Function at 0x61e5b4
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x8c]
sub esp, 0x10c
add eax, edi
push dword [0x493790]
xor eax, dword [esp + 0x28]
or eax, 0xffffffd9
pop eax
mov ecx, dword [ebp + 0x94]
push ebx
push esi
mov dword [ebp + 0x88], eax
xor edx, edx
push edi
xor eax, eax
cmp ecx, dword [eax*8 + 0x4941c8]
je 0x61e5fc
inc eax
cmp eax, 0x13
jb 0x61e5e5
xor esi, dword [esp + 8]
sbb esi, 0x45
xor esi, dword [esp + 0x28]
mov esi, 0x467d72
lea esi, [ecx + edx]
lea esi, [eax + ebp + 0x7b]
sub esi, ebp
lea esi, [ebx + esi - 0x7b]
sub esi, ebx
shl esi, 3
cmp ecx, dword [esi + 0x4941c8]
jne 0x61e928
rol eax, 0xf
mov eax, 0x48af56
rcr eax, 0xa3
xor eax, dword [esp + 0x28]
lea eax, [ebp + esi + 0x6d]
lea eax, [ecx + edx + 0x4e5cec]
sub eax, ecx
sub eax, edx
push dword [eax]
or eax, ebp
pop eax
cmp eax, 1
je 0x61ea8c
cmp eax, edx
jne 0x61e66b
cmp dword [0x493bb0], 1
je 0x61ea8c
cmp ecx, 0xfc
je 0x61e928
push 0x4a833a
pushf
push ecx
lea ecx, [ebx + esi - 0x1c]
sub ecx, 0xffffffc5
mov ecx, 0x404202
sbb ecx, 0x792bc322
lea ecx, [esp + ebp + 0xc]
sub ecx, ebp
sub ecx, 0xc
lea ecx, [ecx + edi + 6]
sub ecx, edi
push esi
adc esi, 0x6ef1978
lea esi, [ebx + 0x104]
sub esi, ebx
push esi
pop dword [ecx]
pop esi
pop ecx
popf
lea eax, [ebp - 0x80]
push eax
push edx
mov byte [ebp + 0x84], dl
call dword [sym.imp.kernel32.dll_GetModuleFileNameA]
test eax, eax
jne 0x61e715
lea eax, [ebp - 0x80]
push dword [esp + 0x20]
pushf
push ecx
add ecx, ebp
adc ecx, ebp
add ecx, dword [esp + 0x38]
xor ecx, dword [esp + 8]
lea ecx, [esp + eax + 0x42]
sub ecx, eax
lea ecx, [eax + ecx - 0x42]
sub ecx, eax
lea ecx, [ecx + edi + 6]
sub ecx, edi
push edi
sub edi, dword [esp]
lea edi, [ebx + ecx*2 - 0x5e]
lea edi, [eax + 0x482a58]
sub edi, eax
mov dword [ecx], edi
pop edi
pop ecx
popf
push eax
call fcn.00451080
pop ecx
pop ecx
lea edi, [ebp - 0x80]
xor eax, dword [esp + 8]
mov eax, 0x40fdba
sub eax, 0xffffff95
rcr eax, 0x87
lea eax, [edi + 0x14]
lea eax, [eax - 0x14]
push eax
call fcn.0044af40
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x61e7bb
add eax, dword [esp + 0x38]
add eax, dword [esp + 0x18]
push edi
sub eax, ebp
pop eax
push eax
call fcn.0044af40
xor edi, dword [esp + 0x28]
sbb edi, 0xffffffe9
lea edi, [ecx + edx + 0x57]
sub edi, edx
lea edi, [eax + 0x61]
lea edi, [eax + edi - 0x61]
sub edi, eax
lea eax, [ebp - 0x80]
lea eax, [eax - 0x3b]
push 3
lea edi, [eax + edi]
push dword [esp + 0x10]
pushf
push ecx
sbb ecx, 0x3fd8c9a6
lea ecx, [ebp + esi + 0x41cc58]
sub ecx, esi
lea ecx, [esp + 0x2d]
lea ecx, [ecx - 0x2d]
lea ecx, [ecx + 6]
push eax
adc eax, 0x12c4d4ca
xor eax, dword [esp + 0x28]
mov eax, 0x43d262
lea eax, [ebp + esi + 0x482a54]
sub eax, esi
sub eax, ebp
push eax
pop dword [ecx]
pop eax
pop ecx
popf
push edi
call fcn.0044a420
add esp, 0x10
push edi
call fcn.0044af40
push dword [esi + 0x4941cc]
and ebx, ecx
push eax
xor ebx, dword [esp + 8]
add ebx, dword [esp + 0x18]
pop ebx
call fcn.0044af40
lea eax, [eax + ebx + 0x1c]
pop ecx
lea eax, [eax + 3]
pop ecx
and eax, 0xfffffffc
call fcn.00447580
lea ebx, [esi + 0x405972]
sub ebx, 0x6d
mov ebx, 0x42b452
rcl ebx, 0x61
xor ebx, dword [esp + 0x28]
lea ebx, [esp + eax + 0x20]
sub ebx, eax
lea ebx, [ecx + ebx - 0x20]
sub ebx, ecx
push 0x401bfe
pushf
push esi
add esi, dword [esp + 0x38]
mov esi, 0x421126
sbb esi, 0xffffff8b
mov esi, 0x47b2ce
lea esi, [esp + 0x36]
lea esi, [esi - 0x36]
lea esi, [eax + esi + 6]
sub esi, eax
push dword [esp + 0x20]
push eax
mov eax, 0x49af22
rcl eax, 0xd
add eax, dword [esp + 0x18]
xor eax, dword [esp + 0x28]
lea eax, [ebp + esi*2 + 0x4d]
sub eax, 0x4d
lea eax, [esp + ecx + 0x24]
sub eax, ecx
lea eax, [eax + ecx - 0x24]
sub eax, ecx
lea eax, [eax + ecx + 4]
sub eax, ecx
push 0x483708
pop dword [eax]
pop eax
pop dword [esi]
pop esi
popf
push ebx
call fcn.00451080
push edi
push ebx
call fcn.00451090
push 0xc92e7730
pushf
push ebx
add ebx, ebp
mov ebx, esp
lea ebx, [ebx + 6]
push 0x482a50
pop dword [ebx]
pop ebx
popf
push ebx
call fcn.00451090
push dword [esi + 0x4941cc]
push ebx
call fcn.00451090
push 0x74
pushf
push edi
and edi, ebx
add edi, 0x6f94db24
lea edi, [esp + 0x3e]
lea edi, [ebp + edi - 0x3e]
sub edi, ebp
lea edi, [eax + edi + 6]
sub edi, eax
push edx
push edi
lea edi, [ebx + ecx*2 + 0x35]
sub edi, 0x35
mov edi, esp
lea edi, [eax + edi + 4]
sub edi, eax
push 0x12010
pop dword [edi]
pop edi
pop dword [edi]
pop edi
popf
push dword fs:[0]
pushf
push edi
add edi, ecx
lea edi, [ecx + edx*2 + 0x6c]
lea edi, [eax + edi - 0x6c]
sub edi, eax
lea edi, [esp + 0x4a]
lea edi, [ebp + edi - 0x4a]
sub edi, ebp
lea edi, [eax + edi + 6]
sub edi, eax
push eax
and eax, ecx
add eax, dword [esp + 0x38]
rcr eax, 0x2b
lea eax, [ebp + esi + 0x482a1c]
sub eax, esi
sub eax, ebp
mov dword [edi], eax
pop eax
pop edi
popf
push ebx
call fcn.00454284
add esp, 0x2c
lea esp, [ebp - 0x8c]
mov ecx, dword [ebp + 0x88]
call fcn.004475ee
pop edi
pop esi
pop ebx
add ebp, 0xf5aeaf88
push esi
push edi
push edx
sbb edx, ecx
lea edx, [ecx - 0x41]
rcr edx, 0xaf
sub edx, 0x4b
lea edx, [ebp + esi + 0x55c74e38]
sub edx, esi
sub edx, ebp
xor edx, 0xfffffff3
not edx
xchg edx, edi
xor edi, 0x5f961ea1
neg edi
mov esi, dword [esp + 0x10]
lea esi, [ebp + esi - 0x45]
push ebx
push eax
push edi
push 0x69dcb72a
pop eax
xchg edi, eax
xor edi, 0x8cb324f1
neg edi
push edi
lea eax, [ecx + edx*2 + 0x1f]
pop eax
rol eax, 3
inc eax
push eax
or ebx, 0x99efbcb3
pop ebx
xor ebx, 0xd48361b7
ror eax, 0x95
xor eax, dword [esp + 8]
xor eax, dword [esp + 8]
mov eax, 0x49600a
lea eax, [ebx + 0x46]
push edx
push ebx
push esi
or esi, 0x27
add esi, dword [esp + 0x18]
mov esi, 0xb993bdde
xor esi, 0xffffffaa
inc esi
lea ebx, [ecx + edx]
adc ebx, 0x791924c2
sub ebx, 0x9fc73bda
lea ebx, [ebp + esi + 0x10]
sub ebx, ebp
sub ebx, 0x10
sub ebx, 0x4eec4275
neg ebx
xchg ebx, edx
ror edx, 0xd7
ror esi, 1
rcl esi, 0x7d
mov esi, edx
add eax, esi
mov esi, 0x49afc2
add esi, dword [esp + 0x18]
pop esi
add ebx, esi
pop ebx
add edx, 0xb7bfd323
pop edx
lea eax, [eax + ebx - 0x4d]
push ebp
push edi
push ecx
sbb ebp, 0x2f
mov ebp, 0x4307e2
push 0xfffffdad
adc ebp, 0x26503bd2
pop ebp
lea ecx, [ebp + esi + 0x4143d8]
mov ecx, ebp
xor ecx, 3
xchg ecx, edi
xor edi, 0xffffffee
mov ebp, 0x44cdd6
add ebp, dword [esp + 0x38]
push edi
lea ebp, [ecx + edx - 0x3f]
pop ebp
ror ebp, 0xc6
inc ebp
sub eax, ebp
xor ecx, dword [esp + 8]
mov ecx, 0x432766
pop ecx
lea edi, [ebp + esi + 0x483ab8]
pop edi
rol ebp, 5
xor ebp, 0x58
pop ebp
sub eax, ebx
sub esi, eax
pop edi
pop eax
pop ebx
mov esi, edi
add esi, 0xffffff91
xchg esi, edx
sub ebp, edx
lea edx, [eax + ebp + 0x70]
sub edx, 0x70
pop edx
mov edi, 0x41f456
mov edi, 0x46bc0e
pop edi
adc esi, 0x64f247b2
pop esi
leave
ret
push edx
lea eax, [ebp + 0x94]
push eax
lea esi, [esi + 0x4941cc]
push dword [esi]
call fcn.0044af40
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.kernel32.dll_GetStdHandle]
push eax
call dword [sym.imp.kernel32.dll_WriteFile]
jmp 0x61e928