Function at 0x1000c890
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x364
mov eax, dword [0x1002e004]
xor eax, esp
mov dword [esp + 0x360], eax
push ebx
mov ebx, dword [esp + 0x370]
push ebp
push esi
mov esi, ecx
push edi
cmp dword [esi + 4], 0xffffffff
je 0x1000c8be
mov ecx, dword [esi]
call fcn.1000bfa0
mov eax, dword [esi]
mov edi, dword [esp + 0x378]
mov dword [esi + 4], 0xffffffff
cmp edi, dword [eax + 4]
jl 0x1000c8f3
mov eax, 0x10000
mov ecx, dword [esp + 0x370]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1001026b
add esp, 0x364
ret 0x10
cmp dword [eax + 0x10], edi
jle 0x1000c904
mov ecx, eax
call fcn.1000b940
mov eax, dword [esi]
cmp dword [eax + 0x10], edi
jge 0x1000c914
mov ecx, dword [esi]
call fcn.1000b980
mov eax, dword [esi]
cmp dword [eax + 0x10], edi
jl 0x1000c906
lea eax, [esp + 0x1c]
mov ecx, esi
push eax
push edi
call fcn.1000c250
test byte [esp + 0x124], 0x10
mov al, byte [ebx]
je 0x1000c960
cmp al, 0x2f
je 0x1000c950
cmp al, 0x5c
je 0x1000c950
test al, al
je 0x1000c93f
cmp byte [ebx + 1], 0x3a
je 0x1000c950
lea ecx, [esi + 0x140]
mov edx, ebx
call fcn.1000c770
xor eax, eax
jmp 0x1000c8d8
xor ecx, ecx
mov edx, ebx
call fcn.1000c770
xor eax, eax
jmp 0x1000c8d8
mov edx, ebx
mov ecx, ebx
test al, al
je 0x1000c97b
cmp al, 0x2f
je 0x1000c970
cmp al, 0x5c
jne 0x1000c973
lea edx, [ecx + 1]
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x1000c968
lea edi, [esp + 0x15c]
mov ecx, ebx
sub edi, ebx
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edi + ecx - 1], al
test al, al
jne 0x1000c986
cmp edx, ebx
jne 0x1000c9a0
mov byte [esp + 0x15c], al
jmp 0x1000c9da
mov eax, edx
sub eax, ebx
cmp eax, 0x104
jae 0x1000cb63
mov byte [esp + eax + 0x15c], 0
mov al, byte [esp + 0x15c]
cmp al, 0x2f
je 0x1000c9d8
cmp al, 0x5c
je 0x1000c9d8
test al, al
je 0x1000c9d4
cmp byte [esp + 0x15d], 0x3a
je 0x1000c9d8
xor al, al
jmp 0x1000c9da
mov al, 1
test al, al
mov dword [esp + 0x14c], 0x73257325
push edx
lea eax, [esp + 0x160]
mov byte [esp + 0x154], 0
mov word [esp + 0x158], 0x7325
mov dword [esp + 0x15b], 0x732573
mov byte [esp + 0x15a], 0x25
push eax
je 0x1000ca3a
lea eax, [esp + 0x154]
push eax
push 0xffffffffffffffff
lea eax, [esp + 0x274]
push 0x104
push eax
call fcn.1000f490
add esp, 0x18
xor edi, edi
jmp 0x1000ca60
lea edi, [esi + 0x140]
push edi
lea eax, [esp + 0x160]
push eax
push 0xffffffffffffffff
lea eax, [esp + 0x278]
push 0x104
push eax
call fcn.1000f490
add esp, 0x1c
lea edx, [esp + 0x15c]
mov ecx, edi
call fcn.1000c770
push 0
push dword [esp + 0x128]
lea eax, [esp + 0x26c]
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x1000caa1
mov eax, 0x200
jmp 0x1000c8d8
mov edx, dword [esi + 0x138]
mov ecx, dword [esi]
call fcn.1000bba0
cmp dword [esi + 0x13c], 0
jne 0x1000caca
push 0x4000
call fcn.100104ba
add esp, 4
mov dword [esi + 0x13c], eax
xor ebx, ebx
nop dword [eax]
mov edx, dword [esi + 0x13c]
lea eax, [esp + 0x17]
mov ecx, dword [esi]
push eax
push 0x4000
call fcn.1000bd30
mov edi, eax
add esp, 8
cmp edi, 0xffffff96
je 0x1000cb49
test edi, edi
js 0x1000cb1a
jle 0x1000cb10
push 0
lea eax, [esp + 0x1c]
push eax
push edi
push dword [esi + 0x13c]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1000cb21
cmp byte [esp + 0x17], bl
jne 0x1000cb28
test edi, edi
jne 0x1000cad0
mov ebx, 0x5000000
jmp 0x1000cb4e
mov ebx, 0x400
jmp 0x1000cb4e
lea eax, [esp + 0x138]
push eax
lea eax, [esp + 0x12c]
push eax
lea eax, [esp + 0x138]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_SetFileTime]
jmp 0x1000cb4e
mov ebx, 0x1000
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esi]
call fcn.1000bfa0
mov eax, ebx
jmp 0x1000c8d8
call fcn.1001039d
int3