Function at 0x4882e0
Capabilities:
Write file on windows

Disassembly:
push edi
push esi
push ebx
sub esp, 0x40
mov ebx, dword [esp + 0x50]
mov dword [esp + 0x3c], 0
test ebx, ebx
je 0x488590
mov eax, dword [ebx + 0x30]
mov edi, dword [eax + 0x80]
test edi, edi
je 0x488511
mov edx, dword [ebx + 0x20]
mov esi, dword [edx + 0x10]
test esi, esi
jne 0x488430
mov esi, dword [eax + 0xb0]
test esi, esi
je 0x488440
mov edx, dword [eax + 0x78]
mov ecx, dword [eax + 0x7c]
xor edx, dword [eax + 0xb8]
xor ecx, dword [eax + 0xbc]
or ecx, edx
je 0x488419
lea edx, [esp + 0x3c]
mov dword [esp + 0x3c], esi
mov dword [esp + 0xc], edx
mov ecx, dword [ebx + 0x2c]
xor edx, edx
test ecx, ecx
setne dl
add eax, 0x30
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov eax, dword [ebx]
mov dword [esp], eax
call fcn.0046f970
mov edi, eax
mov eax, edx
or eax, edi
jne 0x48846f
cmp dword [esp + 0x3c], esi
je 0x4883f3
mov esi, dword [fcn.004a1b90]
mov dword [esp], 2
call esi
mov dword [esp + 8], 0x54da79
mov dword [esp + 4], str.__s__Unexpected:_stream_was_reallocated_in_fat_cluster_stream_create_with_locator_
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
mov dword [esp], 2
call esi
mov dword [esp + 8], 2
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], 0x54da76
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call esi
mov dword [esp], eax
call sub.msvcrt.dll_fflush
mov eax, dword [ebx + 0x30]
add eax, 0xb0
mov dword [esp], eax
call fcn.0046fa90
mov esi, dword [esp + 0x3c]
mov edi, dword [ebx + 0x2c]
test edi, edi
jne 0x488500
mov ecx, dword [ebx + 0x30]
mov eax, dword [ecx + 0x78]
mov edx, dword [ecx + 0x7c]
mov dword [ecx + 0xb0], esi
mov dword [ecx + 0xb8], eax
mov dword [ecx + 0xbc], edx
mov eax, dword [esp + 0x54]
xor edi, edi
xor edx, edx
mov dword [eax], esi
add esp, 0x40
mov eax, edi
pop ebx
pop esi
pop edi
ret
add esp, 0x40
mov edi, 2
xor edx, edx
mov eax, edi
pop ebx
pop esi
pop edi
ret
lea edx, [esp + 0x3c]
mov dword [esp + 0xc], edx
mov ecx, dword [ebx + 0x2c]
xor edx, edx
test ecx, ecx
setne dl
add eax, 0x30
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov eax, dword [ebx]
mov dword [esp], eax
call fcn.0046f970
mov edi, eax
mov eax, edx
or eax, edi
je 0x4883ef
mov dword [esp + 4], edx
mov dword [esp], edi
mov dword [esp + 0x2c], edx
call fcn.0041d490
mov ebx, dword [fcn.004a1b90]
mov dword [esp], 2
mov esi, eax
call ebx
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], edi
mov dword [esp + 8], 0x54da40
mov dword [esp + 4], str.__s__Failed_to_create_cluster_stream:__lu___s_
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
mov dword [esp], 2
call ebx
mov dword [esp + 8], 2
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], 0x54da76
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call ebx
mov dword [esp], eax
call sub.msvcrt.dll_fflush
mov edx, dword [esp + 0x2c]
add esp, 0x40
mov eax, edi
pop ebx
pop esi
pop edi
ret
mov dword [esp], esi
call fcn.00472630
mov esi, dword [esp + 0x3c]
jmp 0x4883fe
mov esi, dword [fcn.004a1b90]
mov dword [esp], 2
mov edi, 0x16
call esi
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0x54da40
mov dword [esp + 4], str.__s__Invalid_inode_ino___p_.
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
mov dword [esp], 2
call esi
mov dword [esp + 8], 2
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], 0x54da76
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call esi
mov dword [esp], eax
call sub.msvcrt.dll_fflush
add esp, 0x40
mov eax, edi
xor edx, edx
pop ebx
pop esi
pop edi
ret
mov ebx, dword [fcn.004a1b90]
mov dword [esp], 2
mov edi, 0x16
call ebx
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x54da40
mov dword [esp + 4], str.__s__Invalid_argument_ino___p_.
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
mov dword [esp], 2
call ebx
mov dword [esp + 8], 2
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], 0x54da76
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call ebx
mov dword [esp], eax
call sub.msvcrt.dll_fflush
xor edx, edx
jmp 0x488423