Function at 0x472d20
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x158
mov eax, dword [0x589758]
xor eax, esp
mov dword [esp + 0x154], eax
push ebx
mov ebx, dword [esp + 0x160]
push ebp
push esi
push edi
or eax, 0xffffffff
xor ebp, ebp
push 0x3f
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x25]
push ebp
push eax
mov esi, ecx
mov dword [esp + 0x28], ebp
mov byte [esp + 0x2c], 0
call fcn.004f67e0
push 0x100000
mov dword [esp + 0x20], ebp
call fcn.00496dbd
mov edi, eax
add esp, 0x10
cmp edi, ebp
je 0x472db2
push 0x100000
push ebp
push edi
call fcn.004f67e0
mov ecx, dword [esp + 0x17c]
add esp, 0xc
push ecx
push ebx
lea edx, [esp + 0x18]
push edx
push 0x100000
push edi
mov ecx, esi
call fcn.00472020
test eax, eax
jne 0x472db9
push edi
call fcn.00496dc8
add esp, 4
xor eax, eax
jmp 0x472fce
mov ebx, dword [esp + 0x10]
lea ebp, [ebx + 0x10000]
push ebp
call fcn.00496dbd
mov esi, eax
add esp, 4
mov dword [esp + 0x10], esi
test esi, esi
je 0x472da9
push ebp
push 0
push esi
call fcn.004f67e0
push ebx
push edi
lea eax, [esp + 0x28]
push eax
add esi, 0x20
push esi
call fcn.004814f0
push ebp
call fcn.00496dbd
mov esi, eax
add esp, 0x20
test esi, esi
jne 0x472e18
push edi
call fcn.00496dc8
mov ecx, dword [esp + 0x14]
push ecx
call fcn.00496dc8
add esp, 8
xor eax, eax
jmp 0x472fce
push ebp
push 0
push esi
call fcn.004f67e0
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
push edx
add eax, 0x20
push eax
lea eax, [esp + 0x2c]
push eax
push esi
call fcn.00481120
add esp, 0x1c
mov eax, edi
mov ebp, esi
cmp ebx, 4
jb 0x472e5a
mov ecx, dword [ebp]
cmp ecx, dword [eax]
jne 0x472e7f
sub ebx, 4
add eax, 4
add ebp, 4
cmp ebx, 4
jae 0x472e45
test ebx, ebx
je 0x472e9f
mov dl, byte [eax]
cmp dl, byte [ebp]
jne 0x472e7f
cmp ebx, 1
jbe 0x472e9f
mov cl, byte [eax + 1]
cmp cl, byte [ebp + 1]
jne 0x472e7f
cmp ebx, 2
jbe 0x472e9f
mov dl, byte [eax + 2]
cmp dl, byte [ebp + 2]
je 0x472e9f
push edi
call fcn.00496dc8
mov eax, dword [esp + 0x14]
push eax
call fcn.00496dc8
push esi
call fcn.00496dc8
add esp, 0xc
xor eax, eax
jmp 0x472fce
push esi
call fcn.00496dc8
push edi
call fcn.00496dc8
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
push ecx
add eax, 0x20
push eax
lea edx, [esp + 0x30]
push edx
call fcn.0044c2a0
mov ebx, dword [esp + 0x24]
add esp, 0x14
push 0x104
lea eax, [esp + 0x64]
push eax
mov ecx, 8
lea esi, [esp + 0x28]
mov edi, ebx
push 0
rep movsd dword es:[edi], dword [esi]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 0x60]
push 0x5c
push ecx
call fcn.004f6860
add esp, 8
test eax, eax
jne 0x472f2f
mov edx, dword [str.usermonfile.dat]
mov eax, dword [0x5468cc]
mov ecx, dword [0x5468d0]
mov dword [esp + 0x60], edx
mov edx, dword [0x5468d4]
mov dword [esp + 0x64], eax
mov ax, word [0x5468d8]
mov dword [esp + 0x68], ecx
mov dword [esp + 0x6c], edx
mov word [esp + 0x70], ax
jmp 0x472f6d
mov byte [eax], 0
lea eax, [esp + 0x60]
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x472f37
mov ecx, dword [str.usermonfile.dat]
mov edx, dword [0x5468cc]
mov dword [eax], ecx
mov ecx, dword [0x5468d0]
mov dword [eax + 4], edx
mov edx, dword [0x5468d4]
mov dword [eax + 8], ecx
mov cx, word [0x5468d8]
mov dword [eax + 0xc], edx
mov word [eax + 0x10], cx
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
lea edx, [esp + 0x78]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x472f9e
push ebx
call fcn.00496dc8
add esp, 4
xor eax, eax
jmp 0x472fce
mov ecx, dword [esp + 0x14]
push 0
lea eax, [esp + 0x20]
push eax
add ecx, 0x20
push ecx
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push ebx
mov edi, eax
call fcn.00496dc8
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
test edi, edi
setne al
mov ecx, dword [esp + 0x164]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004f6592
add esp, 0x158
ret 8