Function at 0x4e0d51
Capabilities:
Write file on windows

Disassembly:
push 0xc4c
push 0x68aac0
call fcn.00594220
mov edi, edx
mov dword [ebp - 0xc34], edi
xor ebx, ebx
test ecx, ecx
je 0x4e0d70
mov byte [ecx], bl
call fcn.004e12e4
lea eax, [ebp - 0xc30]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [ebp - 0xc24]
push eax
movzx eax, word [ebp - 0xc26]
push eax
movzx eax, word [ebp - 0xc28]
push eax
movzx eax, word [ebp - 0xc2a]
push eax
movzx eax, word [ebp - 0xc2e]
push eax
movzx eax, word [ebp - 0xc30]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push str.P_d_T_d_D_04ld__02ld__02ld_T_02ld__02ld__02ld
mov esi, 0x100
push esi
lea eax, [ebp - 0x220]
push eax
call fcn.005753c9
lea eax, [ebp - 0x220]
push eax
push 0x6aafe0
push str._sCRASH_REPORT__s.txt
push esi
lea eax, [ebp - 0x120]
push eax
call fcn.005753c9
add esp, 0x40
push 2
pop ecx
cmp eax, ecx
jle 0x4e0e1d
mov dl, byte [ebp + ecx - 0x120]
cmp dl, 0x2f
je 0x4e0e10
cmp dl, 0x3a
jne 0x4e0e18
mov byte [ebp + ecx - 0x120], 0x5f
inc ecx
cmp ecx, eax
jl 0x4e0dff
push ebx
push 0x80
push 2
push ebx
push ebx
push 0xc0000000
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
mov dword [ebp - 0xc3c], esi
cmp esi, 0xffffffff
je 0x4e10bb
mov edi, dword [edi]
push 0x208
push ebx
lea eax, [ebp - 0x838]
push eax
call fcn.00572db0
add esp, 0xc
mov eax, dword [ebp - 0xc34]
mov eax, dword [eax + 4]
mov dword [ebp - 0xc38], eax
mov dword [ebp - 0xc34], str.Unknown
push 0x1c
lea ecx, [ebp - 0xc5c]
push ecx
push dword [eax + 0xb8]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x4e0ec0
push 0x206
lea eax, [ebp - 0x838]
push eax
push dword [ebp - 0xc58]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x4e0ec0
lea ecx, [ebp - 0x838]
call fcn.004e0b0a
mov dword [ebp - 0xc34], eax
push 0x208
push ebx
lea eax, [ebp - 0x428]
push eax
call fcn.00572db0
add esp, 0xc
push 0x206
lea eax, [ebp - 0x428]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4e0efe
push 0x650810
lea eax, [ebp - 0x428]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [ebp - 0x428]
call fcn.004e0b0a
push eax
lea eax, [ebp - 0x630]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [ebp - 0x630]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4e0f1d
dec ecx
lea eax, [ebp - 0x630]
cmp ecx, eax
je 0x4e0f34
cmp byte [ecx], 0x2e
jne 0x4e0f24
xor eax, eax
cmp byte [ecx], 0x2e
cmove eax, ecx
test eax, eax
je 0x4e0f42
mov byte [eax], bl
mov eax, dword [ebp - 0xc38]
push dword [eax + 0xb8]
push dword [eax + 0xbc]
push dword [ebp - 0xc34]
push dword [edi]
mov ecx, dword [edi]
call fcn.004e0947
push eax
lea eax, [ebp - 0x630]
push eax
push str._s_caused__s__0x_08x___r_nin_module__s_at__04x:_08x._r_n_r_n
push esi
call fcn.004dfe44
add esp, 0x20
mov ecx, esi
call fcn.004e0779
cmp dword [edi], 0xc0000005
jne 0x4e0fc8
cmp dword [edi + 0x10], 2
jb 0x4e0fc8
mov ecx, str.Read_from
mov eax, str.Write_to
cmp dword [edi + 0x14], ebx
cmove eax, ecx
push dword [edi + 0x18]
push eax
push str._s_location__08x_caused_an_access_violation._r_n
lea eax, [ebp - 0xc20]
push eax
call fcn.005720e1
lea eax, [ebp - 0xc20]
push eax
push 0x650838
push esi
call fcn.004dfe44
add esp, 0x1c
mov edx, dword [ebp - 0xc38]
mov ecx, esi
call fcn.004e0cb8
push str._r_nBytes_at_CS:EIP:_r_n
push esi
call fcn.004dfe44
pop ecx
pop ecx
mov eax, dword [ebp - 0xc38]
mov eax, dword [eax + 0xb8]
mov dword [ebp - 0xc40], eax
mov dword [ebp - 0xc34], ebx
mov ecx, dword [ebp - 0xc34]
cmp ecx, 0x10
jge 0x4e1055
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 0xc40]
movzx eax, byte [ecx + eax]
push eax
push 0x6508b0
push esi
call fcn.004dfe44
add esp, 0xc
mov dword [ebp - 4], 0xfffffffe
jmp 0x4e104d
inc dword [ebp - 0xc34]
jmp 0x4e0ffa
mov edx, dword [ebp - 0xc38]
mov edx, dword [edx + 0xc4]
mov ecx, esi
call fcn.004e0b2e
mov ecx, esi
call fcn.004e0218
lea eax, [ebp - 0x120]
push eax
push str._r_n__end_of__s___r_n
push esi
call fcn.004dfe44
add esp, 0xc
cmp dword [0x6a19b8], 0
jle 0x4e10b0
push ebx
lea eax, [ebp - 0xc3c]
push eax
mov edi, 0x6ab0e8
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [0x6a19b8], ebx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x4e10c0
mov eax, 0x80004005
call fcn.00594268
ret