Function at 0x4dbf90
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x64c
mov eax, dword [0x567e00]
xor eax, esp
mov dword [esp + 0x648], eax
push ebx
mov ebx, dword [esp + 0x658]
push ebp
push esi
push edi
mov edi, ecx
mov ecx, dword [esp + 0x66c]
cmp ecx, 3
je 0x4dbfcb
cmp ecx, 2
je 0x4dbfcb
cmp ecx, 1
jne 0x4dc11c
mov eax, dword [edi + 4]
cmp ecx, 3
jne 0x4dc0f8
mov ebp, dword [esp + 0x660]
cmp ebp, eax
je 0x4dc089
cmp eax, 0xffffffff
je 0x4dbff5
push dword [edi]
call fcn.004dee80
add esp, 4
mov eax, dword [edi]
mov dword [edi + 4], 0xffffffff
cmp ebp, dword [eax + 4]
jge 0x4dc11c
cmp dword [eax + 0x10], ebp
jle 0x4dc01a
push eax
call fcn.004def00
mov eax, dword [edi]
add esp, 4
cmp dword [eax + 0x10], ebp
jge 0x4dc077
mov esi, eax
nop
mov eax, esi
test esi, esi
je 0x4dc070
cmp dword [esi + 0x18], 0
je 0x4dc070
mov edx, dword [esi + 0x10]
inc edx
cmp edx, dword [esi + 4]
je 0x4dc070
mov ecx, dword [esi + 0x50]
mov eax, dword [esi + 0x48]
add ecx, 0x2e
add ecx, dword [esi + 0x4c]
push 0
push 0
push 0
push 0
add eax, ecx
mov dword [esi + 0x10], edx
add dword [esi + 0x14], eax
lea eax, [esi + 0x78]
push 0
push 0
push eax
lea eax, [esi + 0x28]
push eax
push esi
call fcn.004df900
add esp, 0x24
neg eax
sbb eax, eax
inc eax
mov dword [esi + 0x18], eax
mov eax, dword [edi]
mov esi, eax
cmp dword [eax + 0x10], ebp
jl 0x4dc020
push dword [edi + 0x23c]
push eax
call fcn.004def50
add esp, 8
mov dword [edi + 4], ebp
lea eax, [esp + 0x13]
push eax
push dword [esp + 0x66c]
push ebx
push dword [edi]
call fcn.004df430
mov esi, eax
add esp, 0x10
test esi, esi
jg 0x4dc0b7
push dword [edi]
call fcn.004dee80
add esp, 4
mov dword [edi + 4], 0xffffffff
cmp byte [esp + 0x13], 0
jne 0x4dc21e
test esi, esi
jle 0x4dc0e6
mov eax, 0x600
mov ecx, dword [esp + 0x658]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004c6f8b
add esp, 0x64c
ret 0x10
cmp esi, 0xffffff96
mov eax, 0x5000000
mov ecx, 0x1000
cmove eax, ecx
jmp 0x4dc0cb
cmp eax, 0xffffffff
je 0x4dc107
push dword [edi]
call fcn.004dee80
add esp, 4
mov esi, dword [edi]
mov ebp, dword [esp + 0x660]
mov dword [edi + 4], 0xffffffff
cmp ebp, dword [esi + 4]
jl 0x4dc123
mov eax, 0x10000
jmp 0x4dc0cb
cmp dword [esi + 0x10], ebp
jle 0x4dc167
mov ecx, esi
test ecx, ecx
je 0x4dc164
mov eax, dword [ecx + 0x24]
push 0
push 0
push 0
push 0
push 0
mov dword [ecx + 0x14], eax
lea eax, [ecx + 0x78]
push 0
push eax
lea eax, [ecx + 0x28]
mov dword [ecx + 0x10], 0
push eax
push ecx
call fcn.004df900
add esp, 0x24
mov ecx, esi
neg eax
sbb eax, eax
inc eax
mov dword [ecx + 0x18], eax
mov esi, dword [edi]
cmp dword [esi + 0x10], ebp
jge 0x4dc1c7
nop dword [eax]
mov eax, esi
test esi, esi
je 0x4dc1c0
cmp dword [esi + 0x18], 0
je 0x4dc1c0
mov edx, dword [esi + 0x10]
inc edx
cmp edx, dword [esi + 4]
je 0x4dc1c0
mov ecx, dword [esi + 0x50]
mov eax, dword [esi + 0x48]
add ecx, 0x2e
add ecx, dword [esi + 0x4c]
push 0
push 0
push 0
push 0
add eax, ecx
mov dword [esi + 0x10], edx
add dword [esi + 0x14], eax
lea eax, [esi + 0x78]
push 0
push 0
push eax
lea eax, [esi + 0x28]
push eax
push esi
call fcn.004df900
add esp, 0x24
neg eax
sbb eax, eax
inc eax
mov dword [esi + 0x18], eax
mov eax, dword [edi]
mov esi, eax
cmp dword [eax + 0x10], ebp
jl 0x4dc170
lea eax, [esp + 0x18]
mov ecx, edi
push eax
push ebp
call fcn.004db5c0
test byte [esp + 0x224], 0x10
je 0x4dc225
cmp dword [esp + 0x66c], 1
je 0x4dc21e
movzx eax, word [ebx]
cmp eax, 0x2f
je 0x4dc205
cmp eax, 0x5c
je 0x4dc205
test ax, ax
je 0x4dc201
cmp word [ebx + 2], 0x3a
je 0x4dc205
xor dl, dl
jmp 0x4dc207
mov dl, 1
xor ecx, ecx
lea eax, [edi + 0x244]
test dl, dl
push ebx
cmove ecx, eax
push ecx
call fcn.004db480
add esp, 8
xor eax, eax
jmp 0x4dc0cb
cmp dword [esp + 0x66c], 1
je 0x4dc34e
movzx eax, word [ebx]
mov esi, ebx
mov ecx, ebx
test ax, ax
je 0x4dc25e
mov edx, eax
cmp dx, 0x2f
je 0x4dc24d
cmp dx, 0x5c
jne 0x4dc250
lea esi, [ecx + 2]
movzx eax, word [ecx + 2]
add ecx, 2
mov edx, eax
test ax, ax
jne 0x4dc241
lea edx, [esp + 0x248]
mov ecx, ebx
sub edx, ebx
nop dword [eax]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx + ecx - 2], ax
test ax, ax
jne 0x4dc270
cmp esi, ebx
jne 0x4dc290
xor eax, eax
mov word [esp + 0x248], ax
jmp 0x4dc2d0
mov eax, esi
sub eax, ebx
and eax, 0xfffffffe
cmp eax, 0x208
jae 0x4dc431
xor ecx, ecx
mov word [esp + eax + 0x248], cx
mov ax, word [esp + 0x248]
cmp ax, 0x2f
je 0x4dc2f8
cmp ax, 0x5c
je 0x4dc2f8
test ax, ax
je 0x4dc2d0
cmp word [esp + 0x24a], 0x3a
je 0x4dc2f8
push esi
lea eax, [esp + 0x24c]
push eax
lea ebx, [edi + 0x244]
push ebx
lea eax, [esp + 0x45c]
push str._s_s_s
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x14
jmp 0x4dc319
push esi
lea eax, [esp + 0x24c]
push eax
lea eax, [esp + 0x458]
push str._s_s
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
xor ebx, ebx
lea eax, [esp + 0x248]
push eax
push ebx
call fcn.004db480
add esp, 8
lea eax, [esp + 0x450]
push 0
push dword [esp + 0x228]
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4dc35d
mov eax, 0x200
jmp 0x4dc0cb
push dword [edi + 0x23c]
push dword [edi]
call fcn.004def50
add esp, 8
cmp dword [edi + 0x240], 0
jne 0x4dc389
push 0x4000
call fcn.004c6f7d
add esp, 4
mov dword [edi + 0x240], eax
xor ebp, ebp
nop dword [eax + eax]
lea eax, [esp + 0x13]
push eax
push 0x4000
push dword [edi + 0x240]
push dword [edi]
call fcn.004df430
mov esi, eax
add esp, 0x10
cmp esi, 0xffffff96
je 0x4dc40a
test esi, esi
js 0x4dc3db
jle 0x4dc3d0
push 0
lea eax, [esp + 0x18]
push eax
push esi
push dword [edi + 0x240]
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4dc3e2
cmp byte [esp + 0x13], 0
jne 0x4dc3e9
test esi, esi
jne 0x4dc390
mov ebp, 0x5000000
jmp 0x4dc40f
mov ebp, 0x400
jmp 0x4dc40f
lea eax, [esp + 0x238]
push eax
lea eax, [esp + 0x22c]
push eax
lea eax, [esp + 0x238]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileTime]
jmp 0x4dc40f
mov ebp, 0x1000
cmp dword [esp + 0x66c], 1
je 0x4dc420
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [edi]
call fcn.004dee80
add esp, 4
mov eax, ebp
jmp 0x4dc0cb
call fcn.004c774e
int3