Function at 0x4ec850
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x65c
mov eax, dword [0x5e95e0]
xor eax, esp
mov dword [esp + 0x654], eax
mov eax, dword [esp + 0x660]
test eax, eax
push ebx
push ebp
push esi
push edi
mov ebx, ecx
je 0x4ec8a9
cmp dword [eax], 1
je 0x4ec884
mov eax, 0x80000
jmp 0x4ecb2a
mov ebp, dword [eax + 4]
or esi, 0xffffffff
cmp dword [ebp + 4], esi
je 0x4ec897
mov edi, dword [ebp]
call fcn.004eba10
mov edi, dword [esp + 0x674]
mov dword [ebp + 4], esi
mov esi, dword [ebp]
cmp edi, dword [esi + 4]
jl 0x4ec8b3
mov eax, 0x10000
jmp 0x4ecb2a
cmp edi, dword [esi + 0x10]
jge 0x4ec8bd
call fcn.004eb3a0
mov eax, dword [ebp]
cmp dword [eax + 0x10], edi
jge 0x4ec8d5
mov esi, dword [ebp]
call fcn.004eb3e0
mov ecx, dword [ebp]
cmp dword [ecx + 0x10], edi
jl 0x4ec8c5
lea edx, [esp + 0x20]
push edx
push edi
mov ecx, ebp
call fcn.004ebc50
test byte [esp + 0x22c], 0x10
movzx eax, word [ebx]
je 0x4ec930
cmp ax, 0x2f
je 0x4ec907
cmp ax, 0x5c
je 0x4ec907
test ax, ax
je 0x4ec919
cmp word [ebx + 2], 0x3a
jne 0x4ec919
push ebx
push 0
call fcn.004ec1b0
add esp, 8
xor eax, eax
jmp 0x4ecb2a
push ebx
add ebp, 0x244
push ebp
call fcn.004ec1b0
add esp, 8
xor eax, eax
jmp 0x4ecb2a
xor esi, esi
cmp ax, si
mov edi, ebx
mov ecx, ebx
je 0x4ec95b
movzx eax, ax
mov edi, edi
cmp ax, 0x2f
je 0x4ec94c
cmp ax, 0x5c
jne 0x4ec94f
lea edi, [ecx + 2]
movzx eax, word [ecx + 2]
add ecx, 2
cmp ax, si
jne 0x4ec940
lea edx, [esp + 0x250]
mov eax, ebx
sub edx, ebx
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
cmp cx, si
jne 0x4ec966
cmp edi, ebx
jne 0x4ec9eb
mov word [esp + 0x250], si
push edi
lea ecx, [esp + 0x254]
push ecx
lea esi, [ebp + 0x244]
push esi
lea edx, [esp + 0x464]
push str._s_s_s
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x14
lea eax, [esp + 0x250]
push eax
push esi
call fcn.004ec1b0
add esp, 8
xor esi, esi
mov ecx, dword [esp + 0x22c]
push esi
push ecx
push 2
push esi
push esi
push 0x40000000
lea edx, [esp + 0x470]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x4eca57
mov eax, 0x200
jmp 0x4ecb2a
mov eax, edi
sub eax, ebx
sar eax, 1
mov word [esp + eax*2 + 0x250], si
mov ax, word [esp + 0x250]
cmp ax, 0x2f
je 0x4eca25
cmp ax, 0x5c
je 0x4eca25
cmp ax, si
je 0x4ec981
cmp word [esp + 0x252], 0x3a
jne 0x4ec981
push edi
lea ecx, [esp + 0x254]
push ecx
lea edx, [esp + 0x460]
push str._s_s
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [esp + 0x260]
push eax
push esi
call fcn.004ec1b0
add esp, 0x18
jmp 0x4ec9ba
mov eax, dword [ebp + 0x23c]
push eax
mov eax, dword [ebp]
call fcn.004eb620
add esp, 4
cmp dword [ebp + 0x240], esi
jne 0x4eca84
push 0x4000
call fcn.005308fb
add esp, 4
mov dword [ebp + 0x240], eax
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [esp + 0x18], esi
mov edi, edi
mov edx, dword [ebp + 0x240]
mov eax, dword [ebp]
lea ecx, [esp + 0x17]
push ecx
push edx
mov ecx, 0x4000
call fcn.004eb7a0
mov esi, eax
add esp, 8
cmp esi, 0xffffff96
je 0x4ecae4
test esi, esi
jl 0x4ecada
jle 0x4ecacf
mov ecx, dword [ebp + 0x240]
push 0
lea eax, [esp + 0x20]
push eax
push esi
push ecx
push edi
call ebx
test eax, eax
je 0x4ecaee
cmp byte [esp + 0x17], 0
jne 0x4ecaf8
test esi, esi
jne 0x4eca90
mov dword [esp + 0x18], 0x5000000
jmp 0x4ecb17
mov dword [esp + 0x18], 0x1000
jmp 0x4ecb17
mov dword [esp + 0x18], 0x400
jmp 0x4ecb17
lea edx, [esp + 0x240]
push edx
lea eax, [esp + 0x234]
push eax
lea ecx, [esp + 0x240]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [ebp]
call fcn.004eba10
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x664]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
mov dword [0x5f1ed0], eax
call fcn.00552101
add esp, 0x65c
ret