Function at 0x6985c0
Capabilities:
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x888058
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x6c
push ebx
push ebp
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
xor esi, esi
mov dword [0x9ddbd8], esi
call edi
mov ebp, dword [esp + 0x90]
mov dword [0x9ddbe0], eax
mov ecx, dword [ebp + 0x24]
or ecx, 1
mov dword [ebp + 0x24], ecx
mov dword [0x9ddbd8], esi
call edi
mov ebx, dword [esp + 0x8c]
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [0x9ddbe0], eax
lea eax, [esp + 0x14]
push 1
push eax
push esi
push ebx
mov dword [esp + 0x24], esi
call edi
push esi
push esi
push esi
push ebx
mov dword [esp + 0x28], eax
call edi
mov edx, dword [0x992ee4]
mov ecx, ebp
push 0x40
push ebp
mov dword [ecx], edx
mov eax, dword [0x992ee8]
mov dword [esp + 0x94], esi
mov dword [ecx + 4], eax
mov edx, dword [0x992eec]
mov dword [ecx + 8], edx
mov eax, dword [0x992ef0]
mov word [ebp + 0x30], 0x40
mov dword [ebp + 0x20], 0x40001
mov dword [ecx + 0xc], eax
mov word [ebp + 0x3e], 0x50
mov dword [ebp + 0x34], esi
call fcn.006a3300
push ebp
mov dword [ebp + 0x34], eax
call fcn.00697560
add esp, 0xc
test eax, eax
je 0x6986fa
cmp ebx, 0xffffffff
je 0x6986ce
cmp ebp, esi
je 0x6986ce
lea ecx, [esp + 0x10]
push esi
push ecx
push 0x40
push ebp
push ebx
mov dword [esp + 0x24], esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x6986ef
mov dword [0x9ddbd8], 0xe
mov dword [0x9ddbdc], 0x1ab0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x9ddbe0], eax
jmp 0x6986fa
mov dword [0x9ddbd8], 1
mov dword [0x9ddbdc], 0x1aa9
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x9ddbe0], eax
jmp 0x6986fa
mov dword [esp + 0x8c], 1
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x14]
push esi
push edx
push eax
push ebx
call edi
cmp dword [esp + 0x8c], esi
jne 0x698735
mov dword [0x9ddbd8], 0x10
mov dword [0x9ddbdc], 0x29d8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x9ddbe0], eax
jmp 0x698a1c
mov ecx, dword [esp + 0xa4]
mov dword [esp + 0x8c], esi
call fcn.00636d30
test eax, eax
jbe 0x698774
mov ecx, dword [esp + 0xa4]
call fcn.00637470
mov ecx, dword [esp + 0xa4]
mov dword [esp + 0x8c], eax
call fcn.00636d30
mov ecx, dword [esp + 0x8c]
mov dword [ecx], eax
mov eax, dword [esp + 0x8c]
mov dword [esp + 0x10], 0x10
cmp eax, esi
je 0x69878f
mov dword [esp + 0x10], 0x38
lea ecx, [esp + 0x90]
mov dword [esp + 0x14], esi
call fcn.00636b60
mov edx, dword [esp + 0x10]
push 0xffffffffffffffff
push edx
lea ecx, [esp + 0x98]
mov dword [esp + 0x8c], esi
call fcn.00636d40
lea ecx, [esp + 0x90]
call fcn.00637450
mov esi, eax
mov eax, dword [esp + 0x10]
xor ecx, ecx
mov dword [esi + 4], eax
mov eax, dword [esp + 0x8c]
test eax, eax
setne cl
mov word [esi + 0xc], cx
mov word [esi], 1
test eax, eax
mov word [esi + 0xe], 0x28
lea ecx, [esi + 0x10]
je 0x698839
mov dword [esp + 0x14], ecx
mov dword [ecx], 3
mov byte [ecx + 4], 1
mov ecx, dword [esp + 0xa4]
call fcn.00636d30
test eax, eax
jbe 0x69881e
mov ecx, dword [esp + 0xa4]
call fcn.00636d30
jmp 0x698820
xor eax, eax
mov dword [esi + 0x1c], eax
mov eax, dword [esi + 0x18]
or al, 1
mov dword [esi + 0x20], 0x100
mov dword [esi + 0x24], 0
mov dword [esi + 0x18], eax
mov edx, dword [esi + 4]
push edx
push esi
call fcn.006a3300
mov cx, word [esp + 0x18]
mov dword [esi + 8], eax
mov eax, dword [esp + 0x9c]
add esp, 8
mov word [eax + 0x12], cx
mov eax, dword [esp + 0x8c]
test eax, eax
je 0x6988de
mov ecx, dword [esp + 0x14]
mov byte [esp + 0x1c], 0
mov edx, dword [ecx + 8]
or edx, 4
mov dword [ecx + 8], edx
xor edx, edx
mov dword [esp + 0x1d], edx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x21], edx
push ecx
mov dword [esp + 0x29], edx
mov word [esp + 0x2d], dx
mov byte [esp + 0x2f], dl
mov edx, dword [eax]
push edx
push eax
push 1
call fcn.00637c00
mov eax, dword [esp + 0xa4]
mov ecx, dword [esp + 0x14]
push eax
push ecx
push ebp
push ebx
call fcn.006994d0
add esp, 0x10
test eax, eax
je 0x698a05
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
add edx, 0x18
mov dword [edx], eax
mov eax, dword [esp + 0x24]
mov dword [edx + 4], ecx
mov ecx, dword [esp + 0x28]
mov dword [edx + 8], eax
mov dword [edx + 0xc], ecx
lea edx, [esp + 0x90]
push esi
push edx
push ebp
push ebx
call fcn.006990b0
add esp, 0x10
test eax, eax
je 0x698a05
xor esi, esi
mov dword [0x9ddbd8], esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x9ddbe0], eax
lea eax, [esp + 0xa4]
push 1
push eax
push esi
push ebx
mov dword [esp + 0xb4], esi
call edi
push esi
push esi
push 0x90
push ebx
mov dword [esp + 0x28], eax
call edi
mov dword [esp + 0x8c], esi
mov esi, dword [esp + 0x98]
push 0x38
push esi
mov word [esi + 4], 0x38
mov dword [esi], 0
call fcn.006a3300
add esp, 8
cmp word [esi + 4], 0x38
mov dword [esp + 0x98], eax
mov dword [esi], eax
jne 0x6989c7
push eax
push 0x38
push esi
mov dword [esi], 0
call fcn.006a32b0
mov ecx, dword [esp + 0xa4]
add esp, 0xc
test eax, eax
mov dword [esi], ecx
je 0x6989c7
lea edx, [esp + 0x2c]
mov ecx, 0xe
lea edi, [esp + 0x2c]
push 0x38
push edx
push ebp
rep movsd dword es:[edi], dword [esi]
call fcn.00698120
add esp, 0xc
test eax, eax
je 0x6989c1
lea eax, [esp + 0x2c]
push 0x38
push eax
push ebx
call fcn.00691b60
add esp, 0xc
test eax, eax
je 0x6989c1
mov dword [esp + 0x8c], 1
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0xa4]
push 0
push ecx
push edx
push ebx
call edi
mov eax, dword [esp + 0x8c]
xor esi, esi
cmp eax, esi
jne 0x698a50
mov dword [0x9ddbd8], 0x10
mov dword [0x9ddbdc], 0x2a32
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x9ddbe0], eax
lea ecx, [esp + 0x90]
mov dword [esp + 0x84], 0xffffffff
call fcn.00636c90
mov dword [0x9ddbd8], 0x10
mov dword [0x9ddbdc], 0x29b1
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
mov dword [0x9ddbe0], eax
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x6c]
mov dword fs:[0], ecx
add esp, 0x78
ret
mov dword [0x9ddbd8], esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x9ddbe0], eax
lea eax, [esp + 0xa4]
push 1
push eax
push esi
push ebx
mov dword [esp + 0xb4], esi
call edi
push esi
push esi
push 0x40
push ebx
mov dword [esp + 0xa8], eax
call edi
mov dword [esp + 0x8c], esi
mov esi, dword [esp + 0x94]
push 0x50
push esi
mov word [esi + 4], 0x50
mov word [esi + 0x10], 0x38
mov dword [esi], 0
call fcn.006a3300
push esi
mov dword [esi], eax
call fcn.00697600
add esp, 0xc
test eax, eax
je 0x698aff
mov ecx, 0x14
lea edi, [esp + 0x2c]
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x2c]
push 0x50
push ecx
push ebp
call fcn.00698120
add esp, 0xc
test eax, eax
je 0x698af9
lea edx, [esp + 0x2c]
push 0x50
push edx
push ebx
call fcn.00691b60
add esp, 0xc
test eax, eax
je 0x698af9
mov dword [esp + 0x8c], 1
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ecx, dword [esp + 0x98]
xor esi, esi
lea eax, [esp + 0xa4]
push esi
push eax
push ecx
push ebx
call edi
cmp dword [esp + 0x8c], esi
jne 0x698b37
mov dword [0x9ddbd8], 0x10
mov dword [0x9ddbdc], 0x2a05
jmp 0x6989fa
mov eax, dword [ebp + 0x24]
and al, 0xfe
mov dword [ebp + 0x24], eax
mov dword [0x9ddbd8], esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea edx, [esp + 0xa4]
push 1
push edx
push esi
push ebx
mov dword [0x9ddbe0], eax
mov dword [esp + 0xb4], esi
call edi
push esi
push esi
push esi
push ebx
mov dword [esp + 0xa4], eax
call edi
push 1
push ebp
call fcn.00699790
push ebp
call fcn.00697560
add esp, 0xc
test eax, eax
je 0x698b9c
push 0x40
push ebp
push ebx
call fcn.00691b60
add esp, 0xc
test eax, eax
je 0x698b9c
mov esi, 1
mov ecx, dword [esp + 0x94]
lea eax, [esp + 0xa4]
push 0
push eax
push ecx
push ebx
call edi
test esi, esi
jne 0x698bce
mov dword [0x9ddbd8], 0x10
mov dword [0x9ddbdc], 0x29d8
jmp 0x6989fa
lea ecx, [esp + 0x90]
mov dword [esp + 0x84], 0xffffffff
call fcn.00636c90
mov ecx, dword [esp + 0x7c]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x78
ret