Function at 0x4e7aa0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0xbc
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0xd0]
xor ebp, ebp
mov esi, ecx
push edi
lea ecx, [esp + 0x14]
mov dword [esp + 0x18], 3
mov dword [esp + 0x28], ebp
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x30], ebp
call fcn.004e4c80
mov eax, dword [eax]
push eax
call fcn.00440230
mov bl, al
mov eax, dword [esp + 0x14]
push eax
call fcn.0043f020
add esp, 8
test bl, bl
je 0x4e7d76
push edi
mov ecx, esi
call fcn.004e5970
mov ebp, eax
test ebp, ebp
je 0x4e7d76
push ebp
mov ecx, esi
call fcn.004e4f40
mov edi, eax
test edi, edi
je 0x4e7b23
push edi
mov ecx, esi
call fcn.004e4fb0
push edi
call fcn.0043f020
add esp, 4
push 0x10000000
push 2
push 1
push 0x40000000
push ebp
mov ecx, esi
call fcn.004e4d70
mov edi, eax
test edi, edi
je 0x4e7b48
cmp edi, 0xffffffff
jne 0x4e7c28
push 0
mov ecx, esi
call fcn.004e7910
push eax
push ebp
mov ecx, esi
mov dword [esp + 0x2c], eax
call fcn.004e5460
test al, al
je 0x4e7c28
mov ecx, esi
call fcn.004e7990
lea ecx, [esp + 0x38]
mov edi, eax
push ecx
mov dword [esp + 0x2c], edi
mov dword [esp + 0x3c], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [esp + 0x48], 2
jne 0x4e7bb8
cmp dword [esp + 0x3c], 4
jbe 0x4e7bb8
mov edx, dword [esp + 0x24]
push 1
push edi
push edx
mov ecx, esi
call fcn.004e4f10
push 0x10000000
push 4
push 1
push 0x40000000
mov dword [esp + 0x3c], eax
push ebp
jmp 0x4e7c1f
push edi
lea ecx, [esp + 0x1c]
call fcn.004e4c80
mov edi, dword [eax]
push ebp
lea ecx, [esp + 0x24]
call fcn.004e4c80
mov ebx, dword [eax]
mov eax, dword [esp + 0xd0]
push eax
lea ecx, [esp + 0x14]
call fcn.004e4c80
mov ecx, dword [eax]
push edi
push ebx
push ecx
call fcn.004e5a10
mov edx, dword [esp + 0x1c]
push edx
call fcn.0043f020
mov eax, dword [esp + 0x30]
push eax
call fcn.0043f020
mov ecx, dword [esp + 0x2c]
push ecx
call fcn.0043f020
mov edx, dword [esp + 0x40]
add esp, 0x18
push 0x10000000
push 4
push 1
push 0x40000000
push edx
mov ecx, esi
call fcn.004e4d70
mov edi, eax
test edi, edi
je 0x4e7d76
cmp edi, 0xffffffff
je 0x4e7d76
mov eax, dword [esp + 0xe0]
mov ecx, dword [esp + 0xdc]
push eax
mov eax, dword [esp + 0xdc]
push ecx
mov ecx, dword [esp + 0xdc]
lea edx, [esp + 0x20]
push edx
push eax
xor ebx, ebx
push ecx
mov ecx, esi
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
call fcn.004e6170
test al, al
je 0x4e7d58
mov eax, dword [esp + 0x18]
cmp byte [eax], 0x54
jne 0x4e7d58
cmp byte [eax + 1], 0x72
jne 0x4e7d58
cmp byte [eax + 2], 0x6f
jne 0x4e7d58
cmp byte [eax + 3], 0x79
jne 0x4e7d58
mov ecx, dword [esp + 0x1c]
mov eax, dword [eax + 4]
lea edx, [ecx + ecx*4]
shl edx, 1
cmp eax, edx
mov dword [esp + 0x20], eax
jae 0x4e7d60
push eax
lea ecx, [esp + 0x34]
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebx
call fcn.004e4c10
mov ebx, dword [esp + 0x30]
test ebx, ebx
jne 0x4e7cf0
lea ecx, [esp + 0x30]
mov dword [esp + 0x14], 4
call fcn.004e4bf0
lea ecx, [esp + 0x18]
call fcn.004e4bf0
jmp 0x4e7d69
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
add eax, 0xfffffff8
push eax
add ecx, 8
push ecx
lea edx, [esp + 0x28]
push edx
push ebx
call fcn.004dcff0
add esp, 0x10
test eax, eax
jne 0x4e7d4b
push 2
push eax
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ecx, dword [esp + 0x20]
push 0
lea eax, [esp + 0x14]
push eax
push ecx
push ebx
push edi
mov dword [esp + 0x24], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [esp + 0x10]
cmp edx, dword [esp + 0x20]
jne 0x4e7d4b
mov dword [esp + 0x14], 0
lea ecx, [esp + 0x30]
call fcn.004e4bf0
xor ebx, ebx
jmp 0x4e7d60
mov dword [esp + 0x14], 6
lea ecx, [esp + 0x18]
call fcn.004e4bf0
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x14], ebx
je 0x4e7d9b
push ebp
mov ecx, esi
call fcn.004e4eb0
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x4e7d9b
mov esi, dword [esi + 0x28]
test esi, esi
je 0x4e7d9b
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
push 0
push eax
push ecx
call esi
mov edx, dword [esp + 0x24]
push edx
call fcn.0043f020
mov eax, dword [esp + 0x2c]
push eax
call fcn.0043f020
push ebp
call fcn.0043f020
mov eax, dword [esp + 0x20]
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xbc
ret 0x14