Function at 0x4c66d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51ba70
mov eax, dword fs:[0]
push eax
sub esp, 0x50
push ebx
push esi
push edi
mov eax, dword [0x5a4aa8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x18], ecx
xor esi, esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], esi
cmp dword [ebp + 8], esi
je 0x4c6983
mov edi, dword [ebp + 0xc]
cmp edi, esi
je 0x4c6983
cmp dword [edi], esi
je 0x4c6983
cmp dword [ecx + 0x4808], esi
jne 0x4c6744
lea eax, [esi + 6]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ecx]
mov edx, dword [eax + 0x24]
call edx
test eax, eax
jne 0x4c6764
mov dword [ebp - 0x20], 0xaa
push 0x5814b0
lea eax, [ebp - 0x20]
push eax
call fcn.004fd5a3
mov ebx, dword [edi]
xor eax, eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], eax
push esi
push esi
push 1
push esi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [ebp - 0x4c], eax
cmp eax, esi
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
jne 0x4c67a5
push str.CreateEvent
call esi
mov ecx, eax
mov edx, 0x649e50
call fcn.004917b0
add esp, 4
cmp ebx, 0x1000
jle 0x4c6814
mov edi, dword [ebp + 8]
mov dword [ebp - 0x28], edi
xor esi, esi
mov dword [ebp - 0x24], esi
mov eax, ebx
sub eax, esi
je 0x4c6802
cmp eax, 0x1000
mov dword [ebp - 0x14], 0x1000
jge 0x4c67cf
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx]
lea eax, [ebp - 0x14]
push eax
push edi
mov edx, dword [edx + 8]
call edx
test eax, eax
jne 0x4c67f1
mov eax, dword [ebp - 0x14]
add esi, eax
mov dword [ebp - 0x24], esi
add edi, eax
mov dword [ebp - 0x28], edi
jmp 0x4c67b8
mov dword [ebp - 0x2c], eax
push 0x5814b0
lea eax, [ebp - 0x2c]
push eax
call fcn.004fd5a3
test esi, esi
je 0x4c695b
mov ecx, dword [ebp + 0xc]
mov dword [ecx], esi
jmp 0x4c695b
lea edx, [ebp - 0x5c]
push edx
push edi
push ebx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + 0x4808]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x4c6942
call esi
mov esi, eax
cmp esi, 0x26
je 0x4c692d
cmp esi, 0x3e5
je 0x4c6870
push 0x574738
mov ecx, esi
mov edx, 0x649e50
call fcn.004917b0
add esp, 4
mov dword [ebp - 0x30], esi
push 0x5814b0
lea eax, [ebp - 0x30]
push eax
call fcn.004fd5a3
push 0x64
mov ecx, dword [ebp - 0x4c]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edi, 0x64
mov dword [ebp - 0x38], edi
mov ebx, dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
lea ebx, [ebx]
push 0
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 0x5c]
push eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + 0x4804]
push edx
call ebx
test eax, eax
jne 0x4c6924
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, 0x26
je 0x4c690f
cmp esi, 0x3e4
je 0x4c68e4
push 0x574690
mov ecx, esi
mov edx, 0x649e50
call fcn.004917b0
add esp, 4
mov dword [ebp - 0x34], esi
push 0x5814b0
lea eax, [ebp - 0x34]
push eax
call fcn.004fd5a3
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
add edi, 0x64
mov dword [ebp - 0x38], edi
cmp edi, 0x2710
jbe 0x4c6890
mov dword [ebp - 0x3c], 0x102
push 0x5814b0
lea ecx, [ebp - 0x3c]
push ecx
call fcn.004fd5a3
mov dword [ebp - 0x40], 0
push 0x5814b0
lea edx, [ebp - 0x40]
push edx
call fcn.004fd5a3
mov dword [ebp - 0x1c], 0
jmp 0x4c695b
mov dword [ebp - 0x44], 0
push 0x5814b0
lea eax, [ebp - 0x44]
push eax
call fcn.004fd5a3
call esi
mov dword [ebp - 0x1c], eax
push str.Write_Data
mov ecx, eax
mov edx, 0x649e50
call fcn.004917b0
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx]
mov eax, dword [edx + 0x28]
call eax
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, 0x57
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8