Function at 0x4a7140
Capabilities:
Contain obfuscated stackstrings
Write file on windows

Disassembly:
push 0x6ec
mov eax, 0x5a9180
call fcn.00553bf3
mov edi, ecx
mov ebx, dword [ebp + 0x14]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x424], esi
cmp ebx, 3
je 0x4a76e6
cmp ebx, 2
je 0x4a717a
cmp ebx, 1
je 0x4a717a
mov eax, 0x10000
jmp 0x4a7780
cmp dword [edi + 4], 0xffffffff
je 0x4a7187
mov ecx, dword [edi]
call fcn.004a5979
mov ecx, dword [edi]
or dword [edi + 4], 0xffffffff
mov eax, dword [ebp + 8]
cmp eax, dword [ecx + 4]
jge 0x4a7170
cmp eax, dword [ecx + 0x10]
jge 0x4a719f
call fcn.004a527e
mov eax, dword [edi]
mov ecx, dword [ebp + 8]
cmp dword [eax + 0x10], ecx
jge 0x4a71bf
mov esi, ecx
mov ecx, dword [edi]
call fcn.004a52b5
mov eax, dword [edi]
cmp dword [eax + 0x10], esi
jl 0x4a71ab
mov esi, dword [ebp - 0x424]
lea eax, [ebp - 0x658]
mov ecx, edi
push eax
push dword [ebp + 8]
call fcn.004a5c14
mov eax, dword [ebp - 0x44c]
shr eax, 4
and al, 1
je 0x4a7215
cmp ebx, 1
je 0x4a7761
movzx eax, word [esi]
cmp eax, 0x2f
je 0x4a7207
cmp eax, 0x5c
je 0x4a7207
test ax, ax
je 0x4a71ff
cmp word [esi + 2], 0x3a
je 0x4a7207
lea ecx, [edi + 0x244]
jmp 0x4a7209
xor ecx, ecx
mov edx, esi
call fcn.004a6f77
jmp 0x4a7761
xor eax, eax
xor ebx, ebx
cmp dword [ebp + 0x14], 1
mov word [ebp - 0x420], ax
je 0x4a7605
movzx eax, word [esi]
mov ecx, esi
push 0x5c
mov dword [ebp - 0x424], esi
mov dword [ebp - 0x6ec], 0x2f
pop edx
jmp 0x4a7261
cmp ax, word [ebp - 0x6ec]
je 0x4a7252
cmp ax, dx
jne 0x4a725b
lea eax, [ecx + 2]
mov dword [ebp - 0x424], eax
add ecx, 2
movzx eax, word [ecx]
test ax, ax
jne 0x4a7244
mov eax, 0x104
push eax
push esi
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.0054efab
mov ecx, dword [ebp - 0x424]
add esp, 0x10
cmp ecx, esi
jne 0x4a7292
xor eax, eax
mov word [ebp - 0x218], ax
jmp 0x4a72e0
mov eax, ecx
sub eax, esi
and eax, 0xfffffffe
cmp eax, 0x208
jae 0x4a76e1
xor edx, edx
mov word [ebp + eax - 0x218], dx
mov ax, word [ebp - 0x218]
push 0x2f
pop edx
cmp ax, dx
je 0x4a742b
push 0x5c
pop edx
cmp ax, dx
je 0x4a742b
test ax, ax
je 0x4a72e0
cmp word [ebp - 0x216], 0x3a
je 0x4a742b
push ecx
lea eax, [ebp - 0x218]
mov dword [ebp - 0x6c0], 0x7246435a
push eax
lea esi, [edi + 0x244]
mov dword [ebp - 0x6bc], 0x79635850
push esi
push ebx
sub esp, 0xc
mov dword [ebp - 0x6b8], 0x4e387750
mov ecx, esp
mov dword [ebp - 0x6b4], 0x784e4147
lea eax, [ebp - 0x66a]
mov dword [ebp - 0x6b0], 0x474d5364
lea edx, [ebp - 0x6c0]
mov dword [ebp - 0x6ac], 0x6255794c
push ecx
push eax
push edx
mov dword [ebp - 0x6a8], 0x4751445a
mov dword [ebp - 0x6a4], 0x36426d42
mov dword [ebp - 0x6a0], 0x396c3359
mov dword [ebp - 0x69c], 0x69744863
mov dword [ebp - 0x698], 0x49637843
mov dword [ebp - 0x694], 0x35704749
mov dword [ebp - 0x690], 0x32463348
mov dword [ebp - 0x68c], 0x7a4e774f
mov dword [ebp - 0x688], 0x65414765
mov dword [ebp - 0x684], 0x55775161
mov dword [ebp - 0x680], 0x6f304441
mov dword [ebp - 0x67c], 0x38395450
mov dword [ebp - 0x678], 0x556b6848
mov dword [ebp - 0x674], 0x32733346
mov dword [ebp - 0x670], 0x41414141
mov word [ebp - 0x66c], 0x674e
call fcn.00450208
lea ecx, [ebp - 0x6f8]
call fcn.004ab586
add esp, 0xc
mov ecx, eax
mov dword [ebp - 4], 1
call fcn.004ab6d2
push eax
lea eax, [ebp - 0x420]
push 0x104
push eax
call fcn.004ab1e3
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x6f8]
add esp, 0x18
call fcn.004ab565
mov ecx, esi
jmp 0x4a75db
push ecx
lea eax, [ebp - 0x218]
mov dword [ebp - 0x6e8], 0x7246435a
push eax
push ebx
sub esp, 0xc
mov dword [ebp - 0x6e4], 0x34495350
mov ecx, esp
mov dword [ebp - 0x6e0], 0x486b684e
lea eax, [ebp - 0x665]
mov dword [ebp - 0x6dc], 0x6e73784c
lea edx, [ebp - 0x6e8]
mov dword [ebp - 0x6d8], 0x66496a64
push ecx
push eax
push edx
mov dword [ebp - 0x6d4], 0x6a737945
mov dword [ebp - 0x6d0], 0x364d6d50
mov dword [ebp - 0x6cc], 0x4c346866
mov dword [ebp - 0x6c8], 0x594d5345
mov dword [ebp - 0x6c4], 0x6d384441
mov dword [ebp - 0x6c0], 0x6e413264
mov dword [ebp - 0x6bc], 0x4141474b
mov dword [ebp - 0x6b8], 0x79785166
mov dword [ebp - 0x6b4], 0x50635247
mov dword [ebp - 0x6b0], 0x54554743
mov dword [ebp - 0x6ac], 0x7167514c
mov dword [ebp - 0x6a8], 0x7267544c
mov dword [ebp - 0x6a4], 0x714d6764
mov dword [ebp - 0x6a0], 0x65517746
mov dword [ebp - 0x69c], 0x46305266
mov dword [ebp - 0x698], 0x506b684b
mov dword [ebp - 0x694], 0x32417a65
mov dword [ebp - 0x690], 0x4f677a4b
mov dword [ebp - 0x68c], 0x6b4d7849
mov dword [ebp - 0x688], 0x564d4442
mov dword [ebp - 0x684], 0x4c495450
mov dword [ebp - 0x680], 0x4f4d774d
mov dword [ebp - 0x67c], 0x4f304865
mov dword [ebp - 0x678], 0x38736945
mov dword [ebp - 0x674], 0x65387742
mov dword [ebp - 0x670], 0x6a594162
mov dword [ebp - 0x66c], 0x41414150
mov word [ebp - 0x668], 0x4641
mov byte [ebp - 0x666], 0x6f
call fcn.00450208
lea ecx, [ebp - 0x6f8]
call fcn.004ab586
add esp, 0xc
mov ecx, eax
mov dword [ebp - 4], ebx
call fcn.004ab6d2
push eax
lea eax, [ebp - 0x420]
push 0x104
push eax
call fcn.004ab1e3
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x6f8]
add esp, 0x14
call fcn.004ab565
xor ecx, ecx
lea edx, [ebp - 0x218]
call fcn.004a6f77
push ebx
push dword [ebp - 0x44c]
lea eax, [ebp - 0x420]
push 2
push ebx
push ebx
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4a7614
mov eax, 0x200
jmp 0x4a7780
mov edx, dword [edi + 0x23c]
mov ecx, dword [edi]
call fcn.004a5585
cmp dword [edi + 0x240], ebx
jne 0x4a763a
push 0x4000
call fcn.005312f2
pop ecx
mov dword [edi + 0x240], eax
mov edx, dword [edi + 0x240]
lea eax, [ebp - 0x659]
mov ecx, dword [edi]
push eax
push 0x4000
call fcn.004a56d5
mov dword [ebp - 0x6ec], eax
pop ecx
pop ecx
cmp eax, 0xffffff96
je 0x4a76a1
test eax, eax
js 0x4a7693
jle 0x4a7686
push ebx
lea ecx, [ebp - 0x424]
push ecx
push eax
push dword [edi + 0x240]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4a769a
mov eax, dword [ebp - 0x6ec]
cmp byte [ebp - 0x659], 0
jne 0x4a76a6
test eax, eax
jne 0x4a763a
mov ebx, 0x5000000
jmp 0x4a76a6
mov ebx, 0x400
jmp 0x4a76a6
mov ebx, 0x1000
mov ecx, dword [edi]
call fcn.004a5979
test ebx, ebx
jne 0x4a76cd
lea eax, [ebp - 0x438]
push eax
lea eax, [ebp - 0x448]
push eax
lea eax, [ebp - 0x440]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
cmp dword [ebp + 0x14], 1
je 0x4a76da
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
jmp 0x4a7780
call fcn.0054dca2
mov ebx, dword [ebp + 8]
cmp ebx, dword [edi + 4]
je 0x4a7732
cmp dword [edi + 4], 0xffffffff
je 0x4a76fb
mov ecx, dword [edi]
call fcn.004a5979
mov ecx, dword [edi]
or dword [edi + 4], 0xffffffff
cmp ebx, dword [ecx + 4]
jge 0x4a7170
cmp ebx, dword [ecx + 0x10]
jge 0x4a771b
call fcn.004a527e
jmp 0x4a771b
call fcn.004a52b5
mov eax, dword [edi]
mov ecx, eax
cmp dword [eax + 0x10], ebx
jl 0x4a7716
mov edx, dword [edi + 0x23c]
call fcn.004a5585
mov dword [edi + 4], ebx
mov ecx, dword [edi]
lea eax, [ebp - 0x659]
push eax
push dword [ebp + 0x10]
mov edx, esi
call fcn.004a56d5
mov esi, eax
pop ecx
pop ecx
test esi, esi
jg 0x4a7758
mov ecx, dword [edi]
call fcn.004a5979
or dword [edi + 4], 0xffffffff
cmp byte [ebp - 0x659], 0
je 0x4a7765
xor eax, eax
jmp 0x4a7780
test esi, esi
jle 0x4a7770
mov eax, 0x600
jmp 0x4a7780
cmp esi, 0xffffff96
mov eax, 0x5000000
mov ecx, 0x1000
cmove eax, ecx
call fcn.00553ba2
ret 0x10