Function at 0x4dcbec
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x4dce48
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x10]
mov eax, 0x4dce58
call fcn.0065ca3c
mov eax, dword [ebp - 0x10]
push eax
call fcn.00501d74
mov eax, dword [eax + 0x1b0]
add eax, 0x3c
mov edx, dword [0x672714]
mov edx, dword [edx]
mov edx, dword [edx + 0x18]
mov edx, dword [edx + 8]
pop ecx
call fcn.00403b24
call fcn.00501d74
mov eax, dword [eax + 0x1b0]
mov byte [eax + 0x5a], 2
call fcn.00501d74
mov eax, dword [eax + 0x1b0]
mov edx, dword [eax]
call dword [edx + 0x28]
test al, al
je 0x4dce22
call fcn.005397ec
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x10]
mov ebx, dword [eax + 0x18]
dec ebx
test ebx, ebx
jl 0x4dcca2
inc ebx
xor esi, esi
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x1c]
mov edi, dword [eax + esi*4]
cmp byte [edi + 0x41e], 0
je 0x4dcc9e
mov eax, edi
call fcn.0059aa2c
test al, al
jne 0x4dce22
inc esi
dec ebx
jne 0x4dcc7a
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x10]
mov ebx, dword [eax + 0x18]
dec ebx
test ebx, ebx
jl 0x4dcd43
inc ebx
xor esi, esi
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x1c]
mov edi, dword [eax + esi*4]
cmp byte [edi + 0x454], 0
jne 0x4dcd3b
cmp byte [edi + 0x434], 0
je 0x4dcce4
mov eax, dword [edi + 0x158]
call fcn.0065cc54
test al, al
je 0x4dcd3b
cmp dword [ebp - 4], 0
je 0x4dccf7
lea eax, [ebp - 4]
mov edx, 0x4dce74
call fcn.00403524
call fcn.005397f4
mov edx, dword [ebp - 0xc]
mov edx, dword [edx + 0x10]
mov edx, dword [edx + 0x1c]
cmp eax, dword [edx + esi*4]
jne 0x4dcd17
lea eax, [ebp - 4]
mov edx, 0x4dce80
call fcn.00403524
lea edx, [ebp - 0x10]
mov eax, dword [edi + 0x158]
call fcn.006301a4
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0x14]
call fcn.0065c920
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 4]
call fcn.00403524
inc esi
dec ebx
jne 0x4dccb7
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.0065cb10
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 4]
call fcn.0040330c
call fcn.00501d74
mov eax, dword [eax + 0x1b0]
lea edx, [ebp - 0x10]
call fcn.006371a0
mov eax, dword [ebp - 0x10]
call fcn.00660d7c
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4dcdb7
call fcn.00501d74
mov eax, dword [eax + 0x1b0]
lea edx, [ebp - 0x10]
call fcn.006371a0
mov edx, dword [ebp - 0x10]
lea ecx, [ebp - 0x14]
mov eax, 0x4dce84
call fcn.0065d968
mov eax, dword [ebp - 0x14]
mov cx, word [0x4dcea0]
mov dl, 1
call fcn.0062941c
cmp ax, 4
jne 0x4dce22
jmp 0x4dcd59
cmp dword [ebp - 4], 0
je 0x4dce1c
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.0040351c
push eax
mov eax, dword [ebp - 4]
push eax
push ebx
call sub.kernel32.dll_WriteFile
test eax, eax
jne 0x4dce1c
call fcn.00501d74
mov eax, dword [eax + 0x1b0]
lea edx, [ebp - 0x10]
call fcn.006371a0
mov edx, dword [ebp - 0x10]
lea ecx, [ebp - 0x14]
mov eax, 0x4dce84
call fcn.0065d968
mov eax, dword [ebp - 0x14]
mov cx, word [0x4dcea4]
mov dl, 1
call fcn.0062941c
cmp ax, 2
jne 0x4dcdbd
push ebx
call sub.kernel32.dll_CloseHandle
jmp 0x4dce22
push ebx
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4dce4f
lea eax, [ebp - 0x14]
call fcn.00403274
lea eax, [ebp - 0x10]
call fcn.00403880
lea eax, [ebp - 4]
call fcn.00403274
ret