Function at 0x1001326c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 8], edi
mov dword [ebp - 4], esi
mov dword [ebp - 0xc], ebx
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 0x14]
mov ebx, dword [ebp + 0x18]
lea eax, [ebp - 0x10]
push 0x19
push dword [ebp + 8]
push eax
push edi
call fcn.10026824
add esp, 0x10
test eax, eax
je 0x100132c5
movzx edx, byte [ebp + 0x10]
test dl, 1
je 0x100132b3
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
movzx eax, ax
mov esp, ebp
pop ebp
ret
push 0x100b600c
push 0xfffffffffffffffb
push 2
push eax
call fcn.100149ac
add esp, 0x10
mov ecx, dword [ebp - 0x10]
movzx eax, byte [ebp + 0x10]
movzx edx, byte [ecx + 0x12b]
and edx, 0xffffffbf
and eax, 1
shl eax, 6
or edx, eax
mov byte [ecx + 0x12b], dl
mov edx, dword [ebp - 0x10]
movzx eax, byte [edx + 0x129]
test al, 0x40
je 0x100133a3
mov ecx, dword [edx + 0x18]
test ecx, ecx
je 0x10013778
movzx eax, byte [ecx + 0x3c]
test al, 2
je 0x10013341
mov eax, 0x2f
mov dword [ecx + 0x30], eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x18]
mov dword [edx + 0x34], eax
mov ebx, dword [ebp - 0x10]
mov eax, dword [ebx + 0x64]
test eax, eax
je 0x1001332f
xor edx, edx
mov dword [eax + 4], edx
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x64], edx
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
mov eax, 0x2f
mov esp, ebp
pop ebp
ret
movzx ebx, byte [edx + 0x12b]
movzx esi, byte [edx + 0x12c]
mov ecx, ebx
and ecx, 0x40
mov edi, 2
xor eax, eax
test ecx, ecx
setne al
test ebx, 0x80
jne 0x1001336d
mov edi, 0
test esi, 1
mov ecx, 4
jne 0x1001337f
mov ecx, 0
or eax, edi
or eax, ecx
mov ecx, 0x2f
push ecx
push ecx
push eax
push 0xffffffffffffffff
push edx
call fcn.10077ea0
add esp, 0x14
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
movzx eax, byte [ebp + 0x10]
test al, 0x10
je 0x100136bb
movzx ecx, byte [edx + 0x12b]
test cl, 2
jne 0x100133c4
test cl, 4
je 0x10013467
mov ebx, dword [edx + 0x18]
test ebx, ebx
je 0x10013797
movzx eax, byte [ebx + 0x3c]
test al, 2
je 0x1001340f
mov eax, 0x37
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x10]
mov edx, dword [ebx + 0x18]
mov dword [edx + 0x34], eax
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx + 0x64]
test eax, eax
je 0x100133fd
xor edx, edx
mov dword [eax + 4], edx
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x64], edx
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
mov eax, 0x37
mov esp, ebp
pop ebp
ret
mov ebx, ecx
and ebx, 0x40
mov esi, 2
mov edi, 4
xor eax, eax
test ebx, ebx
setne al
test ecx, 0x80
movzx ecx, byte [edx + 0x12c]
jne 0x10013439
mov esi, 0
test cl, 1
mov ecx, 0x37
push ecx
push ecx
jne 0x1001344a
mov edi, 0
or eax, esi
or eax, edi
push eax
push 0xffffffffffffffff
push edx
call fcn.10077ea0
add esp, 0x14
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
mov ecx, dword [edx + 0xb4]
mov dword [ebp - 0x18], ebx
mov eax, esi
mov dword [ebp - 0x14], ecx
add eax, 0xffffffff
adc ebx, 0xffffffff
push ebx
xor ecx, ecx
mov ebx, dword [ebp - 0x18]
push eax
push ecx
push dword [edx + 0xc0]
call fcn.10090380
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], edx
xor ecx, ecx
lea edx, [ebp - 0x18]
push ecx
push edx
push eax
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [ebp - 0x1c], eax
cmp eax, 0xffffffff
jne 0x100134c3
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x100134c3
mov eax, 0xffffffff
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
add edx, 1
add eax, 1
or edx, eax
je 0x100138ae
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x90], esi
mov dword [eax + 0x94], ebx
mov edx, dword [ebp - 0x10]
and byte [edx + 0x12e], 0x7f
mov eax, dword [ebp - 0x10]
movzx ecx, byte [eax + 0x12a]
test cl, 0x40
je 0x10013511
push dword [eax + 0xc0]
push 0x20
push dword [eax + 0x38]
call fcn.1007f474
jmp 0x10013521
push dword [eax + 0xc0]
push 0
push dword [eax + 0x38]
call fcn.1007f474
add esp, 0xc
mov edx, dword [ebp - 0x10]
movzx eax, byte [edx + 0x128]
test al, 1
je 0x1001353b
mov eax, dword [edx + 0x38]
mov byte [eax], 0x40
mov edx, dword [ebp - 0x10]
push dword [edx + 0xc0]
push dword [edx + 0x38]
push edx
call fcn.1002ccf0
add esp, 0xc
cmp eax, 0xffffffff
je 0x100137d0
mov eax, dword [ebp - 0x10]
add dword [eax + 0x90], 1
adc dword [eax + 0x94], 0
mov edx, dword [ebp - 0x10]
and byte [edx + 0x12e], 0x7f
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx + 0x54]
test eax, eax
je 0x100135d4
movsx edx, byte [ecx + 0x11f]
add edx, 0xfffffffb
cmp edx, 0xc
ja case.default.0x10013595
mov edx, dword [edx*4 + 0x100b6a58]
jmp edx
mov edx, dword [ecx + 0x90]
mov ecx, dword [ecx + 0x94]
mov dword [eax], edx
mov dword [eax + 4], ecx
mov ecx, dword [ebp - 0x10]
jmp 0x100135d4
mov edx, dword [ecx + 0x90]
mov dword [eax], edx
mov ecx, dword [ebp - 0x10]
jmp 0x100135d4
mov edx, dword [ecx + 0x90]
mov word [eax], dx
mov ecx, dword [ebp - 0x10]
jmp 0x100135d4
movzx edx, byte [ecx + 0x90]
mov byte [eax], dl
mov ecx, dword [ebp - 0x10]
and byte [ecx + 0x12b], 0x3f
push edi
and byte [ecx + 0x12c], 0xf7
and byte [ecx + 0x12e], 0xfe
call fcn.100260c0
pop ecx
test eax, eax
je 0x1001369a
mov edx, dword [ebp - 0x10]
mov ebx, dword [edx + 0x18]
test ebx, ebx
je 0x100137b6
movzx ecx, byte [ebx + 0x3c]
test cl, 2
je 0x1001363d
mov dword [ebx + 0x30], eax
mov edx, dword [ebp - 0x10]
mov ecx, dword [edx + 0x18]
mov dword [ecx + 0x34], eax
mov ebx, dword [ebp - 0x10]
mov edx, dword [ebx + 0x64]
test edx, edx
je 0x10013630
xor ecx, ecx
mov dword [edx + 4], ecx
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x64], ecx
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
push eax
push eax
movzx esi, byte [edx + 0x12b]
movzx edi, byte [edx + 0x12c]
mov ebx, esi
and ebx, 0x40
xor ecx, ecx
test ebx, ebx
setne cl
test esi, 0x80
mov ebx, 2
jne 0x1001366b
mov ebx, 0
test edi, 1
mov esi, 4
jne 0x1001367d
mov esi, 0
or ecx, ebx
or ecx, esi
push ecx
push 0xffffffffffffffff
push edx
call fcn.10077ea0
add esp, 0x14
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
xor eax, eax
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
mov eax, 0x30
mov esp, ebp
pop ebp
ret
movsx eax, byte [edx + 0x11d]
cmp eax, 2
je 0x100139ab
mov ecx, dword [edx + 0x18]
test ecx, ecx
je 0x1001398c
movzx eax, byte [ecx + 0x3c]
test al, 2
je 0x10013716
mov eax, 0x37
mov dword [ecx + 0x30], eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x18]
mov dword [edx + 0x34], eax
mov ebx, dword [ebp - 0x10]
mov eax, dword [ebx + 0x64]
test eax, eax
je 0x10013704
xor edx, edx
mov dword [eax + 4], edx
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x64], edx
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
mov eax, 0x37
mov esp, ebp
pop ebp
ret
movzx ebx, byte [edx + 0x12b]
movzx esi, byte [edx + 0x12c]
mov ecx, ebx
and ecx, 0x40
mov edi, 2
xor eax, eax
test ecx, ecx
setne al
test ebx, 0x80
jne 0x10013742
mov edi, 0
test esi, 1
mov ecx, 4
jne 0x10013754
mov ecx, 0
or eax, edi
or eax, ecx
mov ecx, 0x37
push ecx
push ecx
push eax
push 0xffffffffffffffff
push edx
call fcn.10077ea0
add esp, 0x14
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
push edx
mov eax, 0x2f
push eax
push eax
push 1
call fcn.10014254
add esp, 0x10
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
push edx
mov eax, 0x37
push eax
push eax
push 1
call fcn.10014254
add esp, 0x10
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
push edx
push eax
push eax
push 0
call fcn.10014254
add esp, 0x10
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [ebp - 0x10]
mov dword [edx + 0xb8], eax
mov edx, dword [ebp - 0x10]
mov ecx, dword [edx + 0x18]
test ecx, ecx
je 0x1001388f
movzx eax, byte [ecx + 0x3c]
test al, 2
je 0x1001382d
mov eax, 0x37
mov dword [ecx + 0x30], eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x18]
mov dword [edx + 0x34], eax
mov ebx, dword [ebp - 0x10]
mov eax, dword [ebx + 0x64]
test eax, eax
je 0x1001381b
xor edx, edx
mov dword [eax + 4], edx
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x64], edx
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
mov eax, 0x37
mov esp, ebp
pop ebp
ret
movzx ebx, byte [edx + 0x12b]
movzx esi, byte [edx + 0x12c]
mov ecx, ebx
and ecx, 0x40
mov edi, 2
xor eax, eax
test ecx, ecx
setne al
test ebx, 0x80
jne 0x10013859
mov edi, 0
test esi, 1
mov ecx, 4
jne 0x1001386b
mov ecx, 0
or eax, edi
or eax, ecx
mov ecx, 0x37
push ecx
push ecx
push eax
push 0xffffffffffffffff
push edx
call fcn.10077ea0
add esp, 0x14
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
push edx
mov eax, 0x37
push eax
push eax
push 1
call fcn.10014254
add esp, 0x10
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [ebp - 0x10]
mov dword [edx + 0xb8], eax
mov edx, dword [ebp - 0x10]
mov ecx, dword [edx + 0x18]
test ecx, ecx
je 0x1001396d
movzx eax, byte [ecx + 0x3c]
test al, 2
je 0x1001390b
mov eax, 0x37
mov dword [ecx + 0x30], eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x18]
mov dword [edx + 0x34], eax
mov ebx, dword [ebp - 0x10]
mov eax, dword [ebx + 0x64]
test eax, eax
je 0x100138f9
xor edx, edx
mov dword [eax + 4], edx
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x64], edx
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
mov eax, 0x37
mov esp, ebp
pop ebp
ret
movzx ebx, byte [edx + 0x12b]
movzx esi, byte [edx + 0x12c]
mov ecx, ebx
and ecx, 0x40
mov edi, 2
xor eax, eax
test ecx, ecx
setne al
test ebx, 0x80
jne 0x10013937
mov edi, 0
test esi, 1
mov ecx, 4
jne 0x10013949
mov ecx, 0
or eax, edi
or eax, ecx
mov ecx, 0x37
push ecx
push ecx
push eax
push 0xffffffffffffffff
push edx
call fcn.10077ea0
add esp, 0x14
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
push edx
mov eax, 0x37
push eax
push eax
push 1
call fcn.10014254
add esp, 0x10
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
push edx
mov eax, 0x37
push eax
push eax
push 1
call fcn.10014254
add esp, 0x10
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
movzx eax, byte [edx + 0x12b]
mov dword [ebp - 0x14], eax
test al, 4
jne 0x10013a66
mov ecx, dword [edx + 0x18]
test ecx, ecx
je 0x10013cae
movzx eax, byte [ecx + 0x3c]
test al, 2
je 0x10013a08
mov eax, 0x1a
mov dword [ecx + 0x30], eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x18]
mov dword [edx + 0x34], eax
mov ebx, dword [ebp - 0x10]
mov eax, dword [ebx + 0x64]
test eax, eax
je 0x100139f6
xor edx, edx
mov dword [eax + 4], edx
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x64], edx
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
mov eax, 0x1a
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebp - 0x14]
movzx esi, byte [edx + 0x12c]
mov ecx, ebx
and ecx, 0x40
mov edi, 2
xor eax, eax
test ecx, ecx
setne al
test ebx, 0x80
jne 0x10013a30
mov edi, 0
test esi, 1
mov ecx, 4
jne 0x10013a42
mov ecx, 0
or eax, edi
or eax, ecx
mov ecx, 0x1a
push ecx
push ecx
push eax
push 0xffffffffffffffff
push edx
call fcn.10077ea0
add esp, 0x14
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
mov eax, esi
sub eax, 1
mov ecx, ebx
sbb ecx, 0
jl 0x10013aa1
mov eax, dword [edx + 0xa8]
test eax, eax
je 0x10013b4a
mov dword [ebp - 0x1c], edx
cdq
mov ecx, esi
sub ecx, eax
mov eax, ebx
sbb eax, edx
mov edx, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
jl 0x10013b4a
or ecx, dword [ebp - 0x20]
je 0x10013b4a
mov ecx, dword [edx + 0x18]
test ecx, ecx
je 0x10013ccd
movzx eax, byte [ecx + 0x3c]
test al, 2
je 0x10013aec
mov eax, 0x19
mov dword [ecx + 0x30], eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x18]
mov dword [edx + 0x34], eax
mov ebx, dword [ebp - 0x10]
mov eax, dword [ebx + 0x64]
test eax, eax
je 0x10013ada
xor edx, edx
mov dword [eax + 4], edx
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x64], edx
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
mov eax, 0x19
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebp - 0x14]
movzx esi, byte [edx + 0x12c]
mov ecx, ebx
and ecx, 0x40
mov edi, 2
xor eax, eax
test ecx, ecx
setne al
test ebx, 0x80
jne 0x10013b14
mov edi, 0
test esi, 1
mov ecx, 4
jne 0x10013b26
mov ecx, 0
or eax, edi
or eax, ecx
mov ecx, 0x19
push ecx
push ecx
push eax
push 0xffffffffffffffff
push edx
call fcn.10077ea0
add esp, 0x14
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
movzx eax, byte [edx + 0x12d]
test al, 1
je 0x10013467
mov ecx, dword [edx + 0x40]
mov dword [ebp - 0x18], ebx
mov ebx, dword [edx + 0x38]
mov dword [ebp - 0x1c], edx
lea eax, [ebp - 0x20]
push 0
sub ecx, ebx
push eax
push ecx
push ebx
push dword [edx + 0xb4]
mov ebx, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [ebp - 0x1c]
mov dword [ebp - 0x14], eax
test eax, eax
je 0x10013ca1
mov eax, dword [edx + 0x38]
and byte [edx + 0x12d], 0xfe
mov dword [edx + 0x40], eax
xor ecx, ecx
add eax, dword [edx + 0xc0]
mov dword [edx + 0x44], eax
mov eax, dword [ebp - 0x14]
mov dword [edx + 0xa0], ecx
mov dword [edx + 0xa4], ecx
cmp eax, 0xffffffff
je 0x10013bc0
mov edx, dword [ebp - 0x10]
jmp 0x10013467
mov dword [ebp - 0x1c], edx
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [ebp - 0x1c]
mov dword [edx + 0xb8], eax
mov edx, dword [ebp - 0x10]
mov ecx, dword [edx + 0x18]
test ecx, ecx
je 0x10013c82
movzx eax, byte [ecx + 0x3c]
test al, 2
je 0x10013c20
mov eax, 0x26
mov dword [ecx + 0x30], eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x18]
mov dword [edx + 0x34], eax
mov ebx, dword [ebp - 0x10]
mov eax, dword [ebx + 0x64]
test eax, eax
je 0x10013c0e
xor edx, edx
mov dword [eax + 4], edx
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x64], edx
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
mov eax, 0x26
mov esp, ebp
pop ebp
ret
movzx ebx, byte [edx + 0x12b]
movzx esi, byte [edx + 0x12c]
mov ecx, ebx
and ecx, 0x40
mov edi, 2
xor eax, eax
test ecx, ecx
setne al
test ebx, 0x80
jne 0x10013c4c
mov edi, 0
test esi, 1
mov ecx, 4
jne 0x10013c5e
mov ecx, 0
or eax, edi
or eax, ecx
mov ecx, 0x26
push ecx
push ecx
push eax
push 0xffffffffffffffff
push edx
call fcn.10077ea0
add esp, 0x14
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
push edx
mov eax, 0x26
push eax
push eax
push 1
call fcn.10014254
add esp, 0x10
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
mov eax, 0xffffffff
mov dword [ebp - 0x14], eax
jmp 0x10013b8c
push edx
mov eax, 0x1a
push eax
push eax
push 1
call fcn.10014254
add esp, 0x10
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
push edx
mov eax, 0x19
push eax
push eax
push 1
call fcn.10014254
add esp, 0x10
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
mov esp, ebp
pop ebp
ret