Function at 0x49b38f
Capabilities:
Create directory
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49f3ed
mov eax, dword fs:[0]
push eax
mov eax, 0x11c8
call fcn.0049ea10
mov eax, dword [0x4d2a20]
xor eax, ebp
mov dword [ebp - 0x28], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0
push 0
push 0
push 0
push 0x100
lea eax, [ebp - 0x12c]
push eax
lea eax, [ebp - 0x1a4]
push eax
push dword [ebp + 8]
call fcn.00487fc3
add esp, 0x20
test eax, eax
je 0x49b3ef
xor eax, eax
jmp 0x49b78e
push dword [ebp + 8]
call fcn.00488545
pop ecx
test eax, eax
je 0x49b403
xor eax, eax
jmp 0x49b78e
push dword [ebp + 8]
push fcn.00486171
lea eax, [ebp - 0x13c]
push eax
call fcn.0043e012
add esp, 0xc
and dword [ebp - 4], 0
lea eax, [ebp - 0x13c]
mov dword [ebp - 0x144], eax
push dword [ebp + 0xc]
lea ecx, [ebp - 0x130]
call fcn.004018ae
mov byte [ebp - 4], 1
lea eax, [ebp - 0x12c]
mov dword [ebp - 0x140], eax
and dword [ebp - 0x11b4], 0
jmp 0x49b45e
mov eax, dword [ebp - 0x11b4]
inc eax
mov dword [ebp - 0x11b4], eax
cmp dword [ebp - 0x11b4], 0x100
jge 0x49b559
mov eax, dword [ebp - 0x11b4]
movsx eax, byte [ebp + eax - 0x12c]
test eax, eax
jne 0x49b4d8
mov eax, dword [ebp - 0x140]
movsx eax, byte [eax]
test eax, eax
jne 0x49b4c2
mov dword [ebp - 0x11c0], 1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x130]
call fcn.00406df8
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x13c]
call fcn.0043df76
mov eax, dword [ebp - 0x11c0]
jmp 0x49b78e
push dword [ebp - 0x140]
lea ecx, [ebp - 0x130]
call fcn.0043df09
jmp 0x49b559
mov eax, dword [ebp - 0x11b4]
movsx eax, byte [ebp + eax - 0x12c]
cmp eax, 0x5c
je 0x49b4fe
mov eax, dword [ebp - 0x11b4]
movsx eax, byte [ebp + eax - 0x12c]
cmp eax, 0x2f
jne 0x49b554
mov eax, dword [ebp - 0x11b4]
mov byte [ebp + eax - 0x12c], 0
push dword [ebp - 0x140]
lea ecx, [ebp - 0x130]
call fcn.0043df09
push 0x4b32fc
lea ecx, [ebp - 0x130]
call fcn.00420d08
push 0
lea ecx, [ebp - 0x130]
call fcn.00413706
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov eax, dword [ebp - 0x11b4]
lea eax, [ebp + eax - 0x12b]
mov dword [ebp - 0x140], eax
jmp 0x49b451
push 0
push 0
push 2
push 0
push 0
push 0x40000000
lea ecx, [ebp - 0x130]
call fcn.00413706
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x148], eax
cmp dword [ebp - 0x148], 0xffffffff
jne 0x49b5b9
and dword [ebp - 0x11c4], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x130]
call fcn.00406df8
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x13c]
call fcn.0043df76
mov eax, dword [ebp - 0x11c4]
jmp 0x49b78e
push dword [ebp - 0x148]
push dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x18]
push eax
call fcn.0043e012
add esp, 0xc
mov byte [ebp - 4], 2
lea eax, [ebp - 0x18]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x11a8], 0x1000
xor eax, eax
inc eax
je 0x49b708
push 0x1000
lea eax, [ebp - 0x11a4]
push eax
push dword [ebp + 8]
call fcn.00486403
add esp, 0xc
mov dword [ebp - 0x11b8], eax
cmp dword [ebp - 0x11b8], 0
jge 0x49b655
and dword [ebp - 0x11c8], 0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x18]
call fcn.0043df90
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x130]
call fcn.00406df8
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x13c]
call fcn.0043df76
mov eax, dword [ebp - 0x11c8]
jmp 0x49b78e
cmp dword [ebp - 0x11b8], 0
jne 0x49b668
jmp 0x49b708
and dword [ebp - 0x11bc], 0
cmp dword [ebp - 0x11b8], 0x1000
jae 0x49b689
mov eax, dword [ebp - 0x11b8]
mov dword [ebp - 0x11d4], eax
jmp 0x49b693
mov dword [ebp - 0x11d4], 0x1000
push 0
lea eax, [ebp - 0x11bc]
push eax
push dword [ebp - 0x11d4]
lea eax, [ebp - 0x11a4]
push eax
push dword [ebp - 0x148]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x49b6c7
mov eax, dword [ebp - 0x11bc]
cmp eax, dword [ebp - 0x11b8]
je 0x49b703
and dword [ebp - 0x11cc], 0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x18]
call fcn.0043df90
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x130]
call fcn.00406df8
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x13c]
call fcn.0043df76
mov eax, dword [ebp - 0x11cc]
jmp 0x49b78e
jmp 0x49b5e5
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x194]
mov eax, dword [ebp - 0x194]
shr eax, 0x10
push eax
call dword [sym.imp.KERNEL32.dll_DosDateTimeToFileTime]
lea eax, [ebp - 0x11b0]
push eax
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFileTimeToFileTime]
lea eax, [ebp - 0x11b0]
push eax
lea eax, [ebp - 0x11b0]
push eax
lea eax, [ebp - 0x11b0]
push eax
push dword [ebp - 0x148]
call dword [sym.imp.KERNEL32.dll_SetFileTime]
mov dword [ebp - 0x11d0], 1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x18]
call fcn.0043df90
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x130]
call fcn.00406df8
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x13c]
call fcn.0043df76
mov eax, dword [ebp - 0x11d0]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x28]
xor ecx, ebp
call fcn.0047676d
leave
ret