Function at 0x47b820
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x1c
push esi
push str.SetByHandle__
push 1
mov esi, ecx
lea eax, [esp + 0xe]
push eax
lea ecx, [esp + 0x13]
push ecx
lea edx, [esp + 0x1c]
push edx
mov ecx, esi
mov byte [esp + 0x1b], 0
mov byte [esp + 0x1a], 0
call fcn.00478d30
mov dword [esp + 8], eax
test eax, eax
jne 0x47bb20
cmp byte [esp + 7], al
jne 0x47bb20
cmp byte [esp + 6], al
jne 0x47bb20
mov eax, dword [0x4d3ab2]
inc eax
push ebx
mov ebx, dword [esp + 0x1c]
mov dword [0x4d3ab2], eax
mov dword [esi + 2], eax
cmp bl, 2
je 0x47b890
mov ecx, esi
call fcn.0047ad10
mov ebx, dword [esp + 0x1c]
cmp dword [esp + 0x30], 0
push ebp
mov ebp, dword [esp + 0x2c]
je 0x47b8ce
push ebx
push ebp
mov ecx, 0x4d3ab0
call fcn.00478670
cmp bl, 2
jne 0x47b8ce
mov ecx, dword [esp + 0x22]
mov edx, dword [esp + 0x21]
lea eax, [esp + 0xe]
push eax
push ecx
push edx
mov ecx, esi
call fcn.0047b720
cmp byte [esp + 0xe], 0
jne 0x47bb1e
push edi
mov edi, dword [esp + 0x34]
lea eax, [esp + 0x12]
push eax
push edi
mov ecx, 0x4d3ab0
call fcn.0047a190
mov dword [esp + 0x14], eax
test eax, eax
jne 0x47bb1d
cmp byte [esp + 0x12], al
jne 0x47bb1d
movzx ebx, bp
mov ecx, ebx
imul ecx, dword [0x4d3df0]
add ecx, dword [0x4d3dec]
push eax
push eax
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xffffffff
jne 0x47b934
call ebp
mov dword [esp + 0x14], eax
test eax, eax
je 0x47b934
mov byte [esp + 0x12], 0x19
jmp 0x47b9e7
mov edx, dword [0x4d3df0]
inc edx
push edx
push 0x4d44fc
mov ecx, esi
call fcn.00478c50
mov dword [esp + 0x14], eax
test eax, eax
jne 0x47b9e2
mov ecx, dword [0x4d3df0]
push eax
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x3c]
push eax
push ecx
push 0x4d44fc
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x47b9d5
mov edx, dword [0x4d3df0]
cmp edx, dword [esp + 0x38]
jne 0x47b9cb
mov al, byte [esp + 0x24]
cmp al, 2
jne 0x47b995
push 0x4d44fc
push str.1G3RPC9696F5J76W9C6N77U2D9UYMZH
jmp 0x47b9af
cmp al, 1
je 0x47b9a5
cmp al, 5
je 0x47b9a5
cmp al, 4
je 0x47b9a5
cmp al, 6
jne 0x47b9bc
push 0x4d44fc
push str.RCJB9AJ64P9N8FBCN72B9BY5Z3TRGPF
push 0x4d3515
call fcn.0047d850
add esp, 0xc
push 0x4d3515
call fcn.0047d090
add esp, 4
jmp 0x47b9fd
mov byte [esp + 0x12], 0x1a
jmp 0x47bb1d
mov byte [esp + 0x12], 0x19
call ebp
mov dword [esp + 0x14], eax
jmp 0x47b9e7
mov byte [esp + 0x12], 0x1b
cmp dword [esp + 0x14], 0
jne 0x47bb1d
cmp byte [esp + 0x12], 0
jne 0x47bb1d
mov al, byte [esp + 0x24]
cmp al, 2
jne 0x47ba6f
mov dword [0x4d3620], ebx
mov ecx, dword [esi + 2]
mov dword [0x4d3ddc], ecx
cmp esi, 0x4d3628
je 0x47ba38
push 0x17a
push esi
push 0x17a
push 0x4d3628
call fcn.0044805c
mov al, byte [esp + 0x34]
add esp, 0x10
mov dword [0x4d361c], 0x4d3628
mov byte [0x4d391c], 0
cmp al, 2
jne 0x47baf7
mov eax, dword [esp + 0x25]
lea edx, [esp + 0x38]
push edx
push eax
mov ecx, 0x4d3628
call fcn.00478e40
mov byte [0x4d391c], al
jmp 0x47baf7
cmp al, 1
je 0x47ba7f
cmp al, 5
je 0x47ba7f
cmp al, 4
je 0x47ba7f
cmp al, 6
jne 0x47baba
mov dword [0x4d3624], ebx
mov ecx, dword [esi + 2]
mov dword [0x4d3de0], ecx
cmp esi, 0x4d37a2
je 0x47baae
push 0x17a
push esi
push 0x17a
push 0x4d37a2
call fcn.0044805c
add esp, 0x10
mov dword [0x4d361c], 0x4d37a2
jmp 0x47baf7
cmp al, 3
jne 0x47baf7
mov dword [0x4d3920], ebx
mov edx, dword [esi + 2]
mov dword [0x4d3de4], edx
cmp esi, 0x4d3924
je 0x47baed
push 0x17a
push esi
push 0x17a
push 0x4d3924
call fcn.0044805c
add esp, 0x10
mov dword [0x4d361c], 0x4d3924
mov eax, dword [esp + 0x44]
mov dword [0x4d3618], ebx
test eax, eax
je 0x47bb1d
cmp esi, eax
je 0x47bb1d
push 0x17a
push esi
push 0x17a
push eax
call fcn.0044805c
add esp, 0x10
pop edi
pop ebp
pop ebx
mov eax, dword [esp + 0x30]
pop esi
test eax, eax
je 0x47bb2f
mov cl, byte [esp + 3]
mov byte [eax], cl
mov eax, dword [esp + 0x30]
test eax, eax
je 0x47bb3d
mov dl, byte [esp + 2]
mov byte [eax], dl
mov eax, dword [esp + 4]
add esp, 0x1c
ret 0x18