Function at 0x4494a0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0xc
push ebx
mov ebx, dword [esp + 0x14]
mov eax, dword [ebx + 8]
push ebp
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
mov esi, ecx
lea ecx, [esp + 0x24]
push ecx
mov ebp, 4
push ebp
lea edx, [esp + 0x20]
mov dword [esp + 0x20], eax
mov eax, dword [esi + 0x21e]
push edx
push eax
call edi
test eax, eax
je case.0x44956f.1
cmp dword [esp + 0x20], ebp
jne case.0x44956f.1
mov ecx, dword [ebx + 0xc]
push 0
lea edx, [esp + 0x24]
push edx
push ebp
lea eax, [esp + 0x20]
mov dword [esp + 0x20], ecx
mov ecx, dword [esi + 0x21e]
push eax
push ecx
call edi
test eax, eax
je case.0x44956f.1
cmp dword [esp + 0x20], ebp
jne case.0x44956f.1
cmp dword [ebx + 0x14], 0
jne 0x449559
mov ecx, dword [esi + 0x21e]
push 0
lea edx, [esp + 0x24]
push edx
push ebp
lea eax, [esp + 0x20]
push eax
push ecx
mov dword [esp + 0x28], 0
call edi
test eax, eax
je case.0x44956f.1
cmp dword [esp + 0x20], ebp
jne case.0x44956f.1
mov dword [esp + 0x10], 0xc
jmp 0x449c79
mov eax, dword [ebx + 0xc]
add eax, 0xffffffff
cmp eax, 0x32
ja case.0x44956f.1
movzx edx, byte [eax + 0x449cdc]
jmp dword [edx*4 + 0x449ca4]
mov ebx, dword [ebx + 0x10]
mov eax, dword [ebx + 0x14]
mov ecx, dword [ebx + 0xc]
lea edx, [eax + ecx + 0x1c]
push 0
lea eax, [esp + 0x24]
push eax
push ebp
lea ecx, [esp + 0x24]
mov dword [esp + 0x24], edx
mov edx, dword [esi + 0x21e]
push ecx
push edx
call edi
test eax, eax
je case.0x44956f.1
cmp dword [esp + 0x20], ebp
jne case.0x44956f.1
mov ecx, dword [esi + 0x21e]
push 0
lea eax, [esp + 0x24]
push eax
push 0x1c
push ebx
push ecx
call edi
test eax, eax
je case.0x44956f.1
cmp dword [esp + 0x20], 0x1c
jne case.0x44956f.1
mov eax, dword [ebx + 0xc]
test eax, eax
mov dword [esp + 0x10], 0x28
jbe 0x449632
cmp byte [esi + 0x1ec], 0
push 0
lea edx, [esp + 0x24]
push edx
push eax
je 0x449602
mov eax, dword [ebx + 8]
mov ecx, dword [esi + 0x21e]
push eax
push ecx
jmp 0x449614
mov ecx, dword [ebx + 8]
mov eax, dword [ecx]
mov edx, dword [eax + 8]
call edx
push eax
mov eax, dword [esi + 0x21e]
push eax
call edi
test eax, eax
je case.0x44956f.1
mov eax, dword [esp + 0x20]
cmp eax, dword [ebx + 0xc]
jne case.0x44956f.1
add eax, 0x28
mov dword [esp + 0x10], eax
mov eax, dword [ebx + 0x14]
test eax, eax
jbe 0x449c79
mov edx, dword [ebx + 0x10]
push 0
lea ecx, [esp + 0x24]
push ecx
push eax
mov eax, dword [esi + 0x21e]
push edx
push eax
call edi
test eax, eax
je case.0x44956f.1
mov eax, dword [esp + 0x20]
cmp eax, dword [ebx + 0x14]
jne case.0x44956f.1
add dword [esp + 0x10], eax
jmp 0x449c79
mov eax, dword [esi + 0x21e]
mov ebx, dword [ebx + 0x10]
push 0
lea ecx, [esp + 0x24]
push ecx
push ebp
lea edx, [esp + 0x24]
push edx
push eax
mov dword [esp + 0x2c], 0x16
call edi
test eax, eax
je case.0x44956f.1
cmp dword [esp + 0x20], ebp
jne case.0x44956f.1
mov edx, dword [esi + 0x21e]
push 0
lea ecx, [esp + 0x24]
push ecx
push 0x16
push ebx
push edx
call edi
test eax, eax
je case.0x44956f.1
cmp dword [esp + 0x20], 0x16
jne case.0x44956f.1
mov dword [esp + 0x10], 0x22
jmp 0x449c79
mov ebx, dword [ebx + 0x10]
mov eax, dword [ebx + 0x48]
push 0
lea ecx, [esp + 0x24]
push ecx
add eax, 0x4e
push ebp
lea edx, [esp + 0x24]
mov dword [esp + 0x24], eax
mov eax, dword [esi + 0x21e]
push edx
push eax
call edi
test eax, eax
je case.0x44956f.1
cmp dword [esp + 0x20], ebp
jne case.0x44956f.1
mov edx, dword [esi + 0x21e]
push 0
lea ecx, [esp + 0x24]
push ecx
push 0x4e
push ebx
push edx
call edi
test eax, eax
je case.0x44956f.1
cmp dword [esp + 0x20], 0x4e
jne case.0x44956f.1
mov eax, dword [ebx + 0x48]
test eax, eax
mov dword [esp + 0x10], 0x5a
jbe 0x449c79
mov edx, dword [ebx + 0x44]
push 0
lea ecx, [esp + 0x24]
push ecx
push eax
mov eax, dword [esi + 0x21e]
push edx
push eax
call edi
test eax, eax
je case.0x44956f.1
mov eax, dword [esp + 0x20]
cmp eax, dword [ebx + 0x48]
jne case.0x44956f.1
add eax, 0x5a
jmp 0x449c75
mov ebx, dword [ebx + 0x10]
mov ecx, dword [ebx + 0x336]
add ecx, 0x13
imul ecx, ecx, 0x2c
push 0
lea edx, [esp + 0x24]
push edx
push ebp
lea eax, [esp + 0x24]
mov dword [esp + 0x24], ecx
mov ecx, dword [esi + 0x21e]
push eax
push ecx
call edi
test eax, eax
je case.0x44956f.1
cmp dword [esp + 0x20], ebp
jne case.0x44956f.1
mov eax, dword [esi + 0x21e]
push 0
lea edx, [esp + 0x24]
push edx
push 0x344
push ebx
push eax
call edi
test eax, eax
je case.0x44956f.1
cmp dword [esp + 0x20], 0x344
jne case.0x44956f.1
mov eax, dword [ebx + 0x336]
test eax, eax
mov dword [esp + 0x10], 0x350
jbe 0x449c79
xor ebp, ebp
test eax, eax
jbe 0x449c79
lea ecx, [ecx]
mov ecx, dword [ebx + 0x33a]
push ebp
call fcn.0044ba10
mov eax, dword [eax]
mov edx, dword [esi + 0x21e]
push 0
lea ecx, [esp + 0x24]
push ecx
push 0x2c
push eax
push edx
call edi
test eax, eax
je case.0x44956f.1
mov eax, 0x2c
cmp dword [esp + 0x20], eax
jne case.0x44956f.1
add dword [esp + 0x10], eax
add ebp, 1
cmp ebp, dword [ebx + 0x336]
jb 0x449800
jmp 0x449c79
mov edx, dword [esi + 0x21e]
mov ebx, dword [ebx + 0x10]
push 0
lea eax, [esp + 0x24]
push eax
push ebp
lea ecx, [esp + 0x1c]
push ecx
push edx
mov dword [esp + 0x24], 0x34
call edi
test eax, eax
je case.0x44956f.1
cmp dword [esp + 0x20], ebp
jne case.0x44956f.1
mov ecx, dword [esp + 0x10]
mov edx, dword [esi + 0x21e]
push 0
lea eax, [esp + 0x24]
push eax
push ecx
push ebx
push edx
call edi
test eax, eax
je case.0x44956f.1
mov eax, dword [esp + 0x20]
cmp eax, dword [esp + 0x10]
je 0x449c72
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0xc
ret 4
mov edx, dword [esi + 0x21e]
mov ebx, dword [ebx + 0x10]
push 0
lea eax, [esp + 0x24]
push eax
push ebp
lea ecx, [esp + 0x24]
push ecx
push edx
mov dword [esp + 0x2c], 6
call edi
test eax, eax
je case.0x44956f.1
cmp dword [esp + 0x20], ebp
jne case.0x44956f.1
mov ecx, dword [esi + 0x21e]
push 0
lea eax, [esp + 0x24]
push eax
push 6
push ebx
push ecx
call edi
test eax, eax
je case.0x44956f.1
cmp dword [esp + 0x20], 6
jne case.0x44956f.1
mov dword [esp + 0x10], 0x12
jmp 0x449c79
mov ecx, dword [esi + 0x21e]
mov ebx, dword [ebx + 0x10]
push 0
lea edx, [esp + 0x24]
push edx
push ebp
lea eax, [esp + 0x24]
push eax
push ecx
mov dword [esp + 0x2c], 0x642
call edi
test eax, eax
je case.0x44956f.1
cmp dword [esp + 0x20], ebp
jne case.0x44956f.1
mov eax, dword [esi + 0x21e]
push 0
lea edx, [esp + 0x24]
push edx
push 0x642
push ebx
push eax
call edi
test eax, eax
je case.0x44956f.1
cmp dword [esp + 0x20], 0x642
jne case.0x44956f.1
mov dword [esp + 0x10], 0x64e
jmp 0x449c79
mov eax, dword [esi + 0x21e]
mov ebx, dword [ebx + 0x10]
push 0
lea ecx, [esp + 0x24]
push ecx
push ebp
lea edx, [esp + 0x24]
push edx
push eax
mov dword [esp + 0x2c], 0x22
call edi
test eax, eax
je case.0x44956f.1
cmp dword [esp + 0x20], ebp
jne case.0x44956f.1
mov edx, dword [esi + 0x21e]
push 0
lea ecx, [esp + 0x24]
push ecx
push 0x22
push ebx
push edx
call edi
test eax, eax
je case.0x44956f.1
cmp dword [esp + 0x20], 0x22
jne case.0x44956f.1
mov dword [esp + 0x10], 0x2e
jmp 0x449c79
mov ebx, dword [ebx + 0x10]
mov eax, dword [ebx + 2]
imul eax, eax, 0x642
push 0
lea ecx, [esp + 0x24]
push ecx
add eax, 0xa
push ebp
lea edx, [esp + 0x24]
mov dword [esp + 0x24], eax
mov eax, dword [esi + 0x21e]
push edx
push eax
call edi
test eax, eax
je case.0x44956f.1
cmp dword [esp + 0x20], ebp
jne case.0x44956f.1
mov edx, dword [esi + 0x21e]
push 0
lea ecx, [esp + 0x24]
push ecx
push 0xa
push ebx
push edx
call edi
test eax, eax
je case.0x44956f.1
cmp dword [esp + 0x20], 0xa
jne case.0x44956f.1
mov eax, dword [ebx + 2]
test eax, eax
mov dword [esp + 0x10], 0x16
jbe 0x449c79
xor ebp, ebp
test eax, eax
jbe 0x449c79
lea esp, [esp]
mov ecx, dword [ebx + 6]
push ebp
call fcn.0044ba70
mov edx, dword [esi + 0x21e]
push 0
lea ecx, [esp + 0x24]
push ecx
push 0x642
push eax
push edx
call edi
test eax, eax
je case.0x44956f.1
mov eax, 0x642
cmp dword [esp + 0x20], eax
jne case.0x44956f.1
add dword [esp + 0x10], eax
add ebp, 1
cmp ebp, dword [ebx + 2]
jb 0x449a50
jmp 0x449c79
mov ebx, dword [ebx + 0x10]
mov eax, dword [ebx + 2]
push 0
lea edx, [esp + 0x24]
push edx
lea ecx, [eax + eax + 0x12]
push ebp
lea eax, [esp + 0x24]
mov dword [esp + 0x24], ecx
mov ecx, dword [esi + 0x21e]
push eax
push ecx
call edi
test eax, eax
je case.0x44956f.1
cmp dword [esp + 0x20], ebp
jne case.0x44956f.1
mov eax, dword [esp + 0x18]
mov ecx, dword [esi + 0x21e]
push 0
lea edx, [esp + 0x24]
push edx
push eax
push ebx
push ecx
call edi
test eax, eax
je case.0x44956f.1
mov eax, dword [esp + 0x20]
cmp eax, dword [esp + 0x18]
jne case.0x44956f.1
add eax, 0xc
mov dword [esp + 0x10], eax
mov eax, dword [ebx + 2]
test eax, eax
jbe 0x449c79
mov ecx, dword [ebx + 6]
push 0
lea edx, [esp + 0x24]
push edx
mov edx, dword [esi + 0x21e]
add eax, eax
push eax
push ecx
push edx
call edi
test eax, eax
je case.0x44956f.1
mov ecx, dword [ebx + 2]
mov eax, dword [esp + 0x20]
add ecx, ecx
cmp eax, ecx
jne case.0x44956f.1
add dword [esp + 0x10], eax
jmp 0x449c79
mov ecx, dword [esi + 0x21e]
mov ebx, dword [ebx + 0x10]
push 0
lea edx, [esp + 0x24]
push edx
push ebp
lea eax, [esp + 0x24]
push eax
push ecx
mov dword [esp + 0x2c], 0xd4
call edi
test eax, eax
je case.0x44956f.1
cmp dword [esp + 0x20], ebp
jne case.0x44956f.1
mov eax, dword [esi + 0x21e]
push 0
lea edx, [esp + 0x24]
push edx
push 0xd4
push ebx
push eax
call edi
test eax, eax
je case.0x44956f.1
cmp dword [esp + 0x20], 0xd4
jne case.0x44956f.1
mov dword [esp + 0x10], 0xe0
jmp 0x449c79
mov eax, dword [esi + 0x21e]
mov ebx, dword [ebx + 0x10]
push 0
lea ecx, [esp + 0x24]
push ecx
push ebp
lea edx, [esp + 0x24]
push edx
push eax
mov dword [esp + 0x2c], 0x2c
call edi
test eax, eax
je case.0x44956f.1
cmp dword [esp + 0x20], ebp
jne case.0x44956f.1
mov edx, dword [esi + 0x21e]
push 0
lea ecx, [esp + 0x24]
push ecx
push 0x2c
push ebx
push edx
call edi
test eax, eax
je case.0x44956f.1
cmp dword [esp + 0x20], 0x2c
jne case.0x44956f.1
mov dword [esp + 0x10], 0x38
jmp 0x449c79
mov edx, dword [esi + 0x21e]
mov ebx, dword [ebx + 0x10]
push 0
lea eax, [esp + 0x24]
push eax
push ebp
lea ecx, [esp + 0x24]
push ecx
push edx
mov dword [esp + 0x2c], 0xe6668
call edi
test eax, eax
je case.0x44956f.1
cmp dword [esp + 0x20], ebp
jne case.0x44956f.1
mov ecx, dword [esp + 0x18]
mov edx, dword [esi + 0x21e]
push 0
lea eax, [esp + 0x24]
push eax
push ecx
push ebx
push edx
call edi
test eax, eax
je case.0x44956f.1
mov eax, dword [esp + 0x20]
cmp eax, dword [esp + 0x18]
jne case.0x44956f.1
add eax, 0xc
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
add dword [esi + 0x1002d0], eax
lea ecx, [esi + 0x1002b0]
push ecx
lea ecx, [esi + 0x222]
call fcn.004113f0
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0xc
ret 4