Function at 0x59ffb4
Capabilities:
Write file on windows

Disassembly:
push ebp
sub esp, 0x40
mov eax, 0x6e3578
call fcn.006899cc
sub esp, 0x260
and dword [ebp + 0x40], 0
push ebx
push esi
mov esi, dword [ebp + 0x4c]
mov ebx, ecx
push edi
xor edi, edi
inc edi
cmp dword [esi + 0x10], 0xfffff
push edi
jbe 0x5a0028
lea ecx, [ebp - 0xa4]
call fcn.0045c4aa
and dword [ebp - 4], 0
lea eax, [ebp - 0xa4]
push 0x77cfa0
push dword [esi + 0x10]
push 0x73e1e0
push eax
call fcn.004634b5
mov ecx, eax
call fcn.0041baa0
push eax
call fcn.004634b5
lea ecx, [ebp - 0xa4]
call fcn.0045c68b
mov eax, edi
jmp 0x5a04d3
lea ecx, [ebp - 0x1d4]
call fcn.0045c4aa
push 0x5d
push dword [esi + 0x10]
lea eax, [ebp + 0x34]
mov dword [ebp - 4], edi
push 0x10
push eax
call fcn.006774c3
pop ecx
pop ecx
push eax
push 0x5b
lea eax, [ebp - 0x1d4]
push eax
call fcn.00463eb6
push eax
call fcn.0058fcf7
mov ecx, eax
call fcn.0041baa0
push eax
call fcn.00463eb6
lea eax, [ebp]
push eax
lea ecx, [ebp - 0x1d0]
call fcn.004145c0
push esi
lea eax, [ebp]
mov byte [ebp - 4], 2
push eax
lea eax, [ebp + 0x18]
push eax
call fcn.0046af2d
lea ecx, [ebp]
mov byte [ebp - 4], 4
call fcn.0040fad0
xor eax, eax
lea ecx, [ebp - 0x26c]
push edi
mov dword [ebp + 0x30], eax
mov dword [ebp + 0x3c], eax
mov dword [ebp + 0x4c], eax
mov dword [ebp + 0x38], eax
call fcn.0045c4aa
push 0x77cfa0
push dword [ebp + 0x28]
lea eax, [ebp - 0x26c]
mov byte [ebp - 4], 5
push 0x73e200
push eax
call fcn.004634b5
mov ecx, eax
call fcn.0041baa0
push eax
call fcn.004634b5
mov esi, dword [ebp + 0x28]
test esi, esi
je 0x5a03f2
mov eax, dword [ebp + 0x4c]
cmp dword [ebp + 0x40], 0
jne 0x5a04b2
push edi
lea ecx, [ebp - 0x13c]
sub esi, eax
call fcn.0045c4aa
push 0x77cfa0
push esi
push 0x73e214
lea eax, [ebp - 0x13c]
mov byte [ebp - 4], 6
push eax
call fcn.004634b5
mov ecx, eax
call fcn.004636ae
push eax
call fcn.004634b5
and dword [ebx + 0x74], 0
lea eax, [ebp + 0x18]
and dword [ebx + 0x78], 0
cmp dword [ebp + 0x2c], 0x10
jb 0x5a013d
mov eax, dword [ebp + 0x18]
add eax, dword [ebp + 0x4c]
lea ecx, [ebx + 0x6c]
push ecx
lea ecx, [ebp + 0x30]
push ecx
push esi
push eax
push dword [ebx + 0x88]
call dword [sym.imp.KERNEL32.DLL_WriteFile]
mov esi, eax
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov dword [ebx + 0xa0], eax
test esi, esi
je 0x5a01e1
push edi
lea ecx, [ebp - 0xa4]
call fcn.0045c4aa
push dword [ebp + 0x28]
mov esi, dword [ebp + 0x4c]
lea eax, [ebp - 0xa4]
push 0x73e22c
push dword [ebp + 0x3c]
mov byte [ebp - 4], 7
push 0x73e238
push esi
push 0x73e248
push dword [ebp + 0x30]
push 0x73e254
push eax
call fcn.004634b5
mov ecx, eax
call fcn.004636ae
push eax
call fcn.004634b5
mov ecx, eax
call fcn.004636ae
push eax
call fcn.004634b5
mov ecx, eax
call fcn.004636ae
push eax
call fcn.004634b5
mov ecx, eax
call fcn.0041baa0
add esi, dword [ebp + 0x30]
inc dword [ebp + 0x38]
mov dword [ebp + 0x4c], esi
jmp 0x5a03c0
cmp eax, 0x3e5
jne 0x5a0362
xor esi, esi
lea eax, [ebx + 0x6c]
cmp dword [eax], 0x103
jne 0x5a0211
push 0x64
call dword [sym.imp.KERNEL32.DLL_Sleep]
add esi, 0x64
cmp esi, 0x2710
jb 0x5a01ee
jmp 0x5a0305
push edi
lea ecx, [ebp + 0x3c]
push ecx
push eax
push dword [ebx + 0x88]
call dword [sym.imp.KERNEL32.DLL_GetOverlappedResult]
lea ecx, [ebp - 0xa4]
push edi
test eax, eax
je 0x5a029f
call fcn.0045c4aa
push dword [ebp + 0x28]
lea eax, [ebp - 0xa4]
mov byte [ebp - 4], 8
push 0x73e22c
push dword [ebp + 0x3c]
push 0x73e238
push dword [ebp + 0x4c]
push 0x73e248
push dword [ebp + 0x38]
push 0x73e25c
push eax
call fcn.004634b5
mov ecx, eax
call fcn.004636ae
push eax
call fcn.004634b5
mov ecx, eax
call fcn.004636ae
push eax
call fcn.004634b5
mov ecx, eax
call fcn.004636ae
push eax
call fcn.004634b5
mov ecx, eax
call fcn.0041baa0
mov eax, dword [ebp + 0x4c]
add eax, dword [ebp + 0x3c]
inc dword [ebp + 0x38]
mov dword [ebp + 0x4c], eax
jmp 0x5a02f6
call fcn.0045c4aa
push dword [ebp + 0x28]
lea eax, [ebp - 0xa4]
mov byte [ebp - 4], 9
push 0x73e270
push eax
call fcn.004634b5
mov ecx, eax
call fcn.0041baa0
lea eax, [ebp]
push eax
lea ecx, [ebp - 0xa0]
call fcn.004145c0
lea eax, [ebx + 0xa0]
mov byte [ebp - 4], 0xa
push eax
lea eax, [ebp + 0x40]
mov ecx, ebx
push eax
lea eax, [ebp]
push eax
push 4
call fcn.0059fa69
lea ecx, [ebp]
call fcn.0040fad0
lea ecx, [ebp - 0xa4]
mov byte [ebp - 4], 6
call fcn.0045c68b
cmp esi, 0x2710
jb 0x5a03cb
push edi
lea ecx, [ebp - 0xa4]
call fcn.0045c4aa
push dword [ebp + 0x28]
lea eax, [ebp - 0xa4]
mov byte [ebp - 4], 0xb
push 0x73e290
push eax
call fcn.004634b5
mov ecx, eax
call fcn.0041baa0
lea eax, [ebp]
push eax
lea ecx, [ebp - 0xa0]
call fcn.004145c0
lea eax, [ebx + 0xa0]
mov byte [ebp - 4], 0xc
push eax
lea eax, [ebp + 0x40]
push eax
lea eax, [ebp]
push eax
push 3
jmp 0x5a03b1
push edi
lea ecx, [ebp - 0xa4]
call fcn.0045c4aa
push dword [ebp + 0x28]
lea eax, [ebp - 0xa4]
mov byte [ebp - 4], 0xd
push 0x73e2a8
push eax
call fcn.004634b5
mov ecx, eax
call fcn.0041baa0
lea eax, [ebp]
push eax
lea ecx, [ebp - 0xa0]
call fcn.004145c0
lea eax, [ebx + 0xa0]
mov byte [ebp - 4], 0xe
push eax
lea eax, [ebp + 0x40]
push eax
lea eax, [ebp]
push eax
push 2
mov ecx, ebx
call fcn.0059fa69
lea ecx, [ebp]
call fcn.0040fad0
lea ecx, [ebp - 0xa4]
call fcn.0045c68b
lea ecx, [ebp - 0x13c]
mov byte [ebp - 4], 5
call fcn.0045c68b
mov esi, dword [ebp + 0x28]
mov eax, dword [ebp + 0x4c]
cmp eax, esi
jb 0x5a00e9
cmp dword [ebp + 0x40], 0
jne 0x5a04b2
push dword [ebx + 0x88]
call dword [sym.imp.KERNEL32.DLL_FlushFileBuffers]
push edi
test eax, eax
jne 0x5a0468
lea ecx, [ebp - 0xa4]
call fcn.0045c4aa
push dword [ebp + 0x28]
lea eax, [ebp - 0xa4]
mov byte [ebp - 4], 0xf
push 0x73e2b4
push eax
call fcn.004634b5
mov ecx, eax
call fcn.0041baa0
lea eax, [ebp]
push eax
lea ecx, [ebp - 0xa0]
call fcn.004145c0
lea eax, [ebx + 0xa0]
mov byte [ebp - 4], 0x10
push eax
lea eax, [ebp + 0x40]
mov ecx, ebx
push eax
lea eax, [ebp]
push eax
push 5
call fcn.0059fa69
lea ecx, [ebp]
call fcn.0040fad0
lea ecx, [ebp - 0xa4]
jmp 0x5a04ad
lea ecx, [ebp - 0x13c]
call fcn.0045c4aa
push dword [ebp + 0x28]
lea eax, [ebp - 0x13c]
mov byte [ebp - 4], 0x11
push 0x73e2c8
push dword [ebp + 0x38]
push 0x73e2d8
push eax
call fcn.004634b5
mov ecx, eax
call fcn.004636ae
push eax
call fcn.004634b5
mov ecx, eax
call fcn.0041baa0
lea ecx, [ebp - 0x13c]
call fcn.0045c68b
lea ecx, [ebp - 0x26c]
call fcn.0045c68b
lea ecx, [ebp + 0x18]
call fcn.0040fad0
lea ecx, [ebp - 0x1d4]
call fcn.0045c68b
mov eax, dword [ebp + 0x40]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add ebp, 0x44
leave
ret 4