Function at 0x44fda0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49e2a0
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x4c3c64]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0x10]
push ecx
mov ebx, ecx
mov esi, esp
mov dword [ebp - 0x48], ebx
mov edi, edx
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x3c], esp
mov dword [ebp - 0x50], esi
call fcn.0047727e
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x44fdfb
push 0x80004005
call fcn.00420000
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi], eax
xor eax, eax
mov dword [ebp - 4], eax
cmp edi, eax
je 0x450045
test edi, 0xffff0000
jne 0x45003c
movzx edi, di
push edi
call fcn.0047f19d
mov ebx, eax
test ebx, ebx
je 0x44fef6
mov ecx, edi
shr ecx, 4
inc ecx
movzx edx, cx
push 6
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x44fef6
push edi
push eax
push ebx
call fcn.004206df
mov edi, eax
add esp, 0xc
test edi, edi
je 0x44fef6
mov eax, dword [esi]
movzx ebx, word [edi]
sub eax, 0x10
mov ecx, 1
sub ecx, dword [eax + 0xc]
mov eax, dword [eax + 8]
sub eax, ebx
or eax, ecx
jge 0x44fe86
push ebx
mov ecx, esi
call fcn.0042051d
mov eax, dword [esi]
mov dword [ebp - 0x3c], eax
movzx eax, word [edi]
add edi, 2
cmp eax, 0xffffffff
jne 0x44fea0
push edi
call fcn.0048550b
add esp, 4
inc eax
lea edx, [eax + eax]
mov eax, dword [ebp - 0x3c]
push edx
lea ecx, [ebx + ebx]
push edi
push ecx
push eax
mov dword [ebp - 0x40], ecx
call fcn.00485242
add esp, 0x10
cmp eax, 0x50
ja case.0x44fec4.1
movzx ecx, byte [eax + 0x4501f4]
jmp dword [ecx*4 + 0x4501e4]
call fcn.004777e6
call fcn.0047781e
test ebx, ebx
jl 0x450032
mov eax, dword [esi]
cmp ebx, dword [eax - 8]
jg 0x450032
mov ecx, dword [ebp - 0x40]
mov dword [eax - 0xc], ebx
mov edx, dword [esi]
xor eax, eax
mov word [ecx + edx], ax
mov ebx, dword [ebp - 0x48]
push ebx
mov dword [ebp - 4], 0xffffffff
call fcn.0044fa20
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
add esp, 8
push 0
lea edx, [ebp - 0x44]
push edx
push 2
push 0x4a951c
push ebx
call edi
mov ecx, dword [ebp + 8]
mov eax, ecx
sub eax, 1
je 0x450192
sub eax, 3
je 0x4500fa
push ecx
push str.hex__x_:
lea eax, [ebp - 0x38]
push 0x14
push eax
call fcn.00488a72
lea eax, [ebp - 0x38]
add esp, 0x10
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x44ff50
sub eax, edx
push 0
sar eax, 1
lea ecx, [ebp - 0x44]
push ecx
lea edx, [eax + eax]
push edx
lea eax, [ebp - 0x38]
push eax
push ebx
call edi
cmp dword [ebp + 0xc], 0
jbe 0x4500ea
mov edi, 1
mov dword [ebp - 0x3c], edi
call fcn.0047727e
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
je 0x44fdf1
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp - 0x4c]
mov dword [ebp - 4], 2
movzx edx, byte [ecx + edi - 1]
push edx
lea eax, [ebp - 0x40]
push str._02x
push eax
call fcn.00420632
add esp, 0xc
cmp edi, dword [ebp + 0xc]
jae 0x4500f5
push 0x4b174c
lea ecx, [ebp - 0x40]
push ecx
lea edx, [ebp - 0x54]
push edx
call fcn.00423a96
add esp, 0xc
mov byte [ebp - 4], 3
mov ecx, dword [eax]
mov esi, dword [ebp - 0x40]
lea eax, [ecx - 0x10]
lea edi, [esi - 0x10]
cmp eax, edi
je 0x450063
cmp dword [edi + 0xc], 0
lea esi, [edi + 0xc]
jl 0x450053
mov edx, dword [eax]
cmp edx, dword [edi]
jne 0x450053
push eax
call fcn.0042152d
mov ebx, eax
add esp, 4
or eax, 0xffffffff
lock xadd dword [esi], eax
dec eax
test eax, eax
jg 0x450027
mov ecx, dword [edi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push edi
call eax
lea esi, [ebx + 0x10]
mov ebx, dword [ebp - 0x48]
mov dword [ebp - 0x40], esi
jmp 0x450063
push 0x80070057
call fcn.00420000
push edi
call fcn.0048550b
add esp, 4
push eax
push edi
mov ecx, esi
call fcn.004214bc
jmp 0x44fef9
mov eax, dword [ecx - 0xc]
push eax
push ecx
lea ecx, [ebp - 0x40]
call fcn.004214bc
mov esi, dword [ebp - 0x40]
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x54]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x450086
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edi, dword [ebp - 0x3c]
mov eax, esi
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x450090
sub eax, edx
push 0
sar eax, 1
lea ecx, [ebp - 0x44]
push ecx
lea edx, [eax + eax]
push edx
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea eax, [esi - 0x10]
mov dword [ebp - 4], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4500d4
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
inc edi
lea ecx, [edi - 1]
mov dword [ebp - 0x3c], edi
cmp ecx, dword [ebp + 0xc]
jb 0x44ff82
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea edx, [ebp - 0x44]
push edx
jmp 0x4501bd
mov esi, dword [ebp - 0x40]
jmp 0x450089
call fcn.0047727e
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x450114
push 0x80004005
call fcn.00420000
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp - 0x4c]
mov dword [ebp - 4], 1
mov edx, dword [ecx]
push edx
lea eax, [ebp - 0x3c]
push 0x4b1710
push eax
call fcn.00420632
mov esi, dword [ebp - 0x3c]
mov eax, esi
add esp, 0xc
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x450150
sub eax, edx
push 0
sar eax, 1
lea ecx, [ebp - 0x44]
push ecx
lea edx, [eax + eax]
push edx
push esi
push ebx
call edi
lea eax, [esi - 0x10]
mov dword [ebp - 4], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4501c7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x4501c7
cmp dword [ebp + 0xc], 0
push ecx
mov ecx, esp
mov dword [ebp - 0x50], esp
jbe 0x4501a4
mov edx, dword [ebp - 0x4c]
push edx
jmp 0x4501a9
push 0x4a94b0
call fcn.004211c4
push ebx
call fcn.0044fa20
add esp, 8
push 0
lea eax, [ebp - 0x44]
push eax
push 4
push 0x4a9514
push ebx
call edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00484f14
mov esp, ebp
pop ebp
ret