Function at 0x100927f0
Capabilities:
Get file size
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10143c08
mov eax, dword fs:[0]
push eax
sub esp, 0xb30
mov eax, dword [0x10177024]
xor eax, esp
mov dword [esp + 0xb28], eax
push ebx
push esi
push edi
mov eax, dword [0x10177024]
xor eax, esp
push eax
lea eax, [esp + 0xb40]
mov dword fs:[0], eax
lea ebx, [esp + 0x5c]
mov esi, ecx
call fcn.100918d0
lea ecx, [esp + 0x24]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_void_]
xor ebx, ebx
mov dword [esp + 0xb48], ebx
cmp dword [esp + 0x5c], 3
jne 0x10092a9c
push 0x1ff
lea eax, [esp + 0x939]
push ebx
push eax
mov byte [esp + 0x940], bl
call sub.MSVCR80.dll_memset
add esp, 0xc
push str._GA__Type_
lea ecx, [esp + 0x28]
call dword [0x1014c530]
mov ecx, dword [esp + 0x5c]
push ecx
push 0x10153f8c
mov ecx, 0x200
lea edi, [esp + 0x93c]
call fcn.10091140
add esp, 8
mov edx, edi
push edx
lea ecx, [esp + 0x28]
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::operator_char_const__]
push str.__Type_
lea ecx, [esp + 0x28]
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::operator_char_const__]
push str._MustSend_
lea ecx, [esp + 0x28]
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::operator_char_const__]
cmp byte [esp + 0x60], bl
lea ecx, [esp + 0x24]
je 0x100928df
push 0x10153e30
jmp 0x100928e4
push 0x10153e2c
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::operator_char_const__]
push str.__MustSend_
lea ecx, [esp + 0x28]
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::operator_char_const__]
push str._SetTid_
lea ecx, [esp + 0x28]
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::operator_char_const__]
cmp byte [esp + 0x61], bl
lea ecx, [esp + 0x24]
je 0x10092919
push 0x10153e30
jmp 0x1009291e
push 0x10153e2c
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::operator_char_const__]
push str.__SetTid_
lea ecx, [esp + 0x28]
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::operator_char_const__]
push str._Tid_
lea ecx, [esp + 0x28]
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::operator_char_const__]
lea eax, [esp + 0x62]
push eax
lea ecx, [esp + 0x28]
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::operator_char_const__]
push str.__Tid_
lea ecx, [esp + 0x28]
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::operator_char_const__]
push str._SetCid_
lea ecx, [esp + 0x28]
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::operator_char_const__]
cmp byte [esp + 0x162], bl
lea ecx, [esp + 0x24]
je 0x10092983
push 0x10153e30
jmp 0x10092988
push 0x10153e2c
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::operator_char_const__]
push str.__SetCid_
lea ecx, [esp + 0x28]
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::operator_char_const__]
push str._Cid_
lea ecx, [esp + 0x28]
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::operator_char_const__]
lea ecx, [esp + 0x163]
push ecx
lea ecx, [esp + 0x28]
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::operator_char_const__]
push str.__Cid_
lea ecx, [esp + 0x28]
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::operator_char_const__]
push str._Category_
lea ecx, [esp + 0x28]
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::operator_char_const__]
lea edx, [esp + 0x263]
push edx
lea ecx, [esp + 0x28]
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::operator_char_const__]
push str.__Category_
lea ecx, [esp + 0x28]
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::operator_char_const__]
push str._Action_
lea ecx, [esp + 0x28]
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::operator_char_const__]
lea eax, [esp + 0x2f9]
push eax
lea ecx, [esp + 0x28]
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::operator_char_const__]
push str.__Action_
lea ecx, [esp + 0x28]
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::operator_char_const__]
push str._Label_
lea ecx, [esp + 0x28]
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::operator_char_const__]
lea ecx, [esp + 0x4ed]
push ecx
lea ecx, [esp + 0x28]
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::operator_char_const__]
push str.__Label_
lea ecx, [esp + 0x28]
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::operator_char_const__]
push str._Value_
lea ecx, [esp + 0x28]
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::operator_char_const__]
lea edx, [esp + 0x8ed]
push edx
lea ecx, [esp + 0x28]
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::operator_char_const__]
push str.__Value_
lea ecx, [esp + 0x28]
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::operator_char_const__]
push str.__GA__r_n
lea ecx, [esp + 0x28]
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::operator_char_const__]
add esi, 0x38
push esi
lea ecx, [esp + 0x44]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const__]
push str.WindowsAB_Function.dat
lea ecx, [esp + 0x44]
mov byte [esp + 0xb4c], 1
call dword [0x1014c4e8]
cmp dword [esp + 0x58], 8
mov eax, dword [esp + 0x44]
mov dword [esp + 0x14], vtable.FileControl.0
jae 0x10092ad8
lea eax, [esp + 0x44]
push ebx
push ebx
push eax
lea ecx, [esp + 0x20]
call fcn.10094560
test al, al
je 0x10092b91
push 8
lea eax, [esp + 0x20]
push eax
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
call dword [sym.imp.KERNEL32.dll_IsBadWritePtr]
test eax, eax
mov esi, dword [esp + 0x18]
jne 0x10092b15
lea ecx, [esp + 0x1c]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov ecx, dword [esp + 0x38]
mov eax, ecx
xor edx, edx
add eax, dword [esp + 0x1c]
adc edx, dword [esp + 0x20]
mov dword [esp + 0x18], edx
js 0x10092b34
jg 0x10092b91
cmp eax, 0x200000
jae 0x10092b91
cmp dword [esp + 0x3c], 0x10
mov edi, dword [esp + 0x28]
mov ebx, ecx
jae 0x10092b45
lea edi, [esp + 0x28]
push ecx
push edi
mov dword [esp + 0x1c], 0
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x10092b83
test ebx, ebx
je 0x10092b83
push 2
xor ecx, ecx
push ecx
push ecx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x10092b83
push 0
lea eax, [esp + 0x18]
push eax
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x10092bbc
push esi
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x40]
mov byte [esp + 0xb48], 0
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
lea ecx, [esp + 0x24]
mov dword [esp + 0xb48], 0xffffffff
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
xor al, al
jmp 0x10092bf3
push esi
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x40]
mov byte [esp + 0xb48], 0
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
lea ecx, [esp + 0x24]
mov dword [esp + 0xb48], 0xffffffff
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
mov al, 1
mov ecx, dword [esp + 0xb40]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xb28]
xor ecx, esp
call fcn.10130e50
mov esp, ebp
pop ebp
ret