Function at 0x48cb90
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa78
mov eax, dword [0x4f72bc]
xor eax, ebp
mov dword [ebp - 8], eax
cmp dword [0x5016c4], 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
jle 0x48ce60
push str.TYPE_UNKNOWN
mov edx, 0x7ffffffe
mov eax, 0x30
lea ecx, [ebp - 0x38]
call fcn.004010b0
xor eax, eax
cmp esi, dword [eax*4 + 0x4f85d0]
je 0x48cbe1
inc eax
cmp eax, 0x34
jl 0x48cbd0
jmp 0x48cbfb
mov eax, dword [eax*4 + 0x4f86a0]
push eax
mov edx, 0x7ffffffe
mov eax, 0x30
lea ecx, [ebp - 0x38]
call fcn.004010b0
xor eax, eax
lea ecx, [ecx]
cmp edi, dword [eax*4 + 0x4f8770]
je 0x48cc11
inc eax
cmp eax, 0x22
jl 0x48cc00
jmp 0x48cc45
mov edx, dword [eax*4 + 0x4f8808]
lea eax, [ebp - 0x68]
mov ecx, eax
mov esi, 0x30
sub edx, ecx
lea ecx, [esi + 0x7fffffce]
test ecx, ecx
je 0x48cc3d
mov cl, byte [edx + eax]
test cl, cl
je 0x48cc3d
mov byte [eax], cl
inc eax
dec esi
jne 0x48cc24
jmp 0x48cc41
test esi, esi
jne 0x48cc42
dec eax
mov byte [eax], 0
lea edx, [ebp - 0x884]
push edx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov ecx, dword [ebp - 0x884]
mov edx, dword [ebp - 0x880]
sub esp, 0x10
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [ebp - 0x87c]
mov dword [eax + 4], edx
mov edx, dword [ebp - 0x878]
mov dword [eax + 8], ecx
lea esi, [ebp - 0x674]
mov dword [eax + 0xc], edx
call fcn.004c4ef0
add esp, 0x10
lea ebx, [ebp - 0x574]
call fcn.0047c6f0
mov eax, 0x104
mov ecx, ebx
lea ebx, [ebx]
cmp byte [ecx], 0
je 0x48ccab
inc ecx
dec eax
jne 0x48cca0
jmp 0x48ccf0
test eax, eax
je 0x48ccf0
mov edx, 0x104
sub edx, eax
mov ecx, 0x104
sub ecx, edx
lea eax, [ebp + edx - 0x574]
je 0x48ccec
mov edi, str.history.txt
lea esi, [ecx + edx + 0x7ffffefb]
sub edi, eax
test esi, esi
je 0x48cce8
mov dl, byte [edi + eax]
test dl, dl
je 0x48cce8
mov byte [eax], dl
inc eax
dec esi
dec ecx
jne 0x48ccd4
jmp 0x48ccec
test ecx, ecx
jne 0x48cced
dec eax
mov byte [eax], 0
lea eax, [ebp - 0xa6c]
lea esi, [ebp - 0x68]
mov ecx, eax
mov edx, 0x30
sub esi, ecx
lea ecx, [edx + 0x7fffffce]
test ecx, ecx
je 0x48cd1b
mov cl, byte [esi + eax]
test cl, cl
je 0x48cd1b
mov byte [eax], cl
inc eax
dec edx
jne 0x48cd02
jmp 0x48cd1f
test edx, edx
jne 0x48cd20
dec eax
mov byte [eax], 0
lea eax, [ebp - 0xa3c]
lea edx, [ebp - 0x38]
mov ecx, eax
mov esi, 0x30
sub edx, ecx
lea ecx, [esi + 0x7fffffce]
test ecx, ecx
je 0x48cd4e
mov cl, byte [edx + eax]
test cl, cl
je 0x48cd4e
mov byte [eax], cl
inc eax
dec esi
jne 0x48cd35
jmp 0x48cd52
test esi, esi
jne 0x48cd53
dec eax
mov ebx, dword [ebp + 8]
mov byte [eax], 0
lea eax, [ebp - 0xa0c]
mov edx, ebx
mov ecx, eax
mov esi, 0x80
sub edx, ecx
lea ebx, [ebx]
lea ecx, [esi + 0x7fffff7e]
test ecx, ecx
je 0x48cd89
mov cl, byte [edx + eax]
test cl, cl
je 0x48cd89
mov byte [eax], cl
inc eax
dec esi
jne 0x48cd70
jmp 0x48cd8d
test esi, esi
jne 0x48cd8e
dec eax
mov edx, dword [ebp + 0xc]
mov byte [eax], 0
lea eax, [ebp - 0x98c]
mov ecx, eax
mov esi, 0x104
sub edx, ecx
lea ecx, [esi + 0x7ffffefa]
test ecx, ecx
je 0x48cdbc
mov cl, byte [edx + eax]
test cl, cl
je 0x48cdbc
mov byte [eax], cl
inc eax
dec esi
jne 0x48cda3
jmp 0x48cdc0
test esi, esi
jne 0x48cdc1
dec eax
lea ecx, [ebp - 0xa6c]
mov byte [eax], 0
call fcn.0048dda0
push 0
push 0x80
push 4
push 0
push 0
push 0x40000000
lea edx, [ebp - 0x574]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0xa70], eax
cmp eax, 0xffffffff
jne 0x48ce73
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
push 0
mov esi, eax
lea eax, [ebp - 0xa70]
push eax
push 0x400
push esi
push 0
push 0x1100
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
mov ecx, dword [ebp - 0xa70]
push ecx
push esi
push str._d___s
lea edx, [ebp - 0x874]
push 0x200
push edx
call fcn.00402ee0
add esp, 0x14
push str.WriteLog_CreateFile
lea esi, [ebp - 0x874]
call fcn.0047da70
mov eax, dword [ebp - 0xa70]
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004cf2b6
mov esp, ebp
pop ebp
ret
push 2
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [ebp - 0x46c]
lea edx, [ebp - 0x674]
mov ecx, eax
mov esi, 0x400
sub edx, ecx
lea ecx, [esi + 0x7ffffbfe]
test ecx, ecx
je 0x48ceae
mov cl, byte [edx + eax]
test cl, cl
je 0x48ceae
mov byte [eax], cl
inc eax
dec esi
jne 0x48ce95
jmp 0x48ceb2
test esi, esi
jne 0x48ceb3
dec eax
mov byte [eax], 0
mov ecx, 0x400
lea eax, [ebp - 0x46c]
cmp byte [eax], 0
je 0x48cecc
inc eax
dec ecx
jne 0x48cec1
jmp 0x48cf11
test ecx, ecx
je 0x48cf11
mov edx, 0x400
sub edx, ecx
mov ecx, 0x400
sub ecx, edx
lea eax, [ebp + edx - 0x46c]
je 0x48cf0d
mov edi, 0x4e6f24
lea esi, [ecx + edx + 0x7ffffbff]
sub edi, eax
test esi, esi
je 0x48cf09
mov dl, byte [edi + eax]
test dl, dl
je 0x48cf09
mov byte [eax], dl
inc eax
dec esi
dec ecx
jne 0x48cef5
jmp 0x48cf0d
test ecx, ecx
jne 0x48cf0e
dec eax
mov byte [eax], 0
mov eax, 0x400
lea ecx, [ebp - 0x46c]
lea esp, [esp]
cmp byte [ecx], 0
je 0x48cf2b
inc ecx
dec eax
jne 0x48cf20
jmp 0x48cf6e
test eax, eax
je 0x48cf6e
mov edx, 0x400
sub edx, eax
mov ecx, 0x400
sub ecx, edx
lea eax, [ebp + edx - 0x46c]
je 0x48cf6a
lea edi, [ebp - 0x68]
lea esi, [ecx + edx + 0x7ffffbff]
sub edi, eax
test esi, esi
je 0x48cf66
mov dl, byte [edi + eax]
test dl, dl
je 0x48cf66
mov byte [eax], dl
inc eax
dec esi
dec ecx
jne 0x48cf52
jmp 0x48cf6a
test ecx, ecx
jne 0x48cf6b
dec eax
mov byte [eax], 0
mov eax, 0x400
lea ecx, [ebp - 0x46c]
lea esp, [esp]
cmp byte [ecx], 0
je 0x48cf8b
inc ecx
dec eax
jne 0x48cf80
jmp 0x48cfd0
test eax, eax
je 0x48cfd0
mov edx, 0x400
sub edx, eax
mov ecx, 0x400
sub ecx, edx
lea eax, [ebp + edx - 0x46c]
je 0x48cfcc
mov edi, 0x4e6f24
lea esi, [ecx + edx + 0x7ffffbff]
sub edi, eax
test esi, esi
je 0x48cfc8
mov dl, byte [edi + eax]
test dl, dl
je 0x48cfc8
mov byte [eax], dl
inc eax
dec esi
dec ecx
jne 0x48cfb4
jmp 0x48cfcc
test ecx, ecx
jne 0x48cfcd
dec eax
mov byte [eax], 0
mov eax, 0x400
lea ecx, [ebp - 0x46c]
jmp 0x48cfe0
cmp byte [ecx], 0
je 0x48cfeb
inc ecx
dec eax
jne 0x48cfe0
jmp 0x48d02e
test eax, eax
je 0x48d02e
mov edx, 0x400
sub edx, eax
mov ecx, 0x400
sub ecx, edx
lea eax, [ebp + edx - 0x46c]
je 0x48d02a
lea edi, [ebp - 0x38]
lea esi, [ecx + edx + 0x7ffffbff]
sub edi, eax
test esi, esi
je 0x48d026
mov dl, byte [edi + eax]
test dl, dl
je 0x48d026
mov byte [eax], dl
inc eax
dec esi
dec ecx
jne 0x48d012
jmp 0x48d02a
test ecx, ecx
jne 0x48d02b
dec eax
mov byte [eax], 0
mov eax, 0x400
lea ecx, [ebp - 0x46c]
lea esp, [esp]
cmp byte [ecx], 0
je 0x48d04b
inc ecx
dec eax
jne 0x48d040
jmp 0x48d090
test eax, eax
je 0x48d090
mov edx, 0x400
sub edx, eax
mov ecx, 0x400
sub ecx, edx
lea eax, [ebp + edx - 0x46c]
je 0x48d08c
mov edi, 0x4e6f24
lea esi, [ecx + edx + 0x7ffffbff]
sub edi, eax
test esi, esi
je 0x48d088
mov dl, byte [eax + edi]
test dl, dl
je 0x48d088
mov byte [eax], dl
inc eax
dec esi
dec ecx
jne 0x48d074
jmp 0x48d08c
test ecx, ecx
jne 0x48d08d
dec eax
mov byte [eax], 0
mov eax, 0x400
lea ecx, [ebp - 0x46c]
jmp 0x48d0a0
cmp byte [ecx], 0
je 0x48d0ab
inc ecx
dec eax
jne 0x48d0a0
jmp 0x48d0ed
test eax, eax
je 0x48d0ed
mov edx, 0x400
sub edx, eax
mov ecx, 0x400
sub ecx, edx
lea eax, [ebp + edx - 0x46c]
je 0x48d0e9
mov edi, ebx
lea esi, [ecx + edx + 0x7ffffbff]
sub edi, eax
test esi, esi
je 0x48d0e5
mov dl, byte [eax + edi]
test dl, dl
je 0x48d0e5
mov byte [eax], dl
inc eax
dec esi
dec ecx
jne 0x48d0d1
jmp 0x48d0e9
test ecx, ecx
jne 0x48d0ea
dec eax
mov byte [eax], 0
mov eax, 0x400
lea ecx, [ebp - 0x46c]
cmp byte [ecx], 0
je 0x48d103
inc ecx
dec eax
jne 0x48d0f8
jmp 0x48d14c
test eax, eax
je 0x48d14c
mov edx, 0x400
sub edx, eax
mov ecx, 0x400
sub ecx, edx
lea eax, [ebp + edx - 0x46c]
je 0x48d148
mov edi, 0x4e6f24
lea esi, [ecx + edx + 0x7ffffbff]
sub edi, eax
lea esp, [esp]
test esi, esi
je 0x48d144
mov dl, byte [eax + edi]
test dl, dl
je 0x48d144
mov byte [eax], dl
inc eax
dec esi
dec ecx
jne 0x48d130
jmp 0x48d148
test ecx, ecx
jne 0x48d149
dec eax
mov byte [eax], 0
mov eax, 0x400
lea ecx, [ebp - 0x46c]
cmp byte [ecx], 0
je 0x48d162
inc ecx
dec eax
jne 0x48d157
jmp 0x48d1ac
test eax, eax
je 0x48d1ac
mov edx, 0x400
sub edx, eax
mov ecx, 0x400
sub ecx, edx
lea eax, [ebp + edx - 0x46c]
je 0x48d1a8
mov edi, dword [ebp + 0xc]
lea esi, [ecx + edx + 0x7ffffbff]
sub edi, eax
lea esp, [esp]
test esi, esi
je 0x48d1a4
mov dl, byte [edi + eax]
test dl, dl
je 0x48d1a4
mov byte [eax], dl
inc eax
dec esi
dec ecx
jne 0x48d190
jmp 0x48d1a8
test ecx, ecx
jne 0x48d1a9
dec eax
mov byte [eax], 0
mov eax, 0x400
lea ecx, [ebp - 0x46c]
cmp byte [ecx], 0
je 0x48d1c2
inc ecx
dec eax
jne 0x48d1b7
jmp 0x48d20c
test eax, eax
je 0x48d20c
mov edx, 0x400
sub edx, eax
mov ecx, 0x400
sub ecx, edx
lea eax, [ebp + edx - 0x46c]
je 0x48d208
mov edi, 0x4e6f24
lea esi, [ecx + edx + 0x7ffffbff]
sub edi, eax
jmp 0x48d1f0
test esi, esi
je 0x48d204
mov dl, byte [edi + eax]
test dl, dl
je 0x48d204
mov byte [eax], dl
inc eax
dec esi
dec ecx
jne 0x48d1f0
jmp 0x48d208
test ecx, ecx
jne 0x48d209
dec eax
mov byte [eax], 0
mov eax, 0x400
lea ecx, [ebp - 0x46c]
cmp byte [ecx], 0
je 0x48d222
inc ecx
dec eax
jne 0x48d217
jmp 0x48d26c
test eax, eax
je 0x48d26c
mov edx, 0x400
sub edx, eax
mov ecx, 0x400
sub ecx, edx
lea eax, [ebp + edx - 0x46c]
je 0x48d268
mov edi, dword [ebp + 0x10]
lea esi, [ecx + edx + 0x7ffffbff]
sub edi, eax
lea esp, [esp]
test esi, esi
je 0x48d264
mov dl, byte [edi + eax]
test dl, dl
je 0x48d264
mov byte [eax], dl
inc eax
dec esi
dec ecx
jne 0x48d250
jmp 0x48d268
test ecx, ecx
jne 0x48d269
dec eax
mov byte [eax], 0
mov eax, 0x400
lea ecx, [ebp - 0x46c]
cmp byte [ecx], 0
je 0x48d282
inc ecx
dec eax
jne 0x48d277
jmp 0x48d2cc
test eax, eax
je 0x48d2cc
mov edx, 0x400
sub edx, eax
mov ecx, 0x400
sub ecx, edx
lea eax, [ebp + edx - 0x46c]
je 0x48d2c8
mov edi, 0x4ebdd4
lea esi, [ecx + edx + 0x7ffffbff]
sub edi, eax
jmp 0x48d2b0
test esi, esi
je 0x48d2c4
mov dl, byte [edi + eax]
test dl, dl
je 0x48d2c4
mov byte [eax], dl
inc eax
dec esi
dec ecx
jne 0x48d2b0
jmp 0x48d2c8
test ecx, ecx
jne 0x48d2c9
dec eax
mov byte [eax], 0
push 0
lea edx, [ebp - 0xa74]
push edx
lea eax, [ebp - 0x46c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, dword [ebp - 0xa70]
push eax
lea ecx, [ebp - 0x46c]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
mov eax, 1
pop ebx
call fcn.004cf2b6
mov esp, ebp
pop ebp
ret