Function at 0x4a21fc
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 4], edi
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
test ebx, ebx
je 0x4a26b7
mov ecx, dword [ebx + 0xd4]
movzx eax, byte [ebx + 0x160]
movzx edx, byte [ebx + 0x161]
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebx + 0x130]
and eax, 0x80
shr eax, 7
mov dword [ebp - 0x18], eax
and edx, 1
xor eax, eax
mov dword [ebp - 0x1c], edx
mov dword [ebx + 0xc0], eax
mov dword [ebx + 0xc4], eax
mov dword [ebx + 0xe0], eax
test edi, edi
jne 0x4a2309
test ebx, ebx
je 0x4a25ce
movzx eax, byte [ebx + 0x15d]
test al, 4
jne 0x4a228e
xor eax, eax
mov dword [ebx + 0xa0], eax
mov dword [ebx + 0xa4], eax
mov ecx, 1
jmp 0x4a25bf
lea eax, [ebp - 0x14]
push 0
push eax
mov edx, dword [ebx + 0x38]
mov esi, dword [ebx + 0x40]
sub esi, edx
push esi
push edx
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, eax
mov eax, dword [ebx + 0x38]
mov edx, dword [ebx + 0xe8]
and byte [ebx + 0x15d], 0xfb
xor edi, edi
test ecx, ecx
mov dword [ebx + 0x40], edi
mov dword [ebx + 0x3c], eax
mov dword [ebx + 0xa0], edi
mov dword [ebx + 0xa4], edi
jne 0x4a22d6
mov ecx, 0xffffffff
add edx, eax
mov dword [ebx + 0x44], edx
mov eax, esi
cdq
mov eax, dword [ebx + 0xb8]
add esi, eax
adc edx, dword [ebx + 0xbc]
mov dword [ebx + 0xb8], esi
mov dword [ebx + 0xb0], esi
mov dword [ebx + 0xbc], edx
mov dword [ebx + 0xb4], edx
jmp 0x4a25bf
test ebx, ebx
je 0x4a2385
mov eax, dword [ebx + 0x40]
mov dword [ebp - 0x20], eax
test eax, eax
je 0x4a2385
cmp esi, dword [ebp - 0x20]
je 0x4a2385
mov edx, eax
mov eax, dword [ebx + 0x38]
sub edx, eax
mov dword [ebp - 0x20], edx
je 0x4a2385
lea edx, [ebp - 0x14]
push 0
mov dword [ebp - 0x24], ecx
push edx
push dword [ebp - 0x20]
push eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 0x24]
test eax, eax
jne 0x4a235d
xor eax, eax
mov dword [ebx + 0xa0], eax
mov dword [ebx + 0xa4], eax
mov ecx, 0xffffffff
jmp 0x4a25bf
mov eax, dword [ebp - 0x20]
cdq
add eax, dword [ebx + 0xb8]
adc edx, dword [ebx + 0xbc]
mov dword [ebx + 0xb8], eax
mov dword [ebx + 0xb0], eax
mov dword [ebx + 0xbc], edx
mov dword [ebx + 0xb4], edx
mov eax, dword [0x5212e8]
test eax, eax
je 0x4a242c
test ecx, ecx
jne 0x4a239d
mov ecx, 0xffffffff
jmp 0x4a2411
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x4a23ad
cmp ecx, 0xfffffffa
je 0x4a2662
cmp ecx, 2
je 0x4a23b7
cmp ecx, 1
jne 0x4a23d1
call fcn.004eb830
mov dword [ebp - 0x24], eax
mov eax, dword [0x5212e8]
test eax, eax
je 0x4a23f7
mov dword [ebp - 0x20], 1
jmp 0x4a23d9
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x4a23f0
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x4a23f0
push dword [ebp - 0x24]
call fcn.004eb810
pop ecx
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x4a242c
push 0
push dword [ebp - 0x24]
push edi
push esi
call fcn.004eb810
add esp, 0x10
mov ecx, eax
cmp ecx, edi
je 0x4a2411
mov ecx, 0xffffffff
test ebx, ebx
je 0x4a25bf
xor edx, edx
mov dword [ebx + 0xa0], edx
mov dword [ebx + 0xa4], edx
jmp 0x4a25bf
test ebx, ebx
je 0x4a249e
movzx eax, byte [ebx + 0x161]
test al, 0x40
jne 0x4a2440
mov edx, dword [ebx + 0x40]
jmp 0x4a2486
movzx eax, byte [ebx + 0x15f]
test al, 1
je 0x4a2450
mov edx, dword [ebx + 0x40]
jmp 0x4a2486
mov eax, dword [ebx + 0x38]
cmp esi, eax
je 0x4a2460
mov edx, dword [ebx + 0x40]
cmp esi, edx
jne 0x4a2491
jmp 0x4a2463
mov edx, dword [ebx + 0x40]
add eax, dword [ebx + 0xdc]
mov ecx, dword [ebx + 0x3c]
mov dword [ebp - 0x20], edi
mov edi, dword [ebx + 0xe8]
mov dword [ebp - 0x24], edi
lea ecx, [ecx + edi*2]
cmp eax, ecx
mov edi, dword [ebp - 0x20]
ja 0x4a258b
cmp esi, edx
jne 0x4a2491
mov esi, dword [ebx + 0x38]
add edi, edx
sub edi, esi
mov eax, dword [ebx + 0x12c]
cmp eax, 0x40000
ja 0x4a24a3
mov eax, 0x40000
cmp edi, eax
jbe 0x4a2510
mov ecx, edi
test ebx, ebx
je 0x4a24bb
mov edx, dword [ebx + 0x12c]
cmp edx, 0x40000
ja 0x4a24c0
mov edx, 0x40000
mov dword [ebp - 0x1c], ecx
mov eax, esi
mov dword [ebp - 0x20], edi
mov edi, dword [ebp - 0x10]
mov dword [ebp - 0x24], esi
mov esi, edx
mov dword [ebp - 0x18], ebx
mov ebx, eax
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
cmp edi, eax
je 0x4a261f
lea ecx, [ebp - 0x14]
push 0
push ecx
push esi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, eax
cmp ecx, 1
je 0x4a25d5
mov edi, dword [ebp - 0x20]
mov ebx, dword [ebp - 0x18]
test ecx, ecx
jne 0x4a2534
mov ecx, 0xffffffff
jmp 0x4a2534
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
cmp eax, dword [ebp - 0x10]
je 0x4a2674
lea eax, [ebp - 0x14]
push 0
push eax
push edi
push esi
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, eax
test ebx, ebx
je 0x4a25bf
mov edx, dword [ebx + 0x38]
add edx, dword [ebx + 0xe8]
xor esi, esi
mov dword [ebx + 0x40], esi
mov dword [ebx + 0x44], edx
and byte [ebx + 0x15d], 0xfb
mov eax, edi
cdq
mov eax, dword [ebx + 0xb8]
add edi, eax
adc edx, dword [ebx + 0xbc]
mov dword [ebx + 0xb8], edi
mov dword [ebx + 0xb0], edi
mov dword [ebx + 0xbc], edx
mov dword [ebx + 0xb4], edx
mov dword [ebx + 0xa0], esi
mov dword [ebx + 0xa4], esi
jmp 0x4a25bf
mov ecx, dword [ebp - 0x24]
or byte [ebx + 0x15d], 4
add esi, edi
mov dword [ebx + 0x40], esi
add dword [ebx + 0x44], ecx
mov eax, edi
cdq
add dword [ebx + 0xb0], edi
adc dword [ebx + 0xb4], edx
xor esi, esi
mov dword [ebx + 0xa0], esi
mov dword [ebx + 0xa4], esi
mov ecx, 1
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov eax, ecx
mov esp, ebp
pop ebp
ret
mov ecx, 1
jmp 0x4a25bf
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x18]
sub dword [ebp - 0x1c], eax
add ebx, eax
test edx, edx
je 0x4a25f2
mov edx, dword [edx + 0x12c]
cmp edx, 0x40000
ja 0x4a25f7
mov edx, 0x40000
cmp edx, dword [ebp - 0x1c]
jb 0x4a2605
mov esi, dword [ebp - 0x1c]
test esi, esi
jne 0x4a260c
jmp 0x4a2614
mov edx, dword [ebp - 0x1c]
test edx, edx
je 0x4a2614
test eax, eax
ja 0x4a24d5
mov edi, dword [ebp - 0x20]
mov ebx, dword [ebp - 0x18]
jmp 0x4a2534
push edi
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 2
jne 0x4a24e5
push esi
push ebx
push 1
call fcn.004d4512
add esp, 0xc
cmp eax, 0xffffffff
je 0x4a264a
mov dword [ebp - 0x14], eax
mov ecx, 1
jmp 0x4a25d8
lea ecx, [ebp - 0x14]
push 0
push ecx
push dword [ebp - 0x20]
push dword [ebp - 0x24]
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x4a24f4
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x24], eax
jmp 0x4a23e0
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 2
jne 0x4a2521
push edi
push esi
push 1
call fcn.004d4512
add esp, 0xc
cmp eax, 0xffffffff
je 0x4a26a1
mov ecx, 1
jmp 0x4a2534
lea eax, [ebp - 0x14]
push 0
push eax
push edi
push esi
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x4a2532
mov eax, dword [0x5212e8]
test eax, eax
jne 0x4a26e0
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [ebp - 0x10], eax
mov eax, dword [0x5212e8]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], eax
mov ecx, 1
jmp 0x4a225b
call fcn.004eb830
jmp 0x4a26c8