Function at 0x44ce4d
Capabilities:
Get file size
Write file on windows

Disassembly:
push 0x84
mov eax, 0x4abcea
call fcn.00453742
mov edi, ecx
cmp dword [edi + 0x38], 0
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x88], ebx
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x84], ecx
jne 0x44ce83
xor eax, eax
jmp 0x44d124
lea ecx, [ebp - 0x7c]
push ecx
lea ecx, [ebp - 0x78]
push ecx
push eax
mov ecx, edi
call fcn.0044dde0
test al, al
je 0x44cea0
mov dword [edi + 0x44], 0xffffff9c
jmp 0x44ce7c
push 0x58
call fcn.004545d7
pop ecx
mov dword [ebp - 0x7c], eax
and dword [ebp - 4], 0
test eax, eax
je 0x44cec1
push dword [edi + 0x5c]
mov ecx, eax
call fcn.0044c6bf
mov esi, eax
jmp 0x44cec3
xor esi, esi
or dword [ebp - 4], 0xffffffff
xor ecx, ecx
inc ecx
cmp byte [edi + 0x3e], 0
je 0x44ced4
mov word [esi + 0x44], cx
cmp byte [edi + 0x3c], 0
je 0x44cf10
cmp byte [edi + 0x3d], 0
jne 0x44cefc
mov ecx, dword [ebp - 0x80]
call fcn.00449bf3
lea ecx, [ebx + 4]
cmp dword [ecx + 0x14], 8
jb 0x44cef3
mov ecx, dword [ecx]
push eax
push ecx
call fcn.0040fca3
pop ecx
pop ecx
xor eax, eax
cmp byte [edi + 0x3d], al
mov ecx, esi
setne al
inc eax
push eax
call fcn.0044e1b4
xor ecx, ecx
inc ecx
lea eax, [ebx + 4]
cmp dword [eax + 0x14], 8
jb 0x44cf1b
mov eax, dword [eax]
mov ebx, dword [sym.imp.KERNEL32.dll_CreateFileW]
push 0
push 0x80
push 3
push 0
push ecx
push SysReAllocStringLen
push eax
call ebx
mov dword [ebp - 0x78], eax
cmp eax, 0xffffffff
jne 0x44cf61
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi + 0x44], eax
test esi, esi
je 0x44ce7c
mov ecx, esi
call fcn.0044ca23
push esi
call fcn.0045269e
pop ecx
jmp 0x44ce7c
lea eax, [edi + 8]
cmp dword [eax + 0x14], 8
jb 0x44cf6c
mov eax, dword [eax]
push 0
push 0x80
push 3
push 0
push 3
push 0x40000000
push eax
call ebx
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x44cf9c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [ebp - 0x78]
mov dword [edi + 0x44], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x44cf46
push dword [ebp - 0x80]
mov ecx, esi
call fcn.00411c5a
push 0
push dword [ebp - 0x78]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push dword [ebp - 0x78]
mov dword [esi + 0x38], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0
push dword [edi + 0x40]
mov ecx, edi
push ebx
call fcn.0044e3c1
test eax, eax
jne 0x44cfdc
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x44cf4e
mov eax, dword [edi + 0x58]
inc eax
push eax
lea eax, [ebp - 0x74]
push eax
mov ecx, edi
call fcn.0044dd92
push 0
lea eax, [ebp - 0x90]
push eax
push dword [edi + 0x4c]
lea eax, [ebp - 0x74]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 2
push 0
push 0
push ebx
mov ecx, edi
call fcn.0044e3c1
test eax, eax
je 0x44ce7c
push ebx
mov ecx, edi
call fcn.0044e3ab
push ebx
mov ecx, esi
mov dword [ebp - 0x7c], eax
call fcn.0044e407
test eax, eax
jne 0x44cfd0
mov ecx, esi
call fcn.0044d7ea
add eax, dword [ebp - 0x7c]
mov ecx, dword [ebp - 0x84]
mov dword [esi + 0x48], eax
test ecx, ecx
je 0x44d056
push dword [esi + 0x38]
mov eax, dword [ecx]
push 0
call dword [eax]
mov ecx, dword [ebp - 0x84]
cmp byte [edi + 0x3e], 0
push ecx
mov ecx, edi
jne 0x44d06e
push ebx
push esi
push dword [ebp - 0x88]
call fcn.0044cd29
jmp 0x44d0ba
and dword [ebp - 0x78], 0
lea eax, [ebp - 0x78]
push eax
push ebx
push esi
push dword [ebp - 0x88]
call fcn.0044cce4
mov eax, dword [ebp - 0x78]
push 0
push 0
push dword [ebp - 0x7c]
mov ecx, edi
push ebx
mov dword [esi + 0x38], eax
call fcn.0044e3c1
push ebx
mov ecx, esi
call fcn.0044e407
mov dword [ebp - 0x7c], eax
test eax, eax
jne 0x44cfd0
push 2
push eax
push eax
push ebx
mov ecx, edi
call fcn.0044e3c1
mov eax, dword [ebp - 0x7c]
test eax, eax
jne 0x44cfd0
mov ecx, dword [ebp - 0x84]
test ecx, ecx
je 0x44d0d6
push dword [esi + 0x38]
mov eax, dword [ecx]
push dword [esi + 0x38]
call dword [eax]
push 1
push dword [ebp - 0x80]
lea ecx, [ebp - 0x44]
call fcn.0041142f
mov dword [ebp - 4], 1
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], 2
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x8c]
push eax
lea ecx, [edi + 0x54]
call fcn.0044c547
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x44]
mov dword [ebp - 0x7c], ecx
or dword [ebp - 4], 0xffffffff
call fcn.00401b80
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
inc eax
call fcn.004536f1
ret 0xc