Function at 0x1008aff5
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x70]
sub esp, 0x498
and byte [ebp + 0x5c], 0
and byte [ebp + 0x5d], 0
and byte [ebp + 0x5e], 0
and byte [ebp + 0x5f], 0
and byte [ebp + 0x6c], 0
and byte [ebp + 0x60], 0
push ebx
push esi
push edi
mov edx, ecx
push 0x1b
xor eax, eax
pop ecx
lea edi, [ebp - 0x14]
rep stosd dword es:[edi], eax
mov eax, dword [edx]
mov ebx, 0xff
xor esi, esi
cmp eax, 0x29
mov dword [ebp + 0x58], edx
mov byte [ebp + 0x6d], 0x55
mov byte [ebp + 0x6e], 0xaa
mov byte [ebp + 0x6f], bl
mov byte [ebp + 0x61], 0x24
mov byte [ebp + 0x62], 0x49
mov byte [ebp + 0x63], 0x6d
mov byte [ebp + 0x64], 0x92
mov byte [ebp + 0x65], 0xb6
mov byte [ebp + 0x66], 0xdb
mov byte [ebp + 0x67], bl
mov dword [ebp + 0x68], esi
jg 0x1008b0cf
je 0x1008b064
push 0xf
sub eax, 0x14
pop ecx
cmp eax, ecx
ja case.0x1008adff.28
jmp dword [eax*4 + 0x1008b2ab]
push 3
mov dword [ebp - 0x14], 0x28
mov dword [ebp - 4], esi
mov word [ebp - 6], 8
mov dword [ebp + 0x68], 0x400
pop edi
mov ecx, esi
shr ecx, 5
mov cl, byte [ebp + ecx + 0x60]
mov eax, esi
shl eax, 2
and byte [ebp + eax - 0x425], 0
mov byte [ebp + eax - 0x426], cl
mov ecx, esi
shr ecx, 2
and ecx, 7
mov cl, byte [ebp + ecx + 0x60]
mov byte [ebp + eax - 0x427], cl
mov ecx, esi
and ecx, edi
mov cl, byte [ebp + ecx + 0x6c]
inc esi
cmp esi, 0x100
mov byte [ebp + eax - 0x428], cl
jb 0x1008ae20
jmp 0x1008b163
mov dword [ebp - 0x14], 0x28
mov dword [ebp - 4], esi
mov word [ebp - 6], 0x18
jmp 0x1008b163
mov dword [ebp - 0x14], 0x28
mov dword [ebp - 4], esi
mov word [ebp - 6], 0x10
jmp 0x1008b163
mov dword [ebp - 0x14], 0x28
mov dword [ebp - 4], esi
mov word [ebp - 6], 0x20
jmp 0x1008b163
mov dword [ebp - 0x14], 0x34
mov dword [ebp - 4], 3
mov word [ebp - 6], 0x10
mov dword [ebp + 0x14], 0xf800
mov dword [ebp + 0x18], 0x7e0
mov dword [ebp + 0x1c], 0x1f
jmp 0x1008b163
mov dword [ebp - 0x14], 0x34
mov dword [ebp - 4], 3
mov word [ebp - 6], 0x10
mov dword [ebp + 0x14], 0xf00
mov dword [ebp + 0x18], 0xf0
mov dword [ebp + 0x1c], ecx
jmp 0x1008b163
mov dword [ebp - 0x14], 0x38
mov dword [ebp - 4], 3
mov word [ebp - 6], 0x10
mov dword [ebp + 0x14], 0x7c00
mov dword [ebp + 0x18], 0x3e0
mov dword [ebp + 0x1c], 0x1f
mov dword [ebp + 0x20], 0x8000
jmp 0x1008b163
mov dword [ebp - 0x14], 0x38
mov dword [ebp - 4], 3
mov word [ebp - 6], 0x10
mov dword [ebp + 0x14], 0xf00
mov dword [ebp + 0x18], 0xf0
mov dword [ebp + 0x1c], ecx
mov dword [ebp + 0x20], 0xf000
jmp 0x1008b163
push 3
pop edi
mov dword [ebp - 4], edi
mov dword [ebp + 0x14], 0xe0
mov dword [ebp + 0x18], 0x1c
mov dword [ebp + 0x1c], edi
mov dword [ebp - 0x14], 0x38
mov word [ebp - 6], 0x10
mov dword [ebp + 0x20], 0xff00
jmp 0x1008b163
mov dword [ebp - 0x14], 0x34
mov dword [ebp - 4], 3
mov word [ebp - 6], 0x20
mov dword [ebp + 0x14], ebx
mov dword [ebp + 0x18], 0xff00
mov dword [ebp + 0x1c], 0xff0000
jmp 0x1008b163
mov dword [ebp - 0x14], 0x38
mov dword [ebp - 4], 3
mov word [ebp - 6], 0x20
mov dword [ebp + 0x14], ebx
mov dword [ebp + 0x18], 0xff00
mov dword [ebp + 0x1c], 0xff0000
mov dword [ebp + 0x20], 0xff000000
jmp 0x1008b163
mov dword [ebp + 0x14], 0x3ff
mov dword [ebp + 0x1c], 0x3ff00000
jmp 0x1008b013
mov dword [ebp + 0x14], 0x3ff00000
mov dword [ebp + 0x1c], 0x3ff
mov dword [ebp - 0x14], 0x38
mov dword [ebp - 4], 3
mov word [ebp - 6], 0x20
mov dword [ebp + 0x18], 0xffc00
mov dword [ebp + 0x20], 0xc0000000
jmp 0x1008b163
mov dword [ebp - 0x14], 0x34
mov dword [ebp - 4], 3
mov word [ebp - 6], 0x20
mov dword [ebp + 0x14], 0xffff
mov dword [ebp + 0x18], 0xffff0000
mov dword [ebp + 0x1c], esi
jmp 0x1008b163
mov eax, dword [edx + 8]
mov dword [ebp - 4], esi
mov ecx, eax
lea esi, [eax + 2]
lea eax, [ebp - 0x427]
xor edi, edi
mov dword [ebp - 0x14], 0x28
mov word [ebp - 6], 8
mov dword [ebp + 0x68], 0x400
sub ecx, eax
mov eax, edi
shl eax, 2
lea ebx, [ecx + eax]
mov bl, byte [ebp + ebx - 0x427]
mov byte [ebp + eax - 0x426], bl
mov bl, byte [esi - 1]
mov byte [ebp + eax - 0x427], bl
mov bl, byte [esi]
and byte [ebp + eax - 0x425], 0
inc edi
add esi, 4
cmp edi, 0x100
mov byte [ebp + eax - 0x428], bl
jb 0x1008b08d
jmp 0x1008b163
sub eax, 0x32
je 0x1008b11f
dec eax
je 0x1008b10a
sub eax, 0x1e
je 0x1008b0e6
mov eax, 0x80004005
jmp 0x1008b2a1
mov eax, 0xffff
mov dword [ebp - 0x14], 0x34
mov dword [ebp - 4], 3
mov word [ebp - 6], 0x10
mov dword [ebp + 0x14], eax
mov dword [ebp + 0x18], eax
mov dword [ebp + 0x1c], eax
jmp 0x1008b163
mov dword [ebp - 4], 3
mov dword [ebp + 0x14], ebx
mov dword [ebp + 0x18], ebx
mov dword [ebp + 0x1c], ebx
jmp 0x1008af81
mov dword [ebp - 0x14], 0x28
mov dword [ebp - 4], esi
mov word [ebp - 6], 8
mov dword [ebp + 0x68], 0x400
xor ecx, ecx
mov eax, ecx
shl eax, 2
and byte [ebp + eax - 0x425], 0
mov byte [ebp + eax - 0x426], cl
mov byte [ebp + eax - 0x427], cl
mov byte [ebp + eax - 0x428], cl
inc ecx
cmp ecx, 0x100
jb 0x1008b138
movzx ebx, word [ebp - 6]
mov ecx, dword [edx + 0xc]
mov eax, dword [edx + 0x10]
mov dword [ebp - 0x10], ecx
shr ebx, 3
imul ecx, ebx
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x18], ecx
add ecx, 3
and ecx, 0xfffffffc
imul eax, ecx
mov esi, 0xb12
mov dword [ebp + 4], esi
mov dword [ebp + 8], esi
mov esi, dword [ebp - 0x14]
add eax, esi
mov dword [ebp + 0x64], ecx
mov ecx, dword [ebp + 0x68]
lea ecx, [eax + ecx + 0xe]
xor eax, eax
lea edi, [ebp - 0x28]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp + 0x6c], esi
lea esi, [ecx + 3]
stosw word es:[edi], ax
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
and esi, 0xfffffffc
sub esi, ecx
cmp dword [ebp + 0x7c], 0
lea eax, [esi + ecx]
mov ecx, dword [ebp + 0x68]
mov dword [ebp - 0x26], eax
mov eax, dword [ebp - 0x14]
lea eax, [eax + ecx + 0xe]
mov word [ebp - 8], 1
mov word [ebp - 0x28], 0x4d42
mov dword [ebp - 0x1e], eax
je 0x1008b1f3
push 0
lea eax, [ebp + 0x7c]
push eax
push 0xe
lea eax, [ebp - 0x28]
push eax
push dword [ebp + 0x78]
call edi
mov edx, dword [ebp + 0x58]
cmp dword [ebp + 0x6c], 0
je 0x1008b20e
push 0
lea eax, [ebp + 0x7c]
push eax
push dword [ebp + 0x6c]
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 0x78]
call edi
mov edx, dword [ebp + 0x58]
cmp dword [ebp + 0x68], 0
je 0x1008b22c
push 0
lea eax, [ebp + 0x7c]
push eax
push dword [ebp + 0x68]
lea eax, [ebp - 0x428]
push eax
push dword [ebp + 0x78]
call edi
mov edx, dword [ebp + 0x58]
mov ecx, dword [edx + 0x30]
mov eax, dword [edx + 0x1c]
imul eax, ecx
mov dword [ebp + 0x6c], ecx
mov ecx, dword [edx + 0x18]
imul ecx, ebx
mov ebx, dword [edx + 0x10]
add eax, ecx
add eax, dword [edx + 4]
dec ebx
imul ebx, dword [ebp + 0x6c]
add ebx, eax
cmp ebx, eax
mov dword [ebp + 0x68], eax
jb 0x1008b28b
push 0
lea eax, [ebp + 0x7c]
push eax
push dword [ebp - 0x18]
push ebx
push dword [ebp + 0x78]
call edi
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp + 0x64]
jae 0x1008b280
push 0
lea ecx, [ebp + 0x7c]
push ecx
mov ecx, dword [ebp + 0x64]
sub ecx, eax
push ecx
lea eax, [ebp + 0x5c]
push eax
push dword [ebp + 0x78]
call edi
mov eax, dword [ebp + 0x58]
sub ebx, dword [eax + 0x30]
cmp ebx, dword [ebp + 0x68]
jae 0x1008b254
test esi, esi
je 0x1008b29f
push 0
lea eax, [ebp + 0x7c]
push eax
push esi
lea eax, [ebp + 0x5c]
push eax
push dword [ebp + 0x78]
call edi
xor eax, eax
pop edi
pop esi
pop ebx
add ebp, 0x70
leave
ret 8