Function at 0x4c47b5
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6a1d0e
mov eax, dword fs:[0]
push eax
sub esp, 0x7c
push ebx
push esi
push edi
mov eax, dword [0x816078]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
call fcn.004c5358
push dword [ebp + 0x1c]
mov esi, eax
mov dword [ebp - 0x14], edx
lea ecx, [ebp - 0x88]
mov dword [ebp - 0x1c], esi
mov byte [ebp - 0xd], 0
call fcn.004c3372
mov ebx, dword [ebp + 0x14]
mov ecx, 0x10000
cmp ebx, ecx
mov eax, ecx
push ebx
push dword [ebp + 0x18]
cmovb eax, ebx
lea ecx, [ebp - 0x88]
mov dword [ebp - 0x20], eax
call fcn.004c33a1
mov eax, dword [ebp + 8]
mov ecx, esi
add ebx, eax
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0xc]
push 0
pop edx
adc edx, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
add ecx, 0x10000
mov dword [ebp - 0x2c], edx
adc eax, 0
cmp edx, eax
jb 0x4c48ee
ja 0x4c4855
cmp ebx, ecx
jbe 0x4c48ee
cmp dword [ebp - 0x84], 0
je 0x4c48d2
call dword [sym.imp.KERNEL32.dll_GetTickCount64]
sub eax, dword [ebp - 0x78]
sbb edx, dword [ebp - 0x74]
jne 0x4c4873
cmp eax, 0xfa
jb 0x4c48cb
mov eax, dword [ebp - 0x88]
lea ecx, [ebp - 0x88]
call dword [eax + 0x10]
and dword [ebp - 4], 0
lea edx, [ebp - 0x70]
mov eax, dword [ebp - 0x84]
mov esi, dword fs:[0x2c]
push edx
push eax
mov ecx, dword [eax]
mov esi, dword [esi]
inc dword [esi + 4]
call dword [ecx + 0xc]
dec dword [esi + 4]
or dword [ebp - 4], 0xffffffff
test eax, eax
jne 0x4c48b4
mov esi, 0x80004004
jmp 0x4c48cd
call dword [sym.imp.KERNEL32.dll_GetTickCount64]
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], edx
mov dword [0x829758], eax
mov dword [0x82975c], edx
xor esi, esi
mov edx, dword [ebp - 0x2c]
jmp 0x4c48d4
xor esi, esi
test esi, esi
js 0x4c4a60
push dword [ebp + 0x1c]
mov eax, dword [edi]
push edx
push ebx
push edi
call dword [eax + 0x18]
test eax, eax
setns bl
jmp 0x4c48f1
mov bl, byte [ebp - 0xd]
mov edx, dword [ebp + 8]
and dword [ebp - 0x3c], 0
cmp dword [ebp - 0x84], 0
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x44], edx
mov dword [ebp - 0x40], eax
je 0x4c4979
call dword [sym.imp.KERNEL32.dll_GetTickCount64]
sub eax, dword [ebp - 0x78]
sbb edx, dword [ebp - 0x74]
jne 0x4c491f
cmp eax, 0xfa
jb 0x4c4979
mov eax, dword [ebp - 0x88]
lea ecx, [ebp - 0x88]
call dword [eax + 0x10]
mov dword [ebp - 4], 1
lea edx, [ebp - 0x70]
mov eax, dword fs:[0x2c]
push edx
mov esi, dword [eax]
mov eax, dword [ebp - 0x84]
push eax
inc dword [esi + 4]
mov ecx, dword [eax]
call dword [ecx + 0xc]
dec dword [esi + 4]
or dword [ebp - 4], 0xffffffff
test eax, eax
jne 0x4c4962
mov esi, 0x80004004
jmp 0x4c497b
call dword [sym.imp.KERNEL32.dll_GetTickCount64]
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], edx
mov dword [0x829758], eax
mov dword [0x82975c], edx
xor esi, esi
test esi, esi
js 0x4c4a4b
mov esi, dword [ebp - 0x20]
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x24]
push eax
push esi
push dword [ebp + 0x10]
push dword [edi + 0x14]
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [edi + 0x1c], 0
je 0x4c49cb
test eax, eax
jne 0x4c49ea
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x4c49cf
push 1
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x4c]
push eax
push dword [edi + 0x14]
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
neg eax
sbb eax, eax
neg eax
test eax, eax
jne 0x4c49ea
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
jne 0x4c4a4b
mov esi, dword [ebp - 0x20]
mov ecx, dword [ebp + 0x18]
mov eax, dword [ebp - 0x24]
sub dword [ebp + 0x14], eax
mov edx, dword [ebp - 0x28]
add dword [ecx], eax
add dword [ebp + 0x10], eax
add edx, eax
mov ecx, dword [ebp - 0x18]
adc ecx, 0
mov dword [ebp - 0x28], edx
cmp dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp + 0x14]
ja 0x4c4a24
jb 0x4c4a18
cmp dword [ebp - 0x1c], edx
ja 0x4c4a24
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x14]
mov dword [ebp - 0x1c], edx
cmp esi, eax
jne 0x4c4a46
xor esi, esi
test ecx, ecx
je 0x4c4a42
mov esi, 0x10000
cmp ecx, esi
mov eax, esi
cmovb eax, ecx
mov dword [ebp - 0x20], eax
jmp 0x4c48f4
xor bl, bl
jmp 0x4c4a4b
mov esi, 0x80004005
test bl, bl
je 0x4c4a60
mov ecx, dword [ebp - 0x1c]
mov eax, dword [edi]
push 0
push dword [ebp - 0x14]
push ecx
push edi
call dword [eax + 0x18]
jmp 0x4c4a6c
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
mov dword [edi + 0x40], ecx
mov dword [edi + 0x44], eax
mov dword [ebp - 0x88], 0x6fe61c
mov dword [ebp - 4], 2
mov eax, dword [ebp - 0x84]
test eax, eax
je 0x4c4a94
and dword [ebp - 0x84], 0
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18