Function at 0x100a9fd0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
cmp dword [ecx + 0x38], 0
push ebx
push esi
push edi
mov dword [esp + 0x10], ecx
je 0x100aa0ca
mov esi, dword [ebp + 0x10]
mov ebx, esi
mov edx, dword [ebp + 0xc]
mov edi, edx
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], eax
test esi, esi
jl 0x100aa0b9
jg 0x100aa00d
test edx, edx
je 0x100aa0b9
lea edx, [ecx + 0x30]
mov eax, dword [ecx + 0x20]
mov dword [esp + 0x1c], edx
mov eax, dword [eax]
mov dword [esp + 0x18], eax
test eax, eax
je 0x100aa027
mov eax, dword [edx]
mov eax, dword [eax]
jmp 0x100aa029
xor eax, eax
cdq
mov esi, eax
mov eax, edx
mov dword [esp + 0x14], eax
test eax, eax
jl 0x100aa077
jg 0x100aa03c
test esi, esi
je 0x100aa077
cmp ebx, eax
jg 0x100aa04c
jl 0x100aa046
cmp edi, esi
jae 0x100aa04c
mov esi, edi
mov dword [esp + 0x14], ebx
mov eax, dword [esp + 0xc]
push esi
push eax
push dword [esp + 0x20]
call sub.VCRUNTIME140.dll_memcpy
mov edx, dword [esp + 0x28]
add esp, 0xc
mov ecx, dword [esp + 0x10]
sub edi, esi
sbb ebx, dword [esp + 0x14]
mov eax, dword [edx]
sub dword [eax], esi
mov eax, dword [ecx + 0x20]
add dword [eax], esi
jmp 0x100aa09d
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
mov eax, dword [esp + 0xc]
movzx eax, byte [eax]
push eax
call edx
cmp eax, 0xffffffff
je 0x100aa0b3
mov ecx, dword [esp + 0x10]
add edi, 0xffffffff
mov esi, 1
adc ebx, 0xffffffff
lea edx, [ecx + 0x30]
add dword [esp + 0xc], esi
test ebx, ebx
jg 0x100aa010
jl 0x100aa0b3
test edi, edi
jne 0x100aa010
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
sub edx, edi
mov eax, edx
sbb esi, ebx
mov edx, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ecx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x20], esi
mov edx, dword [eax]
lea eax, [ecx + 0x30]
mov dword [esp + 0x24], edi
mov dword [esp + 0x1c], edx
mov dword [esp + 0x18], eax
test edx, edx
je 0x100aa0f2
mov eax, dword [eax]
mov edx, dword [eax]
jmp 0x100aa0f8
xor edx, edx
mov dword [esp + 0x18], eax
mov eax, edx
cdq
mov dword [esp + 0x14], eax
mov dword [esp + 0xc], edx
test edi, edi
jl 0x100aa160
jg 0x100aa10d
test esi, esi
je 0x100aa160
test edx, edx
jl 0x100aa15b
jg 0x100aa117
test eax, eax
je 0x100aa15b
cmp edi, edx
jg 0x100aa12b
jl 0x100aa121
cmp esi, eax
jae 0x100aa12b
mov eax, esi
mov dword [esp + 0x14], esi
mov dword [esp + 0xc], edi
mov ebx, dword [ebp + 8]
push eax
push ebx
push dword [esp + 0x24]
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [esp + 0x24]
add esp, 0xc
mov edx, dword [esp + 0x14]
add ebx, edx
mov ecx, dword [esp + 0x10]
sub esi, edx
mov eax, dword [eax]
sbb edi, dword [esp + 0xc]
sub dword [eax], edx
mov eax, dword [ecx + 0x20]
add dword [eax], edx
jmp 0x100aa163
mov ebx, dword [ebp + 8]
jmp 0x100aa16d
mov ebx, dword [ebp + 8]
test edi, edi
jl 0x100aa187
jg 0x100aa16d
test esi, esi
je 0x100aa187
mov eax, dword [ecx + 0x4c]
test eax, eax
je 0x100aa187
push eax
push esi
push 1
push ebx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc