Function at 0x4eb0c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x7c
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
test edx, edx
je 0x4eb3fd
test eax, eax
je 0x4eb3fd
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 8]
mov edx, eax
mov dword [ebp - 0x64], eax
mov eax, dword [eax + 8]
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x68], 1
mov eax, dword [eax]
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x6c], 0
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x58], eax
mov eax, dword [edx + 0x14]
xor esi, esi
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x28], 0
test eax, eax
jle 0x4eb2ee
shl eax, 2
sub esp, 0xc
push eax
call dword [0x519084]
add esp, 0x10
mov dword [ebp - 0x40], eax
test eax, eax
je 0x4eb3f3
mov edx, dword [ebp + 8]
mov edi, eax
cld
mov ecx, dword [edx + 0x14]
mov eax, esi
shl ecx, 2
shr ecx, 2
rep stosd dword es:[edi], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [ebp - 0x84], eax
mov edi, dword [ebp - 0x6c]
test edi, edi
jne 0x4eb377
mov ebx, dword [ebp - 0x58]
test ebx, ebx
je 0x4eb377
mov eax, dword [ebp - 0x34]
mov esi, dword [ebp - 0x2c]
add eax, esi
cmp byte [eax], 0
jne 0x4eb1b4
cmp dword [ebx], 2
je 0x4eb377
mov dword [ebp - 0x10], 1
cmp byte [eax], 0
jne 0x4eb1cb
mov eax, dword [ebp - 0x40]
test eax, eax
je 0x4eb589
mov edx, dword [ebp - 0x54]
mov dword [ebp - 0x50], 0
mov eax, edx
cmp dword [ebx + 0x18], edx
jg 0x4eb290
jmp 0x4eb34a
mov edx, dword [ebp - 0x40]
test edx, edx
je 0x4eb370
mov ecx, dword [edx + eax*4]
lea edx, [eax*8]
mov eax, dword [ebp - 0x64]
mov esi, dword [eax + 0x18]
add edx, esi
mov eax, dword [edx]
cmp ecx, eax
jl 0x4eb280
mov edx, dword [edx + 4]
cmp ecx, edx
jg 0x4eb280
xor ecx, ecx
cmp eax, edx
je 0x4eb2e4
cmp dword [edi + 0x10], 1
je 0x4eb236
mov ebx, dword [edi + 0xc]
test ebx, ebx
js 0x4eb240
test ecx, ecx
jne 0x4eb240
mov ebx, dword [ebp - 0x58]
mov eax, dword [ebp - 0x54]
inc eax
cmp dword [ebx + 0x18], eax
jle 0x4eb240
lea eax, [ebp - 0x6c]
call fcn.004ea660
nop
mov edx, dword [edi + 8]
test edx, edx
js 0x4eb53d
mov ebx, dword [ebp - 0x40]
test ebx, ebx
je 0x4eb370
mov eax, dword [ebp - 0x64]
test eax, eax
je 0x4eb370
mov ecx, dword [eax + 0x18]
test ecx, ecx
je 0x4eb370
lea ebx, [ebx + edx*4]
mov eax, dword [ebx]
cmp eax, dword [ecx + edx*8 + 4]
jl 0x4eb53a
mov ebx, dword [ebp - 0x58]
nop
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebx + 0x18], eax
jle 0x4eb34a
lea eax, [eax + eax*4]
lea edi, [eax*4]
mov eax, dword [ebx + 0x1c]
add edi, eax
mov eax, dword [edi + 4]
test eax, eax
js 0x4eb280
mov eax, dword [edi + 0xc]
mov esi, dword [edi]
test eax, eax
jns 0x4eb1e5
test esi, esi
je 0x4eb610
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x2c]
add eax, ecx
cmp byte [eax], 0
jne 0x4eb2fa
mov eax, dword [esi + 0xc]
test eax, eax
jne 0x4eb280
mov esi, dword [esi + 0x10]
test esi, esi
jle 0x4eb280
mov dword [ebp - 0x50], 1
mov dword [ebp - 0x10], 0
mov ecx, 1
jmp 0x4eb219
mov dword [ebp - 0x40], 0
jmp 0x4eb17a
push edx
lea edx, [ebp - 0x10]
push edx
push eax
push 0
call fcn.00438260
mov edx, eax
mov eax, esi
call fcn.004e6f60
add esp, 0x10
mov dword [ebp - 0x78], eax
dec eax
je 0x4eb408
cmp dword [ebp - 0x78], 0
jne 0x4eb33a
mov eax, dword [esi + 0xc]
test eax, eax
jne 0x4eb27b
mov eax, dword [esi + 0x10]
test eax, eax
jg 0x4eb2d6
jmp 0x4eb27b
jge 0x4eb27b
mov dword [ebp - 0x6c], 0xfffffffc
mov eax, dword [ebp - 0x54]
test eax, eax
jne 0x4eb35c
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x18]
test eax, eax
jne 0x4eb188
mov dword [ebp - 0x68], 0
lea eax, [ebp - 0x6c]
call fcn.004ea5d0
jmp 0x4eb188
mov dword [ebp - 0x6c], 0xffffffff
mov esi, dword [ebp - 0x44]
test esi, esi
je 0x4eb3c0
mov ebx, dword [ebp - 0x40]
test ebx, ebx
je 0x4eb3b3
mov ecx, dword [ebp - 0x4c]
test ecx, ecx
jle 0x4eb3b3
xor ebx, ebx
nop
mov eax, ebx
shl eax, 4
mov eax, dword [eax + esi + 0xc]
test eax, eax
je 0x4eb3ad
sub esp, 0xc
push eax
call dword [0x519080]
add esp, 0x10
mov esi, dword [ebp - 0x44]
inc ebx
cmp dword [ebp - 0x4c], ebx
jg 0x4eb390
sub esp, 0xc
push esi
call dword [0x519080]
add esp, 0x10
mov edx, dword [ebp - 0x58]
or eax, 0xffffffff
test edx, edx
je 0x4eb3eb
mov eax, dword [ebp - 0x40]
test eax, eax
je 0x4eb3de
sub esp, 0xc
push eax
call dword [0x519080]
add esp, 0x10
mov eax, dword [ebp - 0x6c]
test eax, eax
jne 0x4eb51d
mov al, 1
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov edx, str.running_regexp
call fcn.004e7bf0
lea esp, [ebp - 0xc]
or eax, 0xffffffff
pop ebx
pop esi
pop edi
pop ebp
ret
mov ecx, dword [esi + 0xc]
mov dword [ebp - 0x70], ecx
test ecx, ecx
js 0x4eb2e4
mov eax, dword [esi + 0x10]
mov dword [ebp - 0x74], eax
test eax, eax
jle 0x4eb2e4
mov ecx, dword [ebp + 8]
mov edx, dword [edi + 4]
mov eax, dword [ecx + 8]
mov edx, dword [eax + edx*4]
mov dword [ebp - 0x7c], edx
mov edx, dword [edi + 8]
test edx, edx
js 0x4eb46d
mov ebx, dword [ebp - 0x40]
test ebx, ebx
je 0x4eb370
mov eax, dword [ebp - 0x64]
test eax, eax
je 0x4eb370
mov ecx, dword [eax + 0x18]
test ecx, ecx
je 0x4eb370
lea ebx, [ebx + edx*4]
mov eax, dword [ebx]
cmp eax, dword [ecx + edx*8 + 4]
jge 0x4eb27b
inc eax
mov dword [ebx], eax
mov ebx, dword [ebp - 0x58]
mov eax, dword [ebp - 0x54]
inc eax
cmp dword [ebx + 0x18], eax
jg 0x4eb637
mov dword [ebp - 0x50], 1
jmp 0x4eb4c0
push edx
lea edx, [ebp - 0x10]
push edx
mov ebx, dword [ebp - 0x34]
add eax, ebx
push eax
push 0
call fcn.00438260
mov edx, eax
mov eax, esi
call fcn.004e6f60
mov ecx, dword [ebp - 0x50]
inc ecx
add esp, 0x10
mov dword [ebp - 0x50], ecx
cmp eax, 1
jne 0x4eb5c6
mov ecx, dword [esi + 0x10]
mov eax, dword [esi + 0xc]
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x70], eax
mov ecx, dword [ebp - 0x50]
cmp ecx, dword [ebp - 0x74]
je 0x4eb5cf
mov ebx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x34]
mov edx, ebx
add edx, eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], edx
cmp byte [eax + edx], 0
je 0x4eb650
mov ecx, dword [ebp - 0x70]
cmp dword [ebp - 0x50], ecx
jl 0x4eb486
mov eax, dword [ebp - 0x58]
mov edx, dword [ebp - 0x7c]
mov ebx, dword [ebp - 0x54]
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x54], 0xffffffff
lea eax, [ebp - 0x6c]
mov dword [ebp - 0x58], edx
call fcn.004ea660
mov ecx, dword [ebp - 0x80]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x58], ecx
jmp 0x4eb486
cmp eax, 0xffffffff
jne 0x4eb3eb
cmp dword [ebp - 0x14], 0x989680
jg 0x4eb3eb
xor eax, eax
jmp 0x4eb3eb
inc eax
mov dword [ebx], eax
mov eax, dword [edi + 0xc]
cmp eax, 0x123455
ja 0x4eb559
mov edx, dword [ebp - 0x40]
test edx, edx
je 0x4eb370
mov dword [edx + eax*4], 0
mov ecx, dword [ebp + 8]
mov eax, dword [edi + 4]
mov dword [ebp - 0x54], 0
mov edx, dword [ecx + 8]
mov ecx, dword [edi]
test ecx, ecx
mov eax, dword [edx + eax*4]
mov dword [ebp - 0x58], eax
je 0x4eb188
mov edx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x10]
add edx, eax
mov dword [ebp - 0x34], edx
jmp 0x4eb188
mov edx, dword [ebp - 0x54]
cmp edx, dword [ebx + 0x18]
jge 0x4eb35c
lea eax, [edx + edx*4]
mov edi, dword [ebx + 0x1c]
lea eax, [edi + eax*4]
mov esi, dword [eax + 4]
test esi, esi
js 0x4eb1ce
mov eax, dword [eax]
mov ecx, dword [eax + 0xc]
test ecx, ecx
jne 0x4eb35c
mov eax, dword [eax + 0x10]
test eax, eax
jg 0x4eb1ce
jmp 0x4eb35c
mov esi, dword [esi + 0xc]
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x70], esi
cmp ecx, dword [ebp - 0x70]
jl 0x4eb35c
cmp dword [ebp - 0x78], 0
jl 0x4eb35c
je 0x4eb35c
mov edx, dword [edi + 8]
test edx, edx
js 0x4eb601
mov eax, dword [ebp - 0x40]
test eax, eax
je 0x4eb370
mov ecx, dword [eax + edx*4]
dec ecx
mov dword [eax + edx*4], ecx
cmp dword [ebp - 0x78], 1
jne 0x4eb27b
jmp 0x4eb2e4
mov ebx, dword [ebp - 0x84]
push ebx
push 0x23
push 1
push str.epsilon_transition_left_at_runtime_n
call sub.msvcrt.dll_fwrite
mov eax, dword [ebp - 0x54]
add esp, 0x10
mov dword [ebp - 0x6c], 0xfffffffe
jmp 0x4eb34a
lea eax, [ebp - 0x6c]
call fcn.004ea660
mov eax, dword [esi + 0x10]
mov edx, dword [esi + 0xc]
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x70], edx
jmp 0x4eb47d
sub edx, ebx
mov dword [ebp - 0x34], edx
mov esi, dword [esi + 0xc]
mov dword [ebp - 0x70], esi
jmp 0x4eb5cf