Function at 0x4e9915
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x138
mov eax, dword [0x67ccf0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov ebx, 0x6a0b58
mov dword [ebp - 0x130], eax
push 0x77d
mov ecx, ebx
call fcn.0044c748
mov esi, eax
test esi, esi
je 0x4e997b
mov ecx, esi
call fcn.00413d2e
fstp dword [ebp - 0x128]
cvttss2si eax, dword [ebp - 0x128]
mov ecx, esi
mov dword [ebp - 0x24], eax
call fcn.00413d35
fstp dword [ebp - 0x128]
cvttss2si eax, dword [ebp - 0x128]
mov dword [ebp - 0x20], eax
push 0x84d
mov ecx, ebx
call fcn.0044c748
mov esi, eax
test esi, esi
je 0x4e99cd
mov ecx, esi
call fcn.00413d2e
fstp dword [ebp - 0x128]
cvttss2si eax, dword [ebp - 0x128]
mov ecx, esi
mov dword [ebp - 0x14], eax
call fcn.00413d35
fstp dword [ebp - 0x128]
cvttss2si eax, dword [ebp - 0x128]
mov ecx, esi
mov dword [ebp - 0x10], eax
call fcn.00421eaa
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0xc], eax
push 0x1db
mov ecx, ebx
call fcn.0044c748
mov esi, eax
test esi, esi
je 0x4e9a28
mov ecx, esi
call fcn.00413d2e
fstp dword [ebp - 0x128]
cvttss2si eax, dword [ebp - 0x128]
mov ecx, esi
mov dword [ebp - 0x124], eax
call fcn.00413d35
fstp dword [ebp - 0x128]
cvttss2si eax, dword [ebp - 0x128]
mov ecx, esi
mov dword [ebp - 0x120], eax
call fcn.0041bb9b
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x11c], eax
push 0x491
mov ecx, ebx
call fcn.0044c748
mov esi, eax
test esi, esi
je 0x4e9a83
mov ecx, esi
call fcn.00413d2e
fstp dword [ebp - 0x128]
cvttss2si eax, dword [ebp - 0x128]
mov ecx, esi
mov dword [ebp - 0x114], eax
call fcn.00413d35
fstp dword [ebp - 0x128]
cvttss2si eax, dword [ebp - 0x128]
mov ecx, esi
mov dword [ebp - 0x110], eax
call fcn.0041bb9b
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x10c], eax
push 0xed
mov ecx, ebx
call fcn.0044c748
mov edi, eax
test edi, edi
je 0x4e9af2
mov ecx, edi
call fcn.00413d2e
fstp dword [ebp - 0x128]
cvttss2si eax, dword [ebp - 0x128]
mov ecx, edi
mov dword [ebp - 0xe4], eax
call fcn.00413d35
fstp dword [ebp - 0x128]
cvttss2si eax, dword [ebp - 0x128]
mov ecx, edi
mov dword [ebp - 0xe0], eax
call fcn.0041bb9b
neg eax
mov ecx, edi
sbb esi, esi
neg esi
mov dword [ebp - 0xdc], esi
call fcn.00497443
test eax, eax
je 0x4e9af2
or esi, 2
mov dword [ebp - 0xdc], esi
push 0x124
mov ecx, ebx
call fcn.0044c748
mov edi, eax
test edi, edi
je 0x4e9b5e
mov ecx, edi
call fcn.0041bb9b
neg eax
mov ecx, edi
sbb esi, esi
neg esi
mov dword [ebp - 0xcc], esi
call fcn.004e8ec3
cmp eax, 1
jne 0x4e9b28
or esi, 4
jmp 0x4e9b48
mov ecx, edi
call fcn.004e8ec3
cmp eax, 2
jne 0x4e9b39
or esi, 8
jmp 0x4e9b48
mov ecx, edi
call fcn.004e8ec3
cmp eax, 4
jne 0x4e9b4e
or esi, 0x10
mov dword [ebp - 0xcc], esi
mov ecx, edi
call fcn.004c76d6
movzx eax, al
mov dword [ebp - 0xc8], eax
push 0x5d0
mov ecx, ebx
call fcn.0044c748
test eax, eax
je 0x4e9b9c
mov ecx, eax
call fcn.0041bb9b
test eax, eax
je 0x4e9b85
or dword [ebp - 0xcc], 0x100
jmp 0x4e9b9c
mov eax, dword [ebp - 0xcc]
mov ecx, 0x100
test ecx, eax
je 0x4e9b9c
xor eax, ecx
mov dword [ebp - 0xcc], eax
push 0xf3
mov ecx, ebx
call fcn.0044c748
mov edi, eax
test edi, edi
je 0x4e9c2d
mov ecx, edi
call fcn.00413d2e
fstp dword [ebp - 0x128]
cvttss2si eax, dword [ebp - 0x128]
mov ecx, edi
mov dword [ebp - 0xc4], eax
call fcn.00413d35
fstp dword [ebp - 0x128]
cvttss2si eax, dword [ebp - 0x128]
mov ecx, edi
mov dword [ebp - 0xc0], eax
call fcn.0041bb9b
mov esi, eax
mov ecx, edi
neg esi
sbb esi, esi
neg esi
mov dword [ebp - 0xbc], esi
call fcn.00450898
cmp al, 1
jne 0x4e9c09
or esi, 4
jmp 0x4e9c27
mov ecx, edi
call fcn.00450898
cmp al, 2
jne 0x4e9c19
or esi, 8
jmp 0x4e9c27
mov ecx, edi
call fcn.00450898
cmp al, 3
jne 0x4e9c2d
or esi, 0x10
mov dword [ebp - 0xbc], esi
push 0x61
mov ecx, ebx
call fcn.0044c748
mov esi, eax
test esi, esi
je 0x4e9c85
mov ecx, esi
call fcn.00413d2e
fstp dword [ebp - 0x128]
cvttss2si eax, dword [ebp - 0x128]
mov ecx, esi
mov dword [ebp - 0xb4], eax
call fcn.00413d35
fstp dword [ebp - 0x128]
cvttss2si eax, dword [ebp - 0x128]
mov ecx, esi
mov dword [ebp - 0xb0], eax
call fcn.0041bb9b
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0xac], eax
push 0xc7
mov ecx, ebx
call fcn.0044c748
mov ebx, eax
test ebx, ebx
je 0x4e9d51
mov ecx, ebx
call fcn.00413d2e
fstp dword [ebp - 0x128]
cvttss2si eax, dword [ebp - 0x128]
mov ecx, ebx
mov dword [ebp - 0xa4], eax
call fcn.00413d35
fstp dword [ebp - 0x128]
cvttss2si eax, dword [ebp - 0x128]
mov ecx, ebx
mov dword [ebp - 0xa0], eax
call fcn.0041bb9b
mov esi, eax
mov ecx, ebx
neg esi
sbb esi, esi
neg esi
mov dword [ebp - 0x9c], esi
call fcn.00450898
cmp al, 1
jne 0x4e9d3d
or esi, 4
mov ecx, 0x691150
mov dword [ebp - 0x9c], esi
call fcn.0045363e
mov edi, eax
mov ecx, eax
call fcn.00450898
cmp al, 1
jne 0x4e9d16
or esi, 0x20
jmp 0x4e9d37
mov ecx, edi
call fcn.00450898
cmp al, 2
jne 0x4e9d26
or esi, 0x40
jmp 0x4e9d37
mov ecx, edi
call fcn.00450898
cmp al, 3
jne 0x4e9d3d
or esi, 0x80
mov dword [ebp - 0x9c], esi
mov ecx, ebx
call fcn.004f7633
mov ecx, eax
call fcn.004e8ee7
mov dword [ebp - 0x98], eax
mov ebx, 0x6a0b58
push 0x350
mov ecx, ebx
call fcn.0044c748
mov edi, eax
test edi, edi
je 0x4e9df3
mov ecx, edi
call fcn.00413d2e
fstp dword [ebp - 0x128]
cvttss2si eax, dword [ebp - 0x128]
mov ecx, edi
mov dword [ebp - 0x94], eax
call fcn.00413d35
fstp dword [ebp - 0x128]
cvttss2si eax, dword [ebp - 0x128]
mov ecx, edi
mov dword [ebp - 0x90], eax
call fcn.0041bb9b
mov esi, eax
mov ecx, edi
neg esi
sbb esi, esi
neg esi
mov dword [ebp - 0x8c], esi
call fcn.00450898
cmp al, 1
jne 0x4e9dcb
or esi, 4
mov dword [ebp - 0x8c], esi
mov ecx, edi
call fcn.00450898
cmp al, 2
jne 0x4e9ddf
or esi, 8
mov dword [ebp - 0x8c], esi
mov ecx, edi
call fcn.00450898
cmp al, 3
jne 0x4e9df3
or esi, 0x10
mov dword [ebp - 0x8c], esi
push 0x510
mov ecx, ebx
call fcn.0044c748
mov esi, eax
test esi, esi
je 0x4e9e48
mov ecx, esi
call fcn.00413d2e
fstp dword [ebp - 0x128]
cvttss2si eax, dword [ebp - 0x128]
mov ecx, esi
mov dword [ebp - 0x84], eax
call fcn.00413d35
fstp dword [ebp - 0x128]
cvttss2si eax, dword [ebp - 0x128]
mov ecx, esi
mov dword [ebp - 0x80], eax
call fcn.0041bb9b
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x7c], eax
push 0x4a8
mov ecx, ebx
call fcn.0044c748
mov esi, eax
test esi, esi
je 0x4e9eac
mov ecx, esi
call fcn.00413d2e
fstp dword [ebp - 0x128]
cvttss2si eax, dword [ebp - 0x128]
mov ecx, esi
mov dword [ebp - 0x74], eax
call fcn.00413d35
fstp dword [ebp - 0x128]
cvttss2si eax, dword [ebp - 0x128]
mov ecx, esi
mov dword [ebp - 0x70], eax
call fcn.0041bb9b
test eax, eax
je 0x4e9ea8
xor eax, eax
mov ecx, 0x6b5e20
inc eax
push eax
mov dword [ebp - 0x6c], eax
call fcn.00419b82
jmp 0x4e9eac
and dword [ebp - 0x6c], 0
push 0x214
mov ecx, ebx
call fcn.0044c748
mov esi, eax
test esi, esi
je 0x4e9f1e
mov ecx, esi
call fcn.00413d2e
fstp dword [ebp - 0x128]
cvttss2si eax, dword [ebp - 0x128]
mov ecx, esi
mov dword [ebp - 0x64], eax
call fcn.00413d35
fstp dword [ebp - 0x128]
cvttss2si eax, dword [ebp - 0x128]
mov ecx, 0x691150
mov dword [ebp - 0x60], eax
call fcn.00421eee
mov esi, eax
test esi, esi
je 0x4e9f1e
mov ecx, esi
call fcn.0052f179
neg eax
mov ecx, esi
sbb eax, eax
neg eax
mov dword [ebp - 0x5c], eax
call fcn.004cac75
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x58], eax
mov edi, 0x6b6b00
mov ecx, edi
call fcn.004df54e
mov esi, eax
test esi, esi
je 0x4e9f6a
mov ecx, esi
call fcn.00413d2e
fstp dword [ebp - 0x128]
cvttss2si eax, dword [ebp - 0x128]
mov ecx, esi
mov dword [ebp - 0x54], eax
call fcn.00413d35
fstp dword [ebp - 0x128]
cvttss2si eax, dword [ebp - 0x128]
mov ecx, edi
mov dword [ebp - 0x50], eax
call fcn.004e8edc
mov dword [ebp - 0x48], eax
xor ebx, ebx
push ebx
push 0x80
push 2
push ebx
push ebx
push 0x40000000
push dword [ebp - 0x130]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x4e9ff7
mov ecx, 0x6b93e8
mov dword [ebp - 0x138], 0x6111101
call fcn.004e8ee0
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
movzx ecx, al
lea eax, [ebp - 0x12c]
push ebx
push eax
push 4
lea eax, [ebp - 0x138]
mov dword [ebp - 0x134], ecx
push eax
push edi
call esi
push ebx
lea eax, [ebp - 0x12c]
push eax
push 4
lea eax, [ebp - 0x134]
push eax
push edi
call esi
push ebx
lea eax, [ebp - 0x12c]
push eax
push pe_nt_image_headers32
lea eax, [ebp - 0x124]
push eax
push edi
call esi
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005500ac
mov esp, ebp
pop ebp
ret 4