Function at 0x4dff00
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x340
mov eax, dword [0x6aae14]
xor eax, esp
mov dword [esp + 0x33c], eax
mov eax, dword [esp + 0x344]
push esi
mov esi, dword [esp + 0x350]
test eax, eax
jne 0x4dff31
mov eax, 0x10000
jmp 0x4e01d6
cmp dword [eax], 1
je 0x4dff40
mov eax, 0x80000
jmp 0x4e01d6
push ebx
push ebp
push edi
mov edi, dword [eax + 4]
or ebx, 0xffffffff
cmp dword [edi + 4], ebx
je 0x4dff59
mov eax, dword [edi]
push eax
call fcn.004d4fc0
add esp, 4
mov eax, dword [edi]
mov ebp, dword [esp + 0x358]
mov dword [edi + 4], ebx
cmp ebp, dword [eax + 4]
jl 0x4dff74
mov eax, 0x10000
jmp 0x4e01d3
cmp ebp, dword [eax + 0x10]
jge 0x4dff90
push eax
call fcn.004d4d10
add esp, 4
test eax, eax
je 0x4dff90
mov eax, 0x700
jmp 0x4e01d3
mov ecx, dword [edi]
cmp dword [ecx + 0x10], ebp
jge 0x4dffad
mov edx, dword [edi]
push edx
call fcn.004d4d60
add esp, 4
test eax, eax
jne 0x4dff86
mov eax, dword [edi]
cmp dword [eax + 0x10], ebp
jl 0x4dff97
lea ecx, [esp + 0x18]
push ecx
push ebp
mov ecx, edi
call fcn.004d5040
mov edx, dword [esp + 0x120]
mov al, byte [esi]
shr edx, 4
test dl, 1
je 0x4e0006
cmp al, 0x2f
je 0x4dffdd
cmp al, 0x5c
je 0x4dffdd
test al, al
je 0x4dffef
cmp byte [esi + 1], 0x3a
jne 0x4dffef
push esi
push 0
call fcn.004d5590
add esp, 8
xor eax, eax
jmp 0x4e01d3
push esi
add edi, 0x140
push edi
call fcn.004d5590
add esp, 8
xor eax, eax
jmp 0x4e01d3
mov byte [esp + 0x248], 0
mov ebp, esi
mov ecx, esi
test al, al
je 0x4e0029
cmp al, 0x2f
je 0x4e001e
cmp al, 0x5c
jne 0x4e0021
lea ebp, [ecx + 1]
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x4e0016
push 0x104
lea eax, [esp + 0x148]
push esi
push eax
call fcn.005e2f3c
add esp, 0xc
cmp ebp, esi
jne 0x4e00b1
mov byte [esp + 0x144], 0
push ebp
lea edx, [esp + 0x148]
push edx
lea esi, [edi + 0x140]
push esi
lea eax, [esp + 0x254]
push 0x647ed0
push eax
call fcn.005dfb23
lea ecx, [esp + 0x158]
push ecx
push esi
call fcn.004d5590
add esp, 0x1c
mov edx, dword [esp + 0x120]
push 0
push edx
push 2
push 0
push 0
push 0x40000000
lea eax, [esp + 0x260]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebp, eax
cmp ebp, ebx
jne 0x4e0114
mov eax, 0x200
jmp 0x4e01d3
mov ecx, ebp
sub ecx, esi
mov byte [esp + ecx + 0x144], 0
mov al, byte [esp + 0x144]
cmp al, 0x2f
je 0x4e00e2
cmp al, 0x5c
je 0x4e00e2
test al, al
je 0x4e004b
cmp byte [esp + 0x145], 0x3a
jne 0x4e004b
push ebp
lea edx, [esp + 0x148]
push edx
lea eax, [esp + 0x250]
push 0x626500
push eax
call fcn.005dfb23
lea ecx, [esp + 0x154]
push ecx
push 0
call fcn.004d5590
add esp, 0x18
jmp 0x4e007e
mov ecx, dword [edi + 0x138]
mov edx, dword [edi]
push ecx
push edx
call fcn.004df510
add esp, 8
cmp dword [edi + 0x13c], 0
jne 0x4e0142
push 0x4000
call fcn.005ddec6
add esp, 4
mov dword [edi + 0x13c], eax
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x4e0150
mov ecx, dword [edi + 0x13c]
mov edx, dword [edi]
lea eax, [esp + 0x13]
push eax
push 0x4000
push ecx
push edx
call fcn.004df6a0
mov esi, eax
add esp, 0x10
cmp esi, 0xffffff96
je 0x4e019a
test esi, esi
jl 0x4e019a
jle 0x4e018f
mov ecx, dword [edi + 0x13c]
push 0
lea eax, [esp + 0x18]
push eax
push esi
push ecx
push ebp
call ebx
test eax, eax
je 0x4e019a
cmp byte [esp + 0x13], 0
jne 0x4e019a
test esi, esi
jne 0x4e0150
mov edx, dword [edi]
push edx
call fcn.004d4fc0
mov esi, eax
add esp, 4
test esi, esi
jne 0x4e01ca
lea eax, [esp + 0x134]
push eax
lea ecx, [esp + 0x128]
push ecx
lea edx, [esp + 0x134]
push edx
push ebp
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x340]
pop esi
xor ecx, esp
mov dword [0x74aea4], eax
call fcn.005dfbbe
add esp, 0x340
ret