Function at 0x489850
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x10
push ebx
push esi
push edi
mov edi, edx
mov eax, dword [edi + 4]
xor esi, esi
cmp eax, esi
mov dword [esp + 0x14], ecx
mov ebx, 1
mov dword [esp + 0xc], esi
mov dword [esp + 0x18], esi
je 0x4898a5
cmp byte [eax], 0x2d
jne 0x4898a5
push 0x62
push eax
call fcn.00563730
add esp, 8
test eax, eax
je 0x48988a
mov dword [esp + 0x18], ebx
mov eax, dword [edi + 4]
push 0x6e
push eax
call fcn.00563730
add esp, 8
test eax, eax
je 0x4898a0
mov dword [esp + 0xc], ebx
mov ebx, 2
mov ecx, dword [edi + ebx*4]
cmp ecx, esi
jne 0x4898c0
mov edx, dword [edi]
push esi
push esi
xor ecx, ecx
call fcn.00475f10
pop edi
pop esi
pop ebx
add esp, 0x10
ret 0xc
push ebp
mov ebp, dword [esp + 0x24]
mov edx, ebp
mov al, byte [ecx]
inc ecx
mov byte [edx], al
inc edx
test al, al
jne 0x4898c7
mov eax, ebp
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4898d6
sub eax, edx
cmp eax, 0x5a
jbe 0x4898fa
mov edx, dword [edi]
push 3
push esi
xor ecx, ecx
call fcn.00475f10
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x10
ret 0xc
mov ecx, ebp
call fcn.00488a40
mov esi, eax
xor eax, eax
cmp esi, eax
jne 0x48991f
mov edx, dword [edi]
push 3
push eax
xor ecx, ecx
call fcn.00475f10
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x10
ret 0xc
mov dword [0x59764c], esi
inc ebx
mov dword [esi + 0x16c], eax
mov dword [esi + 0x170], eax
mov ecx, dword [edi + ebx*4]
cmp ecx, eax
jne 0x48994e
mov edx, dword [edi]
push eax
push eax
xor ecx, ecx
call fcn.00475f10
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x10
ret 0xc
cmp dword [esp + 0x1c], eax
je 0x489986
cmp byte [ecx], 0x26
jne 0x489909
mov edx, ebp
call fcn.0041af50
test eax, eax
jne 0x48997a
mov edx, dword [edi]
push 3
push eax
xor ecx, ecx
call fcn.00475f10
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x10
ret 0xc
mov ecx, dword [eax + 0xc]
mov edx, dword [eax]
mov edi, dword [eax + 8]
add ecx, edx
jmp 0x4899ad
push edi
mov edx, ebp
mov ecx, ebx
mov byte [ebp], 0
call fcn.004ed300
mov eax, ebp
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4899a0
sub eax, edx
mov edi, eax
mov ecx, ebp
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea edx, [esp + 0x18]
push edx
push edi
mov dword [esp + 0x20], 0
mov eax, dword [esi + 0x168]
push ecx
push eax
call ebx
test eax, eax
mov ebp, dword [esp + 0x28]
je 0x489a6b
lea esp, [esp]
cmp dword [esp + 0x14], edi
mov eax, dword [esp + 0x2c]
jne 0x489ab2
test eax, eax
je 0x489a31
mov eax, dword [esp + 0x10]
test eax, eax
je 0x489a06
cmp eax, 1
jne 0x489ad7
add edi, 2
push esi
push edi
xor edx, edx
mov ecx, 0x93e
call fcn.0041c9e0
push eax
push ebp
call dword [sym.imp.USER32.dll_wsprintfA]
mov ecx, dword [0x594094]
add esp, 0x10
push ecx
mov ecx, dword [esp + 0x1c]
mov edx, ebp
call fcn.004fc570
cmp dword [esp + 0x10], 1
jne 0x489ad7
push 0
lea edx, [esp + 0x18]
push edx
mov edi, 2
push edi
mov dword [esp + 0x20], 0
mov eax, dword [esi + 0x168]
push 0x574b0c
push eax
mov dword [esp + 0x24], edi
call ebx
test eax, eax
jne 0x4899e0
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x489a9d
push esi
xor edx, edx
mov ecx, 0x93d
call fcn.0041c9e0
push eax
push ebp
call dword [sym.imp.USER32.dll_wsprintfA]
mov ecx, dword [0x594094]
add esp, 0xc
push ecx
mov ecx, dword [esp + 0x1c]
mov edx, ebp
call fcn.004fc570
pop ebp
mov eax, 1
pop edi
mov dword [esi + 0x170], eax
pop esi
pop ebx
add esp, 0x10
ret 0xc
test eax, eax
je 0x489a9d
push esi
xor edx, edx
mov ecx, 0x93d
call fcn.0041c9e0
push eax
push ebp
call dword [sym.imp.USER32.dll_wsprintfA]
mov edx, dword [0x594094]
add esp, 0xc
push edx
jmp 0x489a92
pop ebp
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x10
ret 0xc