Function at 0x10001091
Capabilities:
Write file on windows

Disassembly:
jmp 0x100ba316
push ebp
lea ebp, [esp - 0x3c4]
sub esp, 0x444
mov eax, dword [0x10178af8]
xor eax, ebp
mov dword [ebp + 0x3c0], eax
mov eax, dword [ebp + 0x3cc]
mov ecx, dword [ebp + 0x3d8]
push ebx
push esi
mov dword [ebp - 0x64], eax
mov eax, dword [eax + 8]
mov dword [ebp - 0x48], ecx
mov ecx, dword [ebp + 0x3dc]
push edi
mov esi, 0x1017ebd8
xor ebx, ebx
push esi
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x70], ebx
mov dword [ebp - 0x5c], eax
call sym.CoreFoundation.dll___CFSpinLock
mov eax, dword [0x1017ebdc]
xor edi, edi
pop ecx
mov dword [ebp - 0x54], edi
cmp eax, ebx
je 0x100ba384
push dword [ebp - 0x5c]
push eax
call sym.CoreFoundation.dll_CFDictionaryGetValue
pop ecx
pop ecx
mov edi, eax
mov dword [ebp - 0x54], eax
push esi
call sym.CoreFoundation.dll___CFSpinUnlock
pop ecx
cmp edi, ebx
jne 0x100ba419
call sym.CoreFoundation.dll__CFGetProgname
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call sym.CoreFoundation.dll_CFRunLoopGetCurrent
push eax
push str._p__d___s_
call sym.CoreFoundation.dll___CFStringMakeConstantString
pop ecx
push eax
push ebx
push ebx
call sym.CoreFoundation.dll_CFStringCreateWithFormat
add esp, 0x18
test byte [ebp + 0x3d0], 1
mov edi, eax
mov eax, str.send
jne 0x100ba3d2
mov eax, str.receive
push eax
push str.In_the_middle_of_windows_msg_to__s_a_message__I_had_an_invalid_pipe_n
call sym.CoreFoundation.dll___CFStringMakeConstantString
pop ecx
push eax
push ebx
push ebx
call sym.CoreFoundation.dll_CFStringCreateWithFormat
add esp, 0x10
mov esi, eax
push esi
push edi
push 0x101400b8
call sym.CoreFoundation.dll___CFStringMakeConstantString
pop ecx
push eax
push 4
call sym.CoreFoundation.dll_CFLog
push edi
call sym.CoreFoundation.dll_CFRelease
push esi
call sym.CoreFoundation.dll_CFRelease
add esp, 0x18
mov eax, 0x10000004
jmp 0x100bac4a
push 0x600
push 0x400
lea eax, [ebp - 0x40]
push eax
push dword [edi + 0x10]
call sym.CoreFoundation.dll_CFStringGetCString
add esp, 0x10
test byte [ebp + 0x3d0], 1
je 0x100bac68
mov edi, str._p__d___s_
mov esi, 0x101400b8
cmp dword [0x1017ebe8], ebx
je 0x100ba4c6
call sym.CoreFoundation.dll__CFGetProgname
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call sym.CoreFoundation.dll_CFRunLoopGetCurrent
push eax
push edi
call sym.CoreFoundation.dll___CFStringMakeConstantString
pop ecx
push eax
push ebx
push ebx
call sym.CoreFoundation.dll_CFStringCreateWithFormat
add esp, 0x18
mov dword [ebp - 0x44], eax
lea eax, [ebp - 0x40]
push eax
push dword [ebp - 0x5c]
mov eax, dword [ebp - 0x64]
push dword [eax + 4]
push str.windows_msg_sending__d_bytes_to_pipe__x__named__s_
call sym.CoreFoundation.dll___CFStringMakeConstantString
pop ecx
push eax
push ebx
push ebx
call sym.CoreFoundation.dll_CFStringCreateWithFormat
add esp, 0x18
push eax
push dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
push esi
call sym.CoreFoundation.dll___CFStringMakeConstantString
pop ecx
push eax
push 7
call sym.CoreFoundation.dll_CFLog
push dword [ebp - 0x44]
call sym.CoreFoundation.dll_CFRelease
push dword [ebp - 0x48]
call sym.CoreFoundation.dll_CFRelease
add esp, 0x18
mov eax, dword [ebp - 0x64]
test dword [eax], 0x80000000
je 0x100ba6a3
call dword [0x10181024]
push eax
mov eax, dword [ebp - 0x64]
push 0x1013ff94
add eax, 0x28
push 0x10
push eax
call dword [0x10181004]
add esp, 0x10
cmp dword [0x1017ebe8], ebx
je 0x100ba56a
call sym.CoreFoundation.dll__CFGetProgname
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call sym.CoreFoundation.dll_CFRunLoopGetCurrent
push eax
push edi
call sym.CoreFoundation.dll___CFStringMakeConstantString
pop ecx
push eax
push ebx
push ebx
call sym.CoreFoundation.dll_CFStringCreateWithFormat
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x64]
add esp, 0x18
add eax, 0x28
push eax
push str.Creating_a_OOL_file_with_name__s
call sym.CoreFoundation.dll___CFStringMakeConstantString
pop ecx
push eax
push ebx
push ebx
call sym.CoreFoundation.dll_CFStringCreateWithFormat
add esp, 0x10
push eax
push dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
push esi
call sym.CoreFoundation.dll___CFStringMakeConstantString
pop ecx
push eax
push 7
call sym.CoreFoundation.dll_CFLog
push dword [ebp - 0x44]
call sym.CoreFoundation.dll_CFRelease
push dword [ebp - 0x48]
call sym.CoreFoundation.dll_CFRelease
add esp, 0x18
call fcn.100b9798
push eax
call fcn.101284b0
add eax, 0x11
pop ecx
mov dword [ebp - 0x48], eax
call fcn.101283a0
mov eax, dword [ebp - 0x64]
add eax, 0x28
mov dword [ebp - 0x4c], esp
push eax
call fcn.100b9798
push eax
push str._s_s
push dword [ebp - 0x48]
push dword [ebp - 0x4c]
call dword [0x10181004]
add esp, 0x14
push ebx
push 0x100
push 2
push ebx
push 5
push 0x40000000
push dword [ebp - 0x4c]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x44], eax
cmp eax, 0xffffffff
jne 0x100ba63d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x44], eax
call sym.CoreFoundation.dll__CFGetProgname
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call sym.CoreFoundation.dll_CFRunLoopGetCurrent
push eax
push edi
call sym.CoreFoundation.dll___CFStringMakeConstantString
pop ecx
push eax
push ebx
push ebx
call sym.CoreFoundation.dll_CFStringCreateWithFormat
add esp, 0x18
push dword [ebp - 0x44]
push dword [ebp - 0x4c]
push str.windows_msg___Error_creating_out_of_line_file_at__s:__d_n
mov edi, eax
call sym.CoreFoundation.dll___CFStringMakeConstantString
pop ecx
push eax
push ebx
push ebx
call sym.CoreFoundation.dll_CFStringCreateWithFormat
add esp, 0x14
mov ebx, eax
push ebx
push edi
push esi
call sym.CoreFoundation.dll___CFStringMakeConstantString
pop ecx
push eax
push 4
call sym.CoreFoundation.dll_CFLog
push edi
call sym.CoreFoundation.dll_CFRelease
push ebx
call sym.CoreFoundation.dll_CFRelease
add esp, 0x18
mov eax, dword [ebp - 0x44]
jmp 0x100bac4a
push ebx
lea eax, [ebp - 0x60]
push eax
mov eax, dword [ebp - 0x64]
push dword [eax + 0x1c]
mov dword [ebp - 0x60], ebx
push dword [eax + 0x18]
push dword [ebp - 0x44]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x100ba69a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x44], eax
call sym.CoreFoundation.dll__CFGetProgname
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call sym.CoreFoundation.dll_CFRunLoopGetCurrent
push eax
push edi
call sym.CoreFoundation.dll___CFStringMakeConstantString
pop ecx
push eax
push ebx
push ebx
call sym.CoreFoundation.dll_CFStringCreateWithFormat
add esp, 0x18
push dword [ebp - 0x44]
push dword [ebp - 0x4c]
push str.windows_msg___Error_writing_to_out_of_line_file_at__s:__d_n
jmp 0x100ba600
push dword [ebp - 0x44]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x1017ebe8], ebx
je 0x100ba71a
call sym.CoreFoundation.dll__CFGetProgname
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call sym.CoreFoundation.dll_CFRunLoopGetCurrent
push eax
push edi
call sym.CoreFoundation.dll___CFStringMakeConstantString
pop ecx
push eax
push ebx
push ebx
call sym.CoreFoundation.dll_CFStringCreateWithFormat
add esp, 0x18
mov dword [ebp - 0x44], eax
lea eax, [ebp - 0x40]
push eax
push dword [ebp - 0x5c]
push str.windows_msg_pipe__x_about_to_get_write_lock_for_write__pipe_name__s_
call sym.CoreFoundation.dll___CFStringMakeConstantString
pop ecx
push eax
push ebx
push ebx
call sym.CoreFoundation.dll_CFStringCreateWithFormat
add esp, 0x14
push eax
push dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
push esi
call sym.CoreFoundation.dll___CFStringMakeConstantString
pop ecx
push eax
push 7
call sym.CoreFoundation.dll_CFLog
push dword [ebp - 0x44]
call sym.CoreFoundation.dll_CFRelease
push dword [ebp - 0x48]
call sym.CoreFoundation.dll_CFRelease
add esp, 0x18
mov eax, dword [ebp - 0x54]
add eax, 0x54
push eax
mov dword [ebp - 0x58], eax
call sym.CoreFoundation.dll___CFSpinLock
mov eax, dword [ebp - 0x54]
pop ecx
add eax, 0x1c
push eax
mov dword [ebp - 0x44], eax
lea eax, [ebp - 0x60]
push eax
mov eax, dword [ebp - 0x64]
push dword [eax + 4]
push eax
push dword [ebp - 0x5c]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x100bac3e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x4c], eax
cmp eax, 0xe8
jne 0x100ba827
mov dword [ebp - 0x4c], 0xa
mov eax, dword [ebp - 0x4c]
dec dword [ebp - 0x4c]
test eax, eax
jle 0x100bac3e
cmp dword [0x1017ebe8], ebx
je 0x100ba7e5
call sym.CoreFoundation.dll__CFGetProgname
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call sym.CoreFoundation.dll_CFRunLoopGetCurrent
push eax
push edi
call sym.CoreFoundation.dll___CFStringMakeConstantString
pop ecx
push eax
push ebx
push ebx
call sym.CoreFoundation.dll_CFStringCreateWithFormat
push str.This_is_CFWindowsNamedPipe_attempting_to_resend_data_on_the_first_write_to_a_pipe
mov dword [ebp - 0x54], eax
call sym.CoreFoundation.dll___CFStringMakeConstantString
push eax
push ebx
push ebx
call sym.CoreFoundation.dll_CFStringCreateWithFormat
add esp, 0x28
push eax
push dword [ebp - 0x54]
mov dword [ebp - 0x48], eax
push esi
call sym.CoreFoundation.dll___CFStringMakeConstantString
pop ecx
push eax
push 7
call sym.CoreFoundation.dll_CFLog
push dword [ebp - 0x54]
call sym.CoreFoundation.dll_CFRelease
push dword [ebp - 0x48]
call sym.CoreFoundation.dll_CFRelease
add esp, 0x18
push 0x64
add byte [eax], al
add byte [esi - 0x77], ah
test dword [eax], edx
loopne 0x100ba82f
invalid
invalid
scasd eax, dword es:[edi]
invalid
inc byte [eax]
add byte [eax], al