Function at 0x4c7bfbf0
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x60
push ebx
mov ebx, eax
test ebx, ebx
jne 0x4c7bfc04
pop ebx
mov esp, ebp
pop ebp
ret
push 0x2e
lea eax, [ebp - 0x5f]
push 0
push eax
mov byte [ebp - 0x60], 0
call sub.msvcrt.dll_memset
xor eax, eax
add esp, 0xc
lea ecx, [ebp - 0x20]
push ecx
mov word [ebp - 0x20], 0
mov dword [ebp - 0x1e], eax
mov dword [ebp - 0x1a], eax
mov dword [ebp - 0x16], eax
mov word [ebp - 0x12], ax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
push 0x4c785018
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
movzx edx, word [ebp - 0x12]
movzx ecx, word [ebp - 0x16]
push eax
movzx eax, word [ebp - 0x14]
push edx
movzx edx, word [ebp - 0x18]
push eax
movzx eax, word [ebp - 0x1a]
push ecx
movzx ecx, word [ebp - 0x1e]
push edx
movzx edx, word [ebp - 0x20]
push eax
push ecx
push edx
lea eax, [ebp - 0x60]
push 0x4c784fd8
push eax
call dword [sym.imp.msvcrt.dll_sprintf]
lea eax, [ebp - 0x60]
add esp, 0x30
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x4c7bfc85
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push ebx
push 0
sub eax, edx
push 0xfde9
mov dword [ebp - 8], eax
call edi
mov esi, eax
lea ecx, [ebp - 1]
push ecx
lea edx, [esi + 1]
push edx
lea ecx, [ebp - 0x30]
mov byte [ebp - 1], 0
call fcn.4c7bf950
push 0
push 0
push esi
mov esi, dword [ebp - 0x2c]
push esi
push 0xffffffffffffffff
push ebx
push 0
push 0xfde9
call edi
test eax, eax
jne 0x4c7bfcf4
test esi, esi
je 0x4c7bfceb
push esi
call sub.MFC42.dll_operatordelete
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, esi
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x4c7bfd00
sub eax, edx
mov edi, eax
mov eax, dword [0x4c7de448]
test eax, eax
mov ebx, eax
mov dword [ebp - 0x10], ebx
mov byte [ebp - 0xc], cl
je 0x4c7bfdfb
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x4c7bfdfb
mov eax, dword [ebp - 8]
lea ecx, [edi + eax + 2]
push ecx
mov byte [ebp - 0xc], 1
call fcn.4c7bf400
test eax, eax
jne 0x4c7bfd60
push ebx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
lea ecx, [ebp - 0x30]
call fcn.4c7a5e80
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [0x4c7dc230]
mov eax, dword [ebp - 8]
push edx
lea ecx, [ebp - 0x60]
call fcn.4c7bf700
test eax, eax
je 0x4c7bfdf3
mov eax, dword [0x4c7dc230]
push eax
mov eax, edi
mov ecx, esi
call fcn.4c7bf700
test eax, eax
je 0x4c7bfdf3
mov ebx, dword [0x4c7dc230]
mov dword [ebp - 8], 0
mov esi, 0x4c784fd4
mov edi, 2
push 0
lea ecx, [ebp - 8]
push ecx
push edi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4c7bfdf3
mov eax, dword [ebp - 8]
add esi, eax
sub edi, eax
jne 0x4c7bfda0
mov eax, dword [0x4c7dc230]
cmp eax, 0xffffffff
je 0x4c7bfdd7
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x4c7dc230], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.4c7bf7b0
lea ecx, [ebp - 0x30]
call fcn.4c7a5e80
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x10]
call fcn.4c7bf7b0
lea ecx, [ebp - 0x30]
call fcn.4c7a5e80
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret