Function at 0x489b20
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
cmp esi, ebx
push edi
mov dword [ebp - 8], ebx
jne 0x489b62
cmp dword [0x3f5a180], ebx
jne 0x489b47
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
jmp 0x489b4c
call fcn.004aa220
mov edi, dword [0x3f5a180]
mov ecx, 1
mov dword [ebp + 8], eax
mov dword [ebp - 0xc], edi
mov dword [ebp - 4], ecx
jmp 0x489b8b
mov eax, dword [esi + 0xa8]
mov ecx, dword [esi + 0x108]
mov dword [ebp + 8], eax
mov eax, dword [esi + 0x130]
mov edi, eax
mov dword [ebp - 4], ecx
shr edi, 6
shr eax, 7
and edi, 1
and eax, 1
mov dword [ebp - 0xc], eax
cmp dword [ebp + 0x10], ebx
jne 0x489bf7
cmp esi, ebx
mov eax, 1
je 0x489d9d
test dword [esi + 0x128], 0x40000000
je 0x489d9d
mov ecx, dword [esi + 0x28]
mov eax, dword [esi + 0x30]
lea edx, [ebp - 0x10]
sub eax, ecx
push ebx
push edx
push eax
mov eax, dword [ebp + 8]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, ebx
jne 0x489bcd
or eax, 0xffffffff
mov ecx, dword [esi + 0xb4]
mov edx, dword [esi + 0x28]
add ecx, edx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ecx
mov ecx, dword [esi + 0x128]
and ecx, 0xbfffffff
pop edi
mov dword [esi + 0x128], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp esi, ebx
je 0x489c33
mov eax, dword [esi + 0x30]
cmp eax, ebx
je 0x489c33
mov ebx, dword [ebp + 0xc]
cmp ebx, eax
je 0x489c36
mov ecx, dword [esi + 0x28]
lea edx, [ebp - 0x10]
sub eax, ecx
push 0
push edx
push eax
mov eax, dword [ebp + 8]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x489c2e
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
jmp 0x489c36
mov ebx, dword [ebp + 0xc]
mov eax, dword [0x3f5a180]
test eax, eax
je 0x489cd5
test ecx, ecx
jne 0x489c51
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
test edi, edi
je 0x489c66
cmp ecx, 0xfffffffa
jne 0x489c66
mov ebx, dword [ebp + 8]
mov dword [ebp - 8], 1
jmp 0x489c83
cmp ecx, 1
je 0x489c70
cmp ecx, 2
jne 0x489c80
mov dword [ebp - 8], 1
call fcn.004aa220
mov ebx, eax
jmp 0x489c83
mov ebx, dword [ebp + 0xc]
mov eax, dword [0x3f5a180]
test eax, eax
je 0x489ca6
test edi, edi
je 0x489ca6
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x489ca6
push ebx
call fcn.004aa240
push ebx
call fcn.004aa220
add esp, 8
mov eax, dword [ebp - 8]
test eax, eax
je 0x489cd2
mov esi, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
push 0
push ebx
push esi
push ecx
call fcn.004aa240
add esp, 0x10
cmp eax, esi
je 0x489d9d
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebp + 0xc]
test esi, esi
mov eax, 1
je 0x489d56
test dword [esi + 0x130], 0x10000
je 0x489d3d
mov ecx, dword [esi + 0x28]
cmp ebx, ecx
je 0x489cf6
cmp ebx, dword [esi + 0x30]
jne 0x489d3d
mov edx, dword [esi + 0xb4]
mov edi, dword [esi + 0x2c]
lea edx, [edi + edx*2]
mov edi, dword [esi + 0xb0]
add edi, ecx
cmp edi, edx
jbe 0x489d3d
mov ecx, dword [ebp + 0x10]
mov edi, dword [esi + 0x128]
mov edx, dword [esi + 0x34]
add ebx, ecx
mov ecx, dword [esi + 0xb4]
or edi, 0x40000000
add edx, ecx
mov dword [esi + 0x128], edi
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x30]
cmp ebx, eax
jne 0x489d56
mov ecx, dword [esi + 0x28]
mov edx, dword [ebp + 0x10]
sub eax, ecx
mov dword [ebp + 0xc], ecx
add edx, eax
mov ebx, ecx
mov dword [ebp + 0x10], edx
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 8]
lea edx, [ebp - 0x10]
push 0
push edx
push eax
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x489d72
or eax, 0xffffffff
test esi, esi
je 0x489d9d
mov edx, dword [esi + 0x128]
mov ecx, dword [esi + 0x28]
and edx, 0xbfffffff
mov dword [esi + 0x30], 0
mov dword [esi + 0x128], edx
mov edx, dword [esi + 0xb4]
add edx, ecx
mov dword [esi + 0x34], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret