Function at 0x1001d640
Capabilities:
Check os version
Get file size
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10135c80
mov eax, dword fs:[0]
push eax
sub esp, 0x9b8
mov eax, dword [0x1017455c]
xor eax, ebp
mov dword [ebp - 0x18], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
xor ebx, ebx
push 0x3ff
lea eax, [ebp - 0x923]
push ebx
push eax
mov byte [ebp - 0x924], bl
call fcn.10116880
add esp, 0xc
push 0x3ff
lea ecx, [ebp - 0x523]
push ebx
push ecx
mov byte [ebp - 0x524], bl
call fcn.10116880
add esp, 0xc
push 0x103
lea edx, [ebp - 0x123]
push ebx
push edx
mov byte [ebp - 0x124], bl
call fcn.10116880
add esp, 0xc
cmp dword [0x1018cc28], 0xffffffff
mov dword [ebp - 0x9c4], ebx
jne 0x1001d711
push 0x94
lea eax, [ebp - 0x9bc]
push ebx
push eax
call fcn.10116880
add esp, 0xc
lea ecx, [ebp - 0x9bc]
push ecx
mov dword [ebp - 0x9bc], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
xor edx, edx
cmp dword [ebp - 0x9ac], 2
sete dl
mov dword [0x1018cc28], edx
push 0x80
push 4
push 3
push 0xc0000000
mov edi, 0x10192308
mov dword [ebp - 4], ebx
call fcn.10033690
mov esi, eax
add esp, 0x10
mov dword [ebp - 0x9c0], esi
cmp esi, 0xffffffff
je 0x1001d8be
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
xor ecx, ecx
lea edx, [ebp - 0x124]
call fcn.100675a0
cmp dword [0x1018cc28], ebx
je 0x1001d788
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
lea eax, [ebp - 0x124]
push eax
lea ecx, [ebp - 0x524]
push str._s__0x_04x__0x_04x___
push ecx
call fcn.1010d6a8
add esp, 0x14
jmp 0x1001d7af
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor eax, 0xff000000
push eax
lea edx, [ebp - 0x124]
push edx
lea eax, [ebp - 0x524]
push str._s__0x_08x___
push eax
call fcn.1010d6a8
add esp, 0x10
mov edx, dword [ebp + 8]
lea ecx, [ebp + 0xc]
push ecx
push edx
lea eax, [ebp - 0x924]
push eax
call fcn.10111b04
add esp, 0xc
cmp byte [ebp - 0x924], 0xa
jne 0x1001d7d7
mov byte [ebp - 0x524], bl
jmp 0x1001d80e
lea eax, [ebp - 0x924]
mov edx, eax
nop
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x1001d7e0
lea edi, [ebp - 0x524]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
cmp cl, bl
jne 0x1001d7f0
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [ebp - 0x9c0]
lea ecx, [ebp - 0x524]
push 0xd
push ecx
call fcn.1010d780
add esp, 8
test eax, eax
jne 0x1001d842
lea edi, [ebp - 0x524]
dec edi
lea ebx, [ebx]
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x1001d830
mov dx, word [0x1014c308]
mov word [edi], dx
lea eax, [ebp - 0x524]
push 0xa
push eax
call fcn.1010d780
add esp, 8
test eax, eax
jne 0x1001d872
lea edi, [ebp - 0x524]
dec edi
mov edi, edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x1001d860
mov cx, word [0x10149d6c]
mov word [edi], cx
push 2
push ebx
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [ebp - 0x524]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x1001d886
mov ecx, dword [ebp - 0x9c0]
sub eax, edx
push ebx
lea edx, [ebp - 0x9c4]
push edx
mov esi, eax
push esi
lea eax, [ebp - 0x524]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1001d8da
lea edx, [ebp - 0x9c0]
push edx
call fcn.100673f0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.1010d699
mov esp, ebp
pop ebp
ret
cmp esi, dword [ebp - 0x9c4]
je 0x1001d8eb
lea eax, [ebp - 0x9c0]
push eax
jmp 0x1001d8b9
lea ecx, [ebp - 0x9c0]
push ecx
jmp 0x1001d8b9