Function at 0x4e6fe0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0xbc
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0xd0]
xor ebp, ebp
mov esi, ecx
push edi
lea ecx, [esp + 0x14]
mov dword [esp + 0x18], 3
mov dword [esp + 0x28], ebp
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x30], ebp
call fcn.004e4300
mov eax, dword [eax]
push eax
call fcn.004402b0
mov bl, al
mov eax, dword [esp + 0x14]
push eax
call fcn.0043f0a0
add esp, 8
test bl, bl
je 0x4e72b6
push edi
mov ecx, esi
call fcn.004e4ff0
mov ebp, eax
test ebp, ebp
je 0x4e72b6
push ebp
mov ecx, esi
call fcn.004e45c0
mov edi, eax
test edi, edi
je 0x4e7063
push edi
mov ecx, esi
call fcn.004e4630
push edi
call fcn.0043f0a0
add esp, 4
push 0x10000000
push 2
push 1
push 0x40000000
push ebp
mov ecx, esi
call fcn.004e43f0
mov edi, eax
test edi, edi
je 0x4e7088
cmp edi, 0xffffffff
jne 0x4e7168
push 0
mov ecx, esi
call fcn.004e6e50
push eax
push ebp
mov ecx, esi
mov dword [esp + 0x2c], eax
call fcn.004e4ae0
test al, al
je 0x4e7168
mov ecx, esi
call fcn.004e6ed0
lea ecx, [esp + 0x38]
mov edi, eax
push ecx
mov dword [esp + 0x2c], edi
mov dword [esp + 0x3c], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [esp + 0x48], 2
jne 0x4e70f8
cmp dword [esp + 0x3c], 4
jbe 0x4e70f8
mov edx, dword [esp + 0x24]
push 1
push edi
push edx
mov ecx, esi
call fcn.004e4590
push 0x10000000
push 4
push 1
push 0x40000000
mov dword [esp + 0x3c], eax
push ebp
jmp 0x4e715f
push edi
lea ecx, [esp + 0x1c]
call fcn.004e4300
mov edi, dword [eax]
push ebp
lea ecx, [esp + 0x24]
call fcn.004e4300
mov ebx, dword [eax]
mov eax, dword [esp + 0xd0]
push eax
lea ecx, [esp + 0x14]
call fcn.004e4300
mov ecx, dword [eax]
push edi
push ebx
push ecx
call fcn.004e5090
mov edx, dword [esp + 0x1c]
push edx
call fcn.0043f0a0
mov eax, dword [esp + 0x30]
push eax
call fcn.0043f0a0
mov ecx, dword [esp + 0x2c]
push ecx
call fcn.0043f0a0
mov edx, dword [esp + 0x40]
add esp, 0x18
push 0x10000000
push 4
push 1
push 0x40000000
push edx
mov ecx, esi
call fcn.004e43f0
mov edi, eax
test edi, edi
je 0x4e72b6
cmp edi, 0xffffffff
je 0x4e72b6
mov eax, dword [esp + 0xe0]
mov ecx, dword [esp + 0xdc]
push eax
mov eax, dword [esp + 0xdc]
push ecx
mov ecx, dword [esp + 0xdc]
lea edx, [esp + 0x20]
push edx
push eax
xor ebx, ebx
push ecx
mov ecx, esi
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
call fcn.004e5790
test al, al
je 0x4e7298
mov eax, dword [esp + 0x18]
cmp byte [eax], 0x54
jne 0x4e7298
cmp byte [eax + 1], 0x72
jne 0x4e7298
cmp byte [eax + 2], 0x6f
jne 0x4e7298
cmp byte [eax + 3], 0x79
jne 0x4e7298
mov ecx, dword [esp + 0x1c]
mov eax, dword [eax + 4]
lea edx, [ecx + ecx*4]
shl edx, 1
cmp eax, edx
mov dword [esp + 0x20], eax
jae 0x4e72a0
push eax
lea ecx, [esp + 0x34]
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebx
call fcn.004e4290
mov ebx, dword [esp + 0x30]
test ebx, ebx
jne 0x4e7230
lea ecx, [esp + 0x30]
mov dword [esp + 0x14], 4
call fcn.004e4270
lea ecx, [esp + 0x18]
call fcn.004e4270
jmp 0x4e72a9
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
add eax, 0xfffffff8
push eax
add ecx, 8
push ecx
lea edx, [esp + 0x28]
push edx
push ebx
call fcn.004dc710
add esp, 0x10
test eax, eax
jne 0x4e728b
push 2
push eax
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ecx, dword [esp + 0x20]
push 0
lea eax, [esp + 0x14]
push eax
push ecx
push ebx
push edi
mov dword [esp + 0x24], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [esp + 0x10]
cmp edx, dword [esp + 0x20]
jne 0x4e728b
mov dword [esp + 0x14], 0
lea ecx, [esp + 0x30]
call fcn.004e4270
xor ebx, ebx
jmp 0x4e72a0
mov dword [esp + 0x14], 6
lea ecx, [esp + 0x18]
call fcn.004e4270
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x14], ebx
je 0x4e72db
push ebp
mov ecx, esi
call fcn.004e4530
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x4e72db
mov esi, dword [esi + 0x28]
test esi, esi
je 0x4e72db
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
push 0
push eax
push ecx
call esi
mov edx, dword [esp + 0x24]
push edx
call fcn.0043f0a0
mov eax, dword [esp + 0x2c]
push eax
call fcn.0043f0a0
push ebp
call fcn.0043f0a0
mov eax, dword [esp + 0x20]
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xbc
ret 0x14