Function at 0x47890c
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff48
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
lea edi, [ebp - 0x74]
mov word [ebp - 6], 0
mov word [ebp - 8], 0
push 0x41
push 0
push edi
call fcn.0048a3b0
add esp, 0xc
lea eax, [ebp - 0xb8]
push 0x41
push 0
push eax
call fcn.0048a3b0
add esp, 0xc
lea edx, [ebp - 0x18]
push 8
push 0
push edx
call fcn.0048a3b0
add esp, 0xc
push esi
call fcn.00477f30
pop ecx
mov ecx, dword [ebp + 0xc]
mov al, byte [ecx + 1]
mov byte [ebp - 0x19], al
and eax, 0xff
mov edx, dword [ebp + 0xc]
cmp eax, 0x10
mov cx, word [edx + 2]
mov word [ebp - 0x1c], cx
je 0x4789da
lea edx, [ebp - 0x18]
push edx
mov ecx, dword [esi + 2]
push ecx
call fcn.00478308
add esp, 8
test eax, eax
jne 0x4789a2
push esi
call fcn.00479620
pop ecx
or eax, 0xffffffff
jmp 0x478ca8
push 8
mov edx, dword [ebp + 0xc]
movzx ecx, word [edx + 0x418]
push ecx
call fcn.00478028
add esp, 8
mov ebx, eax
movsx eax, bx
push eax
lea edx, [ebp - 0x18]
push edx
mov ecx, dword [ebp + 0xc]
push ecx
mov eax, dword [ebp + 0xc]
push eax
call fcn.004785d0
mov dword [ebp - 4], 1
add esp, 0x10
jmp 0x4789e9
mov edx, dword [ebp + 0xc]
xor eax, eax
mov bx, word [edx + 0x418]
mov dword [ebp - 4], eax
movsx edx, bx
sar edx, 8
mov ecx, ebx
and cl, 0xff
mov byte [edi + 1], dl
mov byte [edi + 2], cl
mov eax, dword [esi + 2]
push eax
call sub.HID.DLL_HidD_FlushQueue
push 0x14
push 0
lea edx, [ebp - 0x30]
push edx
call fcn.0048a3b0
add esp, 0xc
push 0
push 1
push 1
push 0
call sub.KERNEL32.DLL_CreateEventA
mov dword [ebp - 0x20], eax
test bx, bx
jle 0x478adf
mov byte [edi], 2
movsx ecx, word [ebp - 8]
sar ecx, 8
mov byte [edi + 3], cl
mov al, byte [ebp - 8]
and al, 0xff
mov byte [edi + 4], al
mov byte [edi + 5], 0
cmp bx, 0x3a
jle 0x478a4f
mov dl, 0x3a
jmp 0x478a51
mov edx, ebx
mov byte [edi + 6], dl
cmp bx, 0x3a
jle 0x478a61
mov eax, 0x3a
jmp 0x478a64
movsx eax, bx
push eax
movsx edx, word [ebp - 8]
add edx, dword [ebp + 0xc]
push edx
lea ecx, [edi + 7]
push ecx
call fcn.0048a31c
add esp, 0xc
lea eax, [ebp - 0x30]
push eax
lea edx, [ebp - 0x10]
push edx
push 0x41
push edi
mov ecx, dword [esi + 2]
push ecx
call sub.KERNEL32.DLL_WriteFile
test eax, eax
jne 0x478aa5
call sub.KERNEL32.DLL_GetLastError
cmp eax, 0x3e5
je 0x478aa5
or ebx, 0xffffffff
jmp 0x478c91
push 0xffffffffffffffff
mov eax, dword [ebp - 0x20]
push eax
call sub.KERNEL32.DLL_WaitForSingleObject
push 0
lea edx, [ebp - 0x10]
push edx
lea ecx, [ebp - 0x30]
push ecx
mov eax, dword [esi + 2]
push eax
call sub.KERNEL32.DLL_GetOverlappedResult
cmp bx, 0x3a
jle 0x478adf
add bx, 0xffc6
add word [ebp - 8], 0x3a
jmp 0x478ad6
test bx, bx
jg 0x478a2c
push 0x41
push 0
push edi
call fcn.0048a3b0
mov byte [edi + 2], 0x3a
add esp, 0xc
jmp 0x478bf2
mov byte [edi], 1
lea edx, [ebp - 0x30]
push edx
lea ecx, [ebp - 0x10]
push ecx
push 0x41
push edi
mov eax, dword [esi + 2]
push eax
call sub.KERNEL32.DLL_ReadFile
test eax, eax
jne 0x478b5f
call sub.KERNEL32.DLL_GetLastError
cmp eax, 0x3e5
je 0x478b5f
xor edx, edx
mov dl, byte [ebp - 0x19]
cmp edx, 0x15
jne 0x478b55
movzx eax, word [ebp - 0x1c]
cmp eax, 2
je 0x478b32
dec eax
jne 0x478b55
mov edx, dword [ebp - 0x20]
push edx
call sub.KERNEL32.DLL_CloseHandle
xor ecx, ecx
mov dword [ebp - 0x20], ecx
push esi
call fcn.00477f58
pop ecx
push esi
call fcn.00479620
pop ecx
xor eax, eax
jmp 0x478ca8
mov ebx, 0xf0000004
jmp 0x478c91
push 0xffffffffffffffff
mov eax, dword [ebp - 0x20]
push eax
call sub.KERNEL32.DLL_WaitForSingleObject
mov ebx, eax
test ebx, ebx
je 0x478b78
or ebx, 0xffffffff
jmp 0x478c91
push 1
lea eax, [ebp - 0x10]
push eax
lea edx, [ebp - 0x30]
push edx
mov ecx, dword [esi + 2]
push ecx
call sub.KERNEL32.DLL_GetOverlappedResult
test eax, eax
jne 0x478b97
or ebx, 0xffffffff
jmp 0x478c91
xor eax, eax
xor edx, edx
mov al, byte [edi + 3]
mov dl, byte [edi + 4]
shl eax, 8
or ax, dx
movsx edx, ax
cmp edx, 0x410
jb 0x478bba
or ebx, 0xffffffff
jmp 0x478c91
xor ecx, ecx
mov cl, byte [edi + 6]
push ecx
lea ecx, [edi + 7]
push ecx
add edx, dword [ebp + 0xc]
add edx, 8
push edx
call fcn.0048a31c
mov dl, byte [edi + 6]
xor eax, eax
mov al, dl
and edx, 0xff
add esp, 0xc
mov cl, byte [edi + eax + 6]
mov byte [ebp - 9], cl
mov al, byte [edi + eax + 5]
mov byte [ebp - 0xa], al
add word [ebp - 6], dx
movsx ecx, word [ebp - 6]
xor eax, eax
xor edx, edx
mov al, byte [edi + 1]
mov dl, byte [edi + 2]
shl eax, 8
or eax, edx
cmp eax, ecx
jg 0x478af5
add word [ebp - 6], 0xfffe
cmp dword [ebp - 4], 0
je 0x478c61
cmp word [ebp - 6], 2
jle 0x478c51
add word [ebp - 6], 0xfffe
movsx ebx, word [ebp - 6]
push ebx
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp + 0xc]
add eax, 8
push eax
push eax
call fcn.00478640
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0xc]
add esp, 0x10
mov ax, word [ecx + ebx + 8]
mov word [edx + 0x41a], ax
jmp 0x478c6f
mov ecx, dword [ebp + 0xc]
mov ax, word [ebp - 6]
mov word [ecx + 0x41a], ax
jmp 0x478c6f
mov edx, dword [ebp + 0xc]
mov cx, word [ebp - 6]
mov word [edx + 0x41a], cx
mov al, byte [ebp - 0xa]
and al, 0xff
xor edx, edx
mov dl, al
mov cl, byte [ebp - 9]
and cl, 0xff
xor eax, eax
mov al, cl
shl eax, 8
or dx, ax
push edx
call fcn.00478158
pop ecx
mov ebx, eax
mov eax, dword [ebp - 0x20]
push eax
call sub.KERNEL32.DLL_CloseHandle
xor edx, edx
mov dword [ebp - 0x20], edx
push esi
call fcn.00477f58
pop ecx
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret