Function at 0x48c740
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa78
mov eax, dword [0x4c32cc]
xor eax, ebp
mov dword [ebp - 8], eax
cmp dword [0x4cd1d4], 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
jle 0x48ca10
push str.TYPE_UNKNOWN
mov edx, 0x7ffffffe
mov eax, 0x30
lea ecx, [ebp - 0x38]
call fcn.00401000
xor eax, eax
cmp esi, dword [eax*4 + 0x4c43a8]
je 0x48c791
inc eax
cmp eax, 0x34
jl 0x48c780
jmp 0x48c7ab
mov eax, dword [eax*4 + 0x4c4478]
push eax
mov edx, 0x7ffffffe
mov eax, 0x30
lea ecx, [ebp - 0x38]
call fcn.00401000
xor eax, eax
lea ecx, [ecx]
cmp edi, dword [eax*4 + 0x4c4548]
je 0x48c7c1
inc eax
cmp eax, 0x22
jl 0x48c7b0
jmp 0x48c7f5
mov edx, dword [eax*4 + 0x4c45e0]
lea eax, [ebp - 0x68]
mov ecx, eax
mov esi, 0x30
sub edx, ecx
lea ecx, [esi + 0x7fffffce]
test ecx, ecx
je 0x48c7ed
mov cl, byte [edx + eax]
test cl, cl
je 0x48c7ed
mov byte [eax], cl
inc eax
dec esi
jne 0x48c7d4
jmp 0x48c7f1
test esi, esi
jne 0x48c7f2
dec eax
mov byte [eax], 0
lea edx, [ebp - 0x884]
push edx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov ecx, dword [ebp - 0x884]
mov edx, dword [ebp - 0x880]
sub esp, 0x10
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [ebp - 0x87c]
mov dword [eax + 4], edx
mov edx, dword [ebp - 0x878]
mov dword [eax + 8], ecx
lea esi, [ebp - 0x674]
mov dword [eax + 0xc], edx
call fcn.00490da0
add esp, 0x10
lea ebx, [ebp - 0x574]
call fcn.0047ea60
mov eax, 0x104
mov ecx, ebx
lea ebx, [ebx]
cmp byte [ecx], 0
je 0x48c85b
inc ecx
dec eax
jne 0x48c850
jmp 0x48c8a0
test eax, eax
je 0x48c8a0
mov edx, 0x104
sub edx, eax
mov ecx, 0x104
sub ecx, edx
lea eax, [ebp + edx - 0x574]
je 0x48c89c
mov edi, str.history.txt
lea esi, [ecx + edx + 0x7ffffefb]
sub edi, eax
test esi, esi
je 0x48c898
mov dl, byte [edi + eax]
test dl, dl
je 0x48c898
mov byte [eax], dl
inc eax
dec esi
dec ecx
jne 0x48c884
jmp 0x48c89c
test ecx, ecx
jne 0x48c89d
dec eax
mov byte [eax], 0
lea eax, [ebp - 0xa6c]
lea esi, [ebp - 0x68]
mov ecx, eax
mov edx, 0x30
sub esi, ecx
lea ecx, [edx + 0x7fffffce]
test ecx, ecx
je 0x48c8cb
mov cl, byte [esi + eax]
test cl, cl
je 0x48c8cb
mov byte [eax], cl
inc eax
dec edx
jne 0x48c8b2
jmp 0x48c8cf
test edx, edx
jne 0x48c8d0
dec eax
mov byte [eax], 0
lea eax, [ebp - 0xa3c]
lea edx, [ebp - 0x38]
mov ecx, eax
mov esi, 0x30
sub edx, ecx
lea ecx, [esi + 0x7fffffce]
test ecx, ecx
je 0x48c8fe
mov cl, byte [edx + eax]
test cl, cl
je 0x48c8fe
mov byte [eax], cl
inc eax
dec esi
jne 0x48c8e5
jmp 0x48c902
test esi, esi
jne 0x48c903
dec eax
mov ebx, dword [ebp + 8]
mov byte [eax], 0
lea eax, [ebp - 0xa0c]
mov edx, ebx
mov ecx, eax
mov esi, 0x80
sub edx, ecx
lea ebx, [ebx]
lea ecx, [esi + 0x7fffff7e]
test ecx, ecx
je 0x48c939
mov cl, byte [edx + eax]
test cl, cl
je 0x48c939
mov byte [eax], cl
inc eax
dec esi
jne 0x48c920
jmp 0x48c93d
test esi, esi
jne 0x48c93e
dec eax
mov edx, dword [ebp + 0xc]
mov byte [eax], 0
lea eax, [ebp - 0x98c]
mov ecx, eax
mov esi, 0x104
sub edx, ecx
lea ecx, [esi + 0x7ffffefa]
test ecx, ecx
je 0x48c96c
mov cl, byte [edx + eax]
test cl, cl
je 0x48c96c
mov byte [eax], cl
inc eax
dec esi
jne 0x48c953
jmp 0x48c970
test esi, esi
jne 0x48c971
dec eax
lea ecx, [ebp - 0xa6c]
mov byte [eax], 0
call fcn.0048cee0
push 0
push 0x80
push 4
push 0
push 0
push 0x40000000
lea edx, [ebp - 0x574]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0xa70], eax
cmp eax, 0xffffffff
jne 0x48ca23
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
push 0
mov esi, eax
lea eax, [ebp - 0xa70]
push eax
push 0x400
push esi
push 0
push 0x1100
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
mov ecx, dword [ebp - 0xa70]
push ecx
push esi
push str._d___s
lea edx, [ebp - 0x874]
push 0x200
push edx
call fcn.00402830
add esp, 0x14
push str.WriteLog_CreateFile
lea esi, [ebp - 0x874]
call fcn.0047fb10
mov eax, dword [ebp - 0xa70]
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004a01d6
mov esp, ebp
pop ebp
ret
push 2
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [ebp - 0x46c]
lea edx, [ebp - 0x674]
mov ecx, eax
mov esi, 0x400
sub edx, ecx
lea ecx, [esi + 0x7ffffbfe]
test ecx, ecx
je 0x48ca5e
mov cl, byte [edx + eax]
test cl, cl
je 0x48ca5e
mov byte [eax], cl
inc eax
dec esi
jne 0x48ca45
jmp 0x48ca62
test esi, esi
jne 0x48ca63
dec eax
mov byte [eax], 0
mov ecx, 0x400
lea eax, [ebp - 0x46c]
cmp byte [eax], 0
je 0x48ca7c
inc eax
dec ecx
jne 0x48ca71
jmp 0x48cac1
test ecx, ecx
je 0x48cac1
mov edx, 0x400
sub edx, ecx
mov ecx, 0x400
sub ecx, edx
lea eax, [ebp + edx - 0x46c]
je 0x48cabd
mov edi, 0x4b5e58
lea esi, [ecx + edx + 0x7ffffbff]
sub edi, eax
test esi, esi
je 0x48cab9
mov dl, byte [edi + eax]
test dl, dl
je 0x48cab9
mov byte [eax], dl
inc eax
dec esi
dec ecx
jne 0x48caa5
jmp 0x48cabd
test ecx, ecx
jne 0x48cabe
dec eax
mov byte [eax], 0
mov eax, 0x400
lea ecx, [ebp - 0x46c]
lea esp, [esp]
cmp byte [ecx], 0
je 0x48cadb
inc ecx
dec eax
jne 0x48cad0
jmp 0x48cb1e
test eax, eax
je 0x48cb1e
mov edx, 0x400
sub edx, eax
mov ecx, 0x400
sub ecx, edx
lea eax, [ebp + edx - 0x46c]
je 0x48cb1a
lea edi, [ebp - 0x68]
lea esi, [ecx + edx + 0x7ffffbff]
sub edi, eax
test esi, esi
je 0x48cb16
mov dl, byte [edi + eax]
test dl, dl
je 0x48cb16
mov byte [eax], dl
inc eax
dec esi
dec ecx
jne 0x48cb02
jmp 0x48cb1a
test ecx, ecx
jne 0x48cb1b
dec eax
mov byte [eax], 0
mov eax, 0x400
lea ecx, [ebp - 0x46c]
lea esp, [esp]
cmp byte [ecx], 0
je 0x48cb3b
inc ecx
dec eax
jne 0x48cb30
jmp 0x48cb80
test eax, eax
je 0x48cb80
mov edx, 0x400
sub edx, eax
mov ecx, 0x400
sub ecx, edx
lea eax, [ebp + edx - 0x46c]
je 0x48cb7c
mov edi, 0x4b5e58
lea esi, [ecx + edx + 0x7ffffbff]
sub edi, eax
test esi, esi
je 0x48cb78
mov dl, byte [edi + eax]
test dl, dl
je 0x48cb78
mov byte [eax], dl
inc eax
dec esi
dec ecx
jne 0x48cb64
jmp 0x48cb7c
test ecx, ecx
jne 0x48cb7d
dec eax
mov byte [eax], 0
mov eax, 0x400
lea ecx, [ebp - 0x46c]
jmp 0x48cb90
cmp byte [ecx], 0
je 0x48cb9b
inc ecx
dec eax
jne 0x48cb90
jmp 0x48cbde
test eax, eax
je 0x48cbde
mov edx, 0x400
sub edx, eax
mov ecx, 0x400
sub ecx, edx
lea eax, [ebp + edx - 0x46c]
je 0x48cbda
lea edi, [ebp - 0x38]
lea esi, [ecx + edx + 0x7ffffbff]
sub edi, eax
test esi, esi
je 0x48cbd6
mov dl, byte [edi + eax]
test dl, dl
je 0x48cbd6
mov byte [eax], dl
inc eax
dec esi
dec ecx
jne 0x48cbc2
jmp 0x48cbda
test ecx, ecx
jne 0x48cbdb
dec eax
mov byte [eax], 0
mov eax, 0x400
lea ecx, [ebp - 0x46c]
lea esp, [esp]
cmp byte [ecx], 0
je 0x48cbfb
inc ecx
dec eax
jne 0x48cbf0
jmp 0x48cc40
test eax, eax
je 0x48cc40
mov edx, 0x400
sub edx, eax
mov ecx, 0x400
sub ecx, edx
lea eax, [ebp + edx - 0x46c]
je 0x48cc3c
mov edi, 0x4b5e58
lea esi, [ecx + edx + 0x7ffffbff]
sub edi, eax
test esi, esi
je 0x48cc38
mov dl, byte [eax + edi]
test dl, dl
je 0x48cc38
mov byte [eax], dl
inc eax
dec esi
dec ecx
jne 0x48cc24
jmp 0x48cc3c
test ecx, ecx
jne 0x48cc3d
dec eax
mov byte [eax], 0
mov eax, 0x400
lea ecx, [ebp - 0x46c]
jmp 0x48cc50
cmp byte [ecx], 0
je 0x48cc5b
inc ecx
dec eax
jne 0x48cc50
jmp 0x48cc9d
test eax, eax
je 0x48cc9d
mov edx, 0x400
sub edx, eax
mov ecx, 0x400
sub ecx, edx
lea eax, [ebp + edx - 0x46c]
je 0x48cc99
mov edi, ebx
lea esi, [ecx + edx + 0x7ffffbff]
sub edi, eax
test esi, esi
je 0x48cc95
mov dl, byte [eax + edi]
test dl, dl
je 0x48cc95
mov byte [eax], dl
inc eax
dec esi
dec ecx
jne 0x48cc81
jmp 0x48cc99
test ecx, ecx
jne 0x48cc9a
dec eax
mov byte [eax], 0
mov eax, 0x400
lea ecx, [ebp - 0x46c]
cmp byte [ecx], 0
je 0x48ccb3
inc ecx
dec eax
jne 0x48cca8
jmp 0x48ccfc
test eax, eax
je 0x48ccfc
mov edx, 0x400
sub edx, eax
mov ecx, 0x400
sub ecx, edx
lea eax, [ebp + edx - 0x46c]
je 0x48ccf8
mov edi, 0x4b5e58
lea esi, [ecx + edx + 0x7ffffbff]
sub edi, eax
lea esp, [esp]
test esi, esi
je 0x48ccf4
mov dl, byte [eax + edi]
test dl, dl
je 0x48ccf4
mov byte [eax], dl
inc eax
dec esi
dec ecx
jne 0x48cce0
jmp 0x48ccf8
test ecx, ecx
jne 0x48ccf9
dec eax
mov byte [eax], 0
mov eax, 0x400
lea ecx, [ebp - 0x46c]
cmp byte [ecx], 0
je 0x48cd12
inc ecx
dec eax
jne 0x48cd07
jmp 0x48cd5c
test eax, eax
je 0x48cd5c
mov edx, 0x400
sub edx, eax
mov ecx, 0x400
sub ecx, edx
lea eax, [ebp + edx - 0x46c]
je 0x48cd58
mov edi, dword [ebp + 0xc]
lea esi, [ecx + edx + 0x7ffffbff]
sub edi, eax
lea esp, [esp]
test esi, esi
je 0x48cd54
mov dl, byte [edi + eax]
test dl, dl
je 0x48cd54
mov byte [eax], dl
inc eax
dec esi
dec ecx
jne 0x48cd40
jmp 0x48cd58
test ecx, ecx
jne 0x48cd59
dec eax
mov byte [eax], 0
mov eax, 0x400
lea ecx, [ebp - 0x46c]
cmp byte [ecx], 0
je 0x48cd72
inc ecx
dec eax
jne 0x48cd67
jmp 0x48cdbc
test eax, eax
je 0x48cdbc
mov edx, 0x400
sub edx, eax
mov ecx, 0x400
sub ecx, edx
lea eax, [ebp + edx - 0x46c]
je 0x48cdb8
mov edi, 0x4b5e58
lea esi, [ecx + edx + 0x7ffffbff]
sub edi, eax
jmp 0x48cda0
test esi, esi
je 0x48cdb4
mov dl, byte [edi + eax]
test dl, dl
je 0x48cdb4
mov byte [eax], dl
inc eax
dec esi
dec ecx
jne 0x48cda0
jmp 0x48cdb8
test ecx, ecx
jne 0x48cdb9
dec eax
mov byte [eax], 0
mov eax, 0x400
lea ecx, [ebp - 0x46c]
cmp byte [ecx], 0
je 0x48cdd2
inc ecx
dec eax
jne 0x48cdc7
jmp 0x48ce1c
test eax, eax
je 0x48ce1c
mov edx, 0x400
sub edx, eax
mov ecx, 0x400
sub ecx, edx
lea eax, [ebp + edx - 0x46c]
je 0x48ce18
mov edi, dword [ebp + 0x10]
lea esi, [ecx + edx + 0x7ffffbff]
sub edi, eax
lea esp, [esp]
test esi, esi
je 0x48ce14
mov dl, byte [edi + eax]
test dl, dl
je 0x48ce14
mov byte [eax], dl
inc eax
dec esi
dec ecx
jne 0x48ce00
jmp 0x48ce18
test ecx, ecx
jne 0x48ce19
dec eax
mov byte [eax], 0
mov eax, 0x400
lea ecx, [ebp - 0x46c]
cmp byte [ecx], 0
je 0x48ce32
inc ecx
dec eax
jne 0x48ce27
jmp 0x48ce7c
test eax, eax
je 0x48ce7c
mov edx, 0x400
sub edx, eax
mov ecx, 0x400
sub ecx, edx
lea eax, [ebp + edx - 0x46c]
je 0x48ce78
mov edi, 0x4bb83c
lea esi, [ecx + edx + 0x7ffffbff]
sub edi, eax
jmp 0x48ce60
test esi, esi
je 0x48ce74
mov dl, byte [edi + eax]
test dl, dl
je 0x48ce74
mov byte [eax], dl
inc eax
dec esi
dec ecx
jne 0x48ce60
jmp 0x48ce78
test ecx, ecx
jne 0x48ce79
dec eax
mov byte [eax], 0
push 0
lea edx, [ebp - 0xa74]
push edx
lea eax, [ebp - 0x46c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, dword [ebp - 0xa70]
push eax
lea ecx, [ebp - 0x46c]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
mov eax, 1
pop ebx
call fcn.004a01d6
mov esp, ebp
pop ebp
ret