Function at 0x4789b3
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push 0x10c
mov eax, 0x68e4ab
call fcn.0056e23b
mov edi, dword [ebp + 8]
xor ebx, ebx
push edi
mov dword [ebp - 0x118], ebx
call fcn.005655b9
mov esi, eax
pop ecx
test esi, esi
je 0x478ca7
lea ecx, [ebp - 0x8c]
call fcn.00572fee
and dword [ebp - 4], ebx
lea ecx, [ebp - 0xfc]
call fcn.005711dd
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x114]
push ebx
call fcn.0056ff00
mov byte [ebp - 4], 2
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x28], al
mov byte [ebp - 4], 3
push eax
push 0x80
push 3
push eax
push 3
push 0xc0000000
push edi
mov dword [ebp - 0x100], eax
call fcn.005654e9
mov edi, eax
add esp, 0x1c
cmp edi, 0xffffffff
jne 0x478a89
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x28]
push ebx
push 1
call fcn.0041c86a
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x114]
call fcn.00570040
mov byte [ebp - 4], bl
lea ecx, [ebp - 0xfc]
call fcn.0047878a
or dword [ebp - 4], edi
lea ecx, [ebp - 0x8c]
call fcn.00478804
jmp 0x478ca7
push esi
call fcn.0056e306
mov dword [ebp - 0x104], eax
pop ecx
test eax, eax
jne 0x478adb
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x28]
push eax
push 1
call fcn.0041c86a
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x114]
call fcn.00570040
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xfc]
call fcn.0047878a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x8c]
call fcn.00478804
jmp 0x478ca0
push 0
lea ecx, [ebp - 0x100]
push ecx
push esi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x478c53
cmp dword [ebp - 0x100], esi
jne 0x478c53
mov esi, dword [ebp - 0x104]
lea ecx, [ebp - 0x40]
push esi
call fcn.0042b0b0
mov byte [ebp - 4], 4
lea eax, [ebp - 0x114]
push 1
push eax
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0xfc]
call fcn.00571f88
mov bl, al
neg bl
sbb bl, bl
mov byte [ebp - 4], 3
push 0
push 1
lea ecx, [ebp - 0x40]
call fcn.0041c86a
add bl, 1
je 0x478b8f
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x28]
push 0
push 1
call fcn.0041c86a
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x114]
call fcn.00570040
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xfc]
call fcn.0047878a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x8c]
call fcn.00478804
mov ebx, dword [ebp - 0x118]
jmp 0x478c96
push str.savefile
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0x114]
call fcn.00570d5d
lea ecx, [ebp - 0x38]
call fcn.00570040
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x8c]
call fcn.005740a5
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x28]
push eax
call fcn.004788c1
mov byte [ebp - 4], 3
xor ebx, ebx
push ebx
push 1
lea ecx, [ebp - 0x40]
call fcn.0041c86a
push ebx
push ebx
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x100]
push ebx
push ecx
push dword [ebp - 0x18]
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ebx, eax
test ebx, ebx
je 0x478c14
push edi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x28]
push 0
push 1
call fcn.0041c86a
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x114]
call fcn.00570040
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xfc]
call fcn.0047878a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x8c]
call fcn.00478804
jmp 0x478c96
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x28]
push 0
push 1
call fcn.0041c86a
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x114]
call fcn.00570040
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xfc]
call fcn.0047878a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x8c]
call fcn.00478804
mov esi, dword [ebp - 0x104]
push 1
push esi
call fcn.0056df27
pop ecx
pop ecx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
call fcn.0056e1e5
ret 4