Function at 0x48d948
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], ecx
mov ebx, edx
mov edi, eax
xor eax, eax
push ebp
push 0x48dbf8
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
push ebp
push 0x48dba9
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [0x57e214]
mov eax, dword [eax]
call fcn.00478ae8
lea ecx, [ebp - 0x30]
mov edx, ebx
mov eax, edi
call fcn.0048e5e4
test al, al
je 0x48db7e
mov eax, dword [edi + 0x18]
mov edx, dword [ebp - 0x30]
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov esi, dword [eax + 0x1c]
shl esi, 0x20
mov eax, dword [ebp - 0x2c]
or esi, dword [eax + 0x20]
push 0
push 0x80
push 2
push 0
push 2
push 0x40000000
mov eax, dword [ebp - 4]
call fcn.004055f8
push eax
call sub.kernel32.dll_CreateFileA_1
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0xffffffff
jne 0x48da07
lea eax, [ebp - 0x34]
mov ecx, dword [ebp - 4]
mov edx, 0x48dc14
call fcn.00405444
mov edx, dword [ebp - 0x34]
mov eax, dword [0x57e200]
mov eax, dword [eax]
call fcn.0047e984
xor edx, edx
push ebp
push 0x48db61
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, 0xfe00
mov eax, esi
call fcn.0047d4c8
xor edx, edx
push edx
push eax
mov eax, edi
call fcn.0048eb54
shl eax, 9
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
call fcn.00402ef0
mov dword [ebp - 0x20], eax
xor eax, eax
push ebp
push 0x48db0a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x168]
mov dword [ebp - 0x18], eax
test esi, esi
je 0x48daf4
mov eax, dword [0x57e214]
mov eax, dword [eax]
call fcn.00478ae8
mov edx, dword [ebp - 0x24]
mov eax, esi
call fcn.0047d4c8
mov ebx, eax
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, edi
call fcn.0048eb54
mov dword [ebp - 0x1c], eax
cmp byte [edi + 0xa], 0
je 0x48daa5
mov eax, dword [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x20]
mov eax, dword [0x57e4fc]
mov eax, dword [eax]
mov edx, dword [ebp - 0x18]
call fcn.0048c908
jmp 0x48dabb
mov eax, dword [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x20]
mov eax, dword [0x57dff4]
mov eax, dword [eax]
mov edx, dword [ebp - 0x18]
call fcn.0047f5ec
push 0
lea eax, [ebp - 0x14]
push eax
push ebx
mov eax, dword [ebp - 0x20]
push eax
mov eax, dword [ebp - 0x28]
push eax
call sub.kernel32.dll_WriteFile_1
test eax, eax
jne 0x48dae4
mov eax, dword [0x57e200]
mov eax, dword [eax]
mov edx, 0x48dc34
call fcn.0047e984
sub esi, ebx
mov eax, dword [ebp - 0x1c]
add dword [ebp - 0x18], eax
test esi, esi
jne 0x48da5f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48db11
mov eax, dword [ebp - 0x20]
call fcn.00402f20
ret
lea eax, [ebp - 0x38]
mov ecx, ebx
mov edx, 0x48dc74
call fcn.00405444
mov edx, dword [ebp - 0x38]
lea ecx, [ebp - 5]
mov eax, dword [0x57e200]
mov eax, dword [eax]
call fcn.0047e828
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x48dbd0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48dbff
lea eax, [ebp - 0x38]
mov edx, 2
call fcn.0040515c
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.0040515c
ret