Function at 0x487f30
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [0xa4effc]
sub esp, 0x14c
push ebx
push ebp
push esi
push edi
push eax
call fcn.00487e60
mov esi, 1
lea ecx, [esp + 0xe0]
push esi
push str..BmpCaptureBFP_d.bmp
push ecx
call fcn.006133d6
add esp, 0x10
xor ebx, ebx
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileA]
lea edx, [esp + 0xdc]
push ebx
push 0x80
push esi
push ebx
push 2
push 0x40000000
push edx
call edi
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x487fcc
inc esi
cmp esi, 0x12c
jg 0x4880b3
push esi
lea eax, [esp + 0xe0]
push str..BmpCaptureBFP_d.bmp
push eax
call fcn.006133d6
add esp, 0xc
lea ecx, [esp + 0xdc]
push ebx
push 0x80
push 1
push ebx
push 2
push 0x40000000
push ecx
call edi
mov ebp, eax
cmp ebp, 0xffffffff
je 0x487f88
xor edx, edx
mov ax, word [0x647d70]
mov dword [esp + 0x20], edx
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [esp + 0x24], edx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x28], edx
push ebx
mov word [esp + 0x30], dx
push ecx
lea edx, [esp + 0x28]
push 0xe
push edx
push ebp
mov word [esp + 0x34], ax
mov dword [esp + 0x36], 0x15f936
mov word [esp + 0x3a], bx
mov word [esp + 0x3c], bx
mov dword [esp + 0x3e], 0x36
call esi
mov ecx, 0xa
xor eax, eax
lea edi, [esp + 0x38]
push ebx
rep stosd dword es:[edi], eax
lea eax, [esp + 0x20]
lea ecx, [esp + 0x3c]
push eax
push 0x28
push ecx
push ebp
mov dword [esp + 0x4c], 0x28
mov dword [esp + 0x50], 0x400
mov dword [esp + 0x54], 0x300
mov word [esp + 0x58], 1
mov word [esp + 0x5a], 0x18
mov dword [esp + 0x5c], ebx
mov dword [esp + 0x60], 0x15f900
call esi
mov ecx, 0x1f
xor eax, eax
lea edi, [esp + 0x60]
push ebx
rep stosd dword es:[edi], eax
mov eax, dword [0xa4effc]
lea ecx, [esp + 0x64]
push 1
mov dword [esp + 0x68], 0x7c
mov edx, dword [eax]
push ecx
push ebx
push eax
call dword [edx + 0x64]
test eax, eax
je 0x488101
mov eax, dword [0xa4f274]
push ebx
cmp eax, ebx
push str.ERROR
je 0x4880f0
mov edx, dword [0xa2af98]
push 0x647d54
push edx
jmp 0x4880fb
mov eax, dword [0xa4f274]
push ebx
push ebx
cmp eax, ebx
push ebx
push ebx
je 0x4880d8
push 0x647d2c
call fcn.004cbc90
add esp, 0x14
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14c
ret
push 0x647d04
call fcn.004cbc90
add esp, 0x14
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14c
ret
mov eax, dword [0xa2af98]
push 0x647cf0
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [esp + 0x46]
and ecx, 0xffff
shr ecx, 3
imul ecx, dword [esp + 0x40]
imul ecx, dword [esp + 0x3c]
push ecx
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edx, dword [esp + 0x40]
mov ecx, dword [esp + 0x3c]
mov esi, eax
lea eax, [edx - 1]
mov dword [esp + 0x30], esi
imul eax, ecx
lea edi, [esi + eax*2]
add eax, edi
mov dword [esp + 0x34], eax
mov eax, dword [0x647e54]
mov edi, eax
lea ebx, [eax + edx]
cmp edi, ebx
jge 0x48822c
mov ebx, dword [esp + 0x34]
xor esi, esi
test ecx, ecx
jle 0x48820f
lea eax, [ebx + 1]
mov edx, dword [esp + 0x70]
mov ecx, dword [0x647e50]
sar edx, 1
imul edx, edi
add edx, esi
add eax, 3
add edx, ecx
mov ecx, dword [esp + 0x84]
mov cx, word [ecx + edx*2]
mov dx, word [0xa24a5e]
mov word [0xa24852], cx
and dx, cx
movzx cx, byte [0xa2485a]
shr dx, cl
xor ecx, ecx
mov cl, byte [0xa24856]
shl dl, cl
mov byte [eax - 2], dl
mov edx, dword [0xa24858]
movzx cx, byte [0xa24851]
and dx, word [0xa24852]
shr dx, cl
mov ecx, dword [0xa24850]
and ecx, 0xff
shl dl, cl
mov byte [eax - 3], dl
mov edx, dword [0xa24a5c]
movzx cx, byte [0xa24854]
and dx, word [0xa24852]
shr dx, cl
xor ecx, ecx
mov cl, byte [0xa24855]
shl dl, cl
inc esi
mov byte [eax - 4], dl
mov ecx, dword [esp + 0x3c]
cmp esi, ecx
jl 0x488161
mov edx, dword [esp + 0x40]
mov eax, dword [0x647e54]
lea esi, [ecx*4]
sub esi, ecx
neg esi
add ebx, esi
inc edi
lea esi, [eax + edx]
cmp edi, esi
jl 0x488154
mov esi, dword [esp + 0x30]
mov eax, dword [0xa4effc]
push 0
push eax
mov ecx, dword [eax]
call dword [ecx + 0x80]
lea edx, [esp + 0x1c]
push 0
push edx
push WriteProcessMemory
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [0xa4f274]
test eax, eax
je 0x4882bc
mov eax, dword [0x647ce4]
mov ecx, dword [0x647ce8]
mov dx, word [0x647cec]
mov dword [esp + 0x10], eax
mov al, byte [0x647cee]
mov dword [esp + 0x14], ecx
mov byte [esp + 0x1a], al
lea edi, [esp + 0x10]
or ecx, 0xffffffff
xor eax, eax
mov word [esp + 0x18], dx
push 0
repne scasb al, byte es:[edi]
not ecx
push 0
dec ecx
push 0
push ecx
lea ecx, [esp + 0x20]
push ecx
call fcn.004cbc90
add esp, 0x14
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14c
ret
mov edx, dword [0x647cd8]
mov eax, dword [0x647cdc]
mov cx, word [0x647ce0]
mov dword [esp + 0x10], edx
mov dl, byte [0x647ce2]
mov dword [esp + 0x14], eax
mov word [esp + 0x18], cx
lea edi, [esp + 0x10]
or ecx, 0xffffffff
xor eax, eax
mov byte [esp + 0x1a], dl
push 0
repne scasb al, byte es:[edi]
not ecx
push 0
dec ecx
push 0
lea eax, [esp + 0x1c]
push ecx
push eax
call fcn.004cbc90
add esp, 0x14
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14c
ret