Function at 0x4f51d0
Capabilities:
Get file size
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x854
mov eax, dword [0x594ccc]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 4], 0
jne 0x4f54ea
cmp dword [esi], 0xffffffff
jne 0x4f54ea
push edi
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x412]
push ecx
mov dword [esi + 4], 1
mov word [ebp - 0x414], ax
call fcn.0051d250
xor edx, edx
push 0x206
push edx
lea eax, [ebp - 0x20a]
push eax
mov word [ebp - 0x20c], dx
call fcn.0051d250
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
add esp, 0x18
push 0x104
lea ecx, [ebp - 0x61c]
push ecx
push 0
call edi
mov eax, dword [0x59941c]
push 0x104
lea edx, [ebp - 0x824]
push edx
push eax
call edi
mov edi, dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
lea ecx, [ebp - 0x61c]
push ecx
call edi
push eax
push 0x104
lea edx, [ebp - 0x20c]
push edx
call fcn.00436d90
lea eax, [ebp - 0x20c]
push 0x2e
push eax
call fcn.0051dd68
add esp, 8
test eax, eax
je 0x4f52a0
xor ecx, ecx
mov word [eax + 2], cx
lea edx, [ebp - 0x824]
push edx
call edi
push eax
push 0x104
lea eax, [ebp - 0x20c]
push eax
call fcn.00436d90
lea ecx, [ebp - 0x20c]
push 0x2e
push ecx
call fcn.0051dd68
add esp, 8
test eax, eax
je 0x4f52d6
xor edx, edx
mov word [eax + 2], dx
push 0x56df9c
push 0x104
lea eax, [ebp - 0x20c]
push eax
call fcn.00436d90
lea eax, [ebp - 0x414]
lea edi, [ebp - 0x61c]
mov ecx, eax
mov edx, 0x104
sub edi, ecx
lea ecx, [edx + 0x7ffffefa]
test ecx, ecx
je 0x4f5321
movzx ecx, word [edi + eax]
test cx, cx
je 0x4f5321
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x4f5301
jmp 0x4f5325
test edx, edx
jne 0x4f5328
sub eax, 2
mov edi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
xor edx, edx
mov word [eax], dx
push 0x56de94
lea eax, [ebp - 0x414]
push eax
call edi
lea ecx, [ebp - 0x20c]
push ecx
lea edx, [ebp - 0x414]
push edx
call edi
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileW]
push 0
push 0x80
push 3
push 0
push 7
push 0x40000000
lea eax, [ebp - 0x414]
push eax
call edi
mov dword [esi], eax
cmp eax, 0xffffffff
je 0x4f5397
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0x500000
jbe 0x4f53e0
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x4f5397
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0x80
push 2
push 0
push 3
push 0x40000000
lea ecx, [ebp - 0x414]
push ecx
call edi
mov dword [esi], eax
cmp eax, 0xffffffff
je 0x4f54e9
push 0
lea edx, [ebp - 0x838]
push edx
push 2
lea ecx, [ebp - 0x840]
push ecx
push eax
mov dword [ebp - 0x840], 0xfeff
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [esi]
push 2
push 0
push 0
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [ebp - 0x844]
push eax
lea ecx, [ebp - 0x84c]
push ecx
lea edx, [ebp - 0x854]
push edx
lea eax, [ebp - 0x83c]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
test eax, eax
je 0x4f54a8
lea ecx, [ebp - 0x83c]
push ecx
mov edx, ecx
push edx
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
lea eax, [ebp - 0x834]
push eax
lea ecx, [ebp - 0x83c]
push ecx
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
movzx edx, word [ebp - 0x826]
movzx eax, word [ebp - 0x828]
movzx ecx, word [ebp - 0x82a]
push edx
movzx edx, word [ebp - 0x82c]
push eax
movzx eax, word [ebp - 0x82e]
push ecx
movzx ecx, word [ebp - 0x832]
push edx
movzx edx, word [ebp - 0x834]
push eax
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
lea eax, [ebp - 0x61c]
push eax
push str.Process__s__d___
push esi
call fcn.004fab30
add esp, 0x2c
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0051d23b
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x834]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx edx, word [ebp - 0x82e]
movzx eax, word [ebp - 0x832]
movzx ecx, word [ebp - 0x834]
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
lea edx, [ebp - 0x61c]
push edx
push 0x56def0
push esi
call fcn.004fab30
add esp, 0x1c
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0051d23b
mov esp, ebp
pop ebp
ret