Function at 0x563950
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2670
call fcn.004c0d2b
push ebx
push esi
push edi
lea edi, [ebp - 0x2670]
mov ecx, 0x99c
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x68c07c]
xor eax, ebp
mov dword [ebp - 4], eax
mov byte [ebp - 0x108], 0
push 0xff
push 0
lea eax, [ebp - 0x107]
push eax
call fcn.004be107
add esp, 0xc
push 0
push 0
push 0
push 0
push 0xff
lea eax, [ebp - 0x108]
push eax
lea ecx, [ebp - 0x160]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.004c052e
add esp, 0x20
mov dword [ebp - 0x16c], eax
lea eax, [ebp - 0x108]
push eax
push str._s_r_n
call fcn.004c00d8
add esp, 8
cmp dword [ebp - 0x16c], 0
je 0x5639ea
xor al, al
jmp 0x563be7
movsx eax, byte [ebp - 0x108]
test eax, eax
jne 0x5639fc
xor al, al
jmp 0x563be7
mov eax, dword [ebp + 8]
push eax
call fcn.004bcd4d
add esp, 4
mov dword [ebp - 0x16c], eax
cmp dword [ebp - 0x16c], 0
je 0x563a1e
xor al, al
jmp 0x563be7
push 0xffffffffffffffff
mov eax, dword [ebp + 0xc]
push eax
push 0x400
lea ecx, [ebp - 0x574]
push ecx
call fcn.004c0bf0
add esp, 0x10
test eax, eax
je 0x563a43
xor al, al
jmp 0x563be7
push 0xffffffffffffffff
lea eax, [ebp - 0x108]
push eax
push 0x400
lea ecx, [ebp - 0x574]
push ecx
call fcn.004bf633
add esp, 0x10
test eax, eax
je 0x563a6b
xor al, al
jmp 0x563be7
lea eax, [ebp - 0x574]
push eax
call fcn.004bdf09
add esp, 4
movzx ecx, al
test ecx, ecx
jne 0x563a88
xor al, al
jmp 0x563be7
lea eax, [ebp - 0x574]
push eax
call fcn.004be387
add esp, 4
mov dword [ebp - 0x580], eax
mov eax, dword [ebp - 0x580]
movsx ecx, byte [ebp + eax - 0x575]
cmp ecx, 0x5c
je 0x563ac3
mov eax, dword [ebp - 0x580]
movsx ecx, byte [ebp + eax - 0x575]
cmp ecx, 0x2f
jne 0x563aca
mov al, 1
jmp 0x563be7
mov esi, esp
push 0
push 0
push 2
push 0
push 1
push 0x40000000
lea eax, [ebp - 0x574]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp esi, esp
call fcn.004bf697
mov dword [ebp - 0x58c], eax
cmp dword [ebp - 0x58c], 0xffffffff
jne 0x563b05
xor al, al
jmp 0x563be7
mov byte [ebp - 0x595], 1
mov dword [ebp - 0x5a4], 0
push 0x2000
lea eax, [ebp - 0x25ac]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.004c1b77
add esp, 0xc
mov dword [ebp - 0x5a4], eax
cmp dword [ebp - 0x5a4], 0
jge 0x563b4b
mov eax, dword [ebp - 0x5a4]
mov dword [ebp - 0x16c], eax
jmp 0x563b92
cmp dword [ebp - 0x5a4], 0
jle 0x563b89
mov esi, esp
push 0
lea eax, [ebp - 0x5a4]
push eax
mov ecx, dword [ebp - 0x5a4]
push ecx
lea edx, [ebp - 0x25ac]
push edx
mov eax, dword [ebp - 0x58c]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp esi, esp
call fcn.004bf697
test eax, eax
jne 0x563b89
xor al, al
jmp 0x563be7
cmp dword [ebp - 0x5a4], 0
jg 0x563b16
mov esi, esp
mov eax, dword [ebp - 0x58c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.004bf697
cmp dword [ebp - 0x16c], 0
jne 0x563bc5
mov eax, dword [ebp + 8]
push eax
call fcn.004bcc44
add esp, 4
mov dword [ebp - 0x16c], eax
jmp 0x563bd1
mov eax, dword [ebp + 8]
push eax
call fcn.004bcc44
add esp, 4
cmp dword [ebp - 0x16c], 0
je 0x563be1
mov byte [ebp - 0x595], 0
mov al, byte [ebp - 0x595]
push edx
mov ecx, ebp
push eax
lea edx, [0x563c18]
call fcn.004c0eed
pop eax
pop edx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004c2261
add esp, 0x2670
cmp ebp, esp
call fcn.004bf697
mov esp, ebp
pop ebp
ret