEventLog
push edi
call esi
push edi
call fcn.004e447d
add esp, 0x20
cmp eax, 0xffffffff
jne 0x4a4d18
push edi
call fcn.004e444b
add esp, 4
mov eax, edi
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4a4d20
sub eax, edx
sar eax, 1
push 0x53b9d8
lea edx, [edi + eax*2]
push 0x5238d0
push edx
call esi
push edi
call fcn.004e447d
add esp, 0x10
cmp eax, 0xffffffff
jne 0x4a4d56
push edi
call fcn.004e444b
add esp, 4
mov eax, edi
lea edx, [eax + 2]
jmp 0x4a4d60
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4a4d60
movzx ecx, word [ebp - 0x96]
sub eax, edx
movzx edx, word [ebp - 0x9a]
push ecx
movzx ecx, word [ebp - 0x9c]
push edx
push ecx
sar eax, 1
lea edx, [edi + eax*2]
push str._04u_02u_02u.log
push edx
call esi
add esp, 0x14
push 0x53b1d8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [sym.imp.KERNEL32.dll_CreateFileW]
push 0
push 0x8000080
push 3
push 0
push 3
push 0xc0000000
push edi
mov dword [ebp - 0xa8], 0
call ebx
mov esi, eax
cmp esi, 0xffffffff
jne 0x4a4e28
push 0
push 0x8000080
push 1
push 0
push 3
push 0xc0000000
push edi
call ebx
mov esi, eax
cmp esi, 0xffffffff
jne 0x4a4e06
push 0x53b1d8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0x208
push 0
push edi
call fcn.004e7d90
push edi
jmp 0x4a536a
push 0
lea eax, [ebp - 0xa8]
push eax
push 2
lea ecx, [ebp - 0xb0]
push ecx
push esi
mov word [ebp - 0xb0], 0xfeff
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 2
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0x808
call fcn.004e4240
push 0x808
mov edi, eax
push 0
push edi
call fcn.004e7d90
push 0x80
call fcn.004e4240
push 0x80
mov ebx, eax
push 0
push ebx
mov dword [ebp - 0xb4], ebx
call fcn.004e7d90
mov eax, dword [ebp - 0xa4]
mov eax, dword [eax + 0x30]
mov edx, ebx
call fcn.004a4b90
mov ecx, dword [ebp - 0xa4]
mov edx, dword [ecx + 0x18]
mov eax, dword [ebp - 0xb8]
movzx ecx, word [ebp - 0x8e]
push edx
movzx edx, word [ebp - 0x90]
push eax
movzx eax, word [ebp - 0x92]
push ebx
push ecx
movzx ecx, word [ebp - 0x94]
push edx
mov edx, dword [ebp - 0xa0]
push eax
mov eax, dword [ebp - 0xac]
push ecx
push edx
push eax
push str.__i__t__s__t__02u:_02u:_02u:_03u__t__s__t__s__t__i__t
push edi
call dword [sym.imp.USER32.dll_wsprintfW]
mov eax, edi
add esp, 0x4c
lea ecx, [eax + 2]
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x4a4ed1
sub eax, ecx
push 0
sar eax, 1
lea ecx, [ebp - 0xa8]
push ecx
lea edx, [eax + eax]
push edx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 2
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [ebp - 0xa4]
mov eax, dword [eax + 0x34]
cmp eax, 0x305
je 0x4a4f1d
cmp eax, 0x307
jne 0x4a4fbe
push 0x808
push 0
push edi
call fcn.004e7d90
mov ecx, dword [ebp - 0xb8]
push ecx
push ebx
push str._DispatchExecute__r_nMajorFunction_s_r_nMinorFunction_s_r_n
push edi
call dword [sym.imp.USER32.dll_wsprintfW]
mov edx, dword [ebp - 0xa4]
mov eax, dword [edx + 0x38]
add esp, 0x1c
mov dword [ebp - 0xa0], eax
test eax, eax
je 0x4a4fbe
xor eax, eax
push 0x7e
push eax
lea ecx, [ebp - 0x8a]
push ecx
mov word [ebp - 0x8c], ax
call fcn.004e7d90
mov ebx, dword [ebp - 0xa0]
lea edx, [ebp - 0x8c]
push edx
add ebx, 0x40
call fcn.004bb6e0
mov eax, edi
add esp, 0x10
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4a4f90
sub eax, edx
lea ecx, [ebp - 0x8c]
push ecx
sar eax, 1
lea edx, [edi + eax*2]
push str.SourceIP_s_r_n
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
mov ebx, dword [ebp - 0xb4]
add esp, 0xc
mov eax, dword [ebp - 0xa4]
cmp dword [eax + 0x18], 0
jbe 0x4a52be
mov ebx, dword [eax + 0x20]
test ebx, ebx
je 0x4a52b8
mov eax, dword [eax + 0x34]
cmp eax, 0x304
je 0x4a4ffc
cmp eax, 0x305
je 0x4a5003
cmp eax, 0x307
je 0x4a4ffc
cmp eax, 0x309
jne 0x4a52b8
cmp eax, 0x305
jne 0x4a507e
mov ecx, dword [ebx + 0x14]
add ecx, ebx
mov dword [ebx + 0x20], ecx
lea eax, [edi - 2]
mov edi, edi
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x4a5010
mov edx, dword [str.Cmd]
mov dword [eax], edx
mov ecx, dword [0x5239f0]
mov dword [eax + 4], ecx
mov dx, word [0x5239f4]
mov word [eax + 8], dx
mov edx, dword [ebx + 0x30]
mov eax, dword [ebx + 0x38]
sub eax, edx
mov dword [ebp - 0xa0], eax
cmp eax, 0x100
jb 0x4a5057
mov dword [ebp - 0xa0], pe_nt_image_headers32
mov eax, edi
lea ecx, [eax + 2]
mov dword [ebp - 0xac], ecx
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4a5062
sub eax, dword [ebp - 0xac]
mov ecx, dword [ebp - 0xa0]
jmp 0x4a51b7
cmp eax, 0x307
jne 0x4a51cc
mov eax, dword [ebx + 0x14]
add eax, ebx
mov dword [ebx + 0x20], eax
lea eax, [edi - 2]
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x4a5094
mov ecx, dword [str.NetFile]
mov dword [eax], ecx
mov edx, dword [0x5239fc]
mov dword [eax + 4], edx
mov ecx, dword [0x523a00]
mov dword [eax + 8], ecx
mov edx, dword [0x523a04]
mov dword [eax + 0xc], edx
mov cx, word [0x523a08]
mov word [eax + 0x10], cx
mov edx, dword [ebx + 0x28]
mov eax, dword [ebx + 0x30]
sub eax, edx
mov dword [ebp - 0xa0], eax
cmp eax, 0x100
jb 0x4a50ed
mov dword [ebp - 0xa0], pe_nt_image_headers32
mov eax, edi
lea ecx, [eax + 2]
mov dword [ebp - 0xac], ecx
jmp 0x4a5100
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4a5100
mov ecx, dword [ebp - 0xa0]
sub eax, dword [ebp - 0xac]
push ecx
mov ecx, dword [ebx + 0x20]
add ecx, edx
sar eax, 1
push ecx
lea edx, [edi + eax*2]
push edx
call fcn.004eaf30
add esp, 0xc
lea eax, [edi - 2]
nop
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x4a5130
mov ecx, dword [str._r_nDestFile]
mov dword [eax], ecx
mov edx, dword [0x523a10]
mov dword [eax + 4], edx
mov ecx, dword [0x523a14]
mov dword [eax + 8], ecx
mov edx, dword [0x523a18]
mov dword [eax + 0xc], edx
mov ecx, dword [0x523a1c]
mov dword [eax + 0x10], ecx
mov edx, dword [0x523a20]
mov dword [eax + 0x14], edx
mov edx, dword [ebx + 0x40]
mov eax, dword [ebx + 0x48]
sub eax, edx
mov dword [ebp - 0xa0], eax
cmp eax, 0x100
jb 0x4a5190
mov dword [ebp - 0xa0], pe_nt_image_headers32
mov eax, edi
lea ecx, [eax + 2]
mov dword [ebp - 0xac], ecx
jmp 0x4a51a0
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4a51a0
sub eax, dword [ebp - 0xac]
mov ecx, dword [ebp - 0xa0]
push ecx
mov ecx, dword [ebx + 0x20]
add ecx, edx
sar eax, 1
push ecx
lea edx, [edi + eax*2]
push edx
call fcn.004eaf30
add esp, 0xc
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea eax, [ebp - 0xa8]
push eax
push 2
push 0x520f44
push esi
call ebx
push 2
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea ecx, [ebp - 0xa8]
push ecx
push 6
push 0x523a24
push esi
call ebx
push 2
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov edx, dword [ebp - 0xa4]
mov eax, dword [edx + 0x38]
mov dword [ebp - 0xa0], eax
test eax, eax
je 0x4a529d
xor eax, eax
push 0x7e
push eax
lea ecx, [ebp - 0x8a]
push ecx
mov word [ebp - 0x8c], ax
call fcn.004e7d90
mov ebx, dword [ebp - 0xa0]
lea edx, [ebp - 0x8c]
push edx
add ebx, 0x40
call fcn.004bb6e0
lea eax, [ebp - 0x8c]
add esp, 0x10
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4a5260
sub eax, edx
push 0
sar eax, 1
lea ecx, [ebp - 0xa8]
push ecx
lea edx, [eax + eax]
push edx
lea eax, [ebp - 0x8c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 2
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea ecx, [ebp - 0xa8]
push ecx
push 6
push 0x523a2c
push esi
call ebx
mov ebx, dword [ebp - 0xb4]
jmp 0x4a52d5
mov ebx, dword [ebp - 0xb4]
push 0
lea edx, [ebp - 0xa8]
push edx
push 0xe
push str.___t___r_n
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 0xa4]
mov eax, dword [eax + 0x34]
cmp eax, 0x305
jne 0x4a52ed
push edi
push 0x40020305
jmp 0x4a52fa
cmp eax, 0x307
jne 0x4a5302
push edi
push 0x40020307
call fcn.004a5d80
add esp, 8
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x53b1d8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, dword [ebp - 0xbc]
push 0x208
push 0
push esi
call fcn.004e7d90
push esi
call fcn.004e424b
push 0x808
push 0
push edi
call fcn.004e7d90
push edi
call fcn.004e424b
push 0x80
push 0
push ebx
call fcn.004e7d90
push ebx
call fcn.004e424b
mov esi, dword [ebp - 0xb8]
add esp, 0x30
push 0x80
push 0
push esi
call fcn.004e7d90
push esi
call fcn.004e424b
add esp, 0x10
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004e3946
mov esp, ebp
pop ebp
ret