Function at 0x1000b520
Capabilities:
Write file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x90
mov eax, dword [0x10025040]
xor eax, esp
mov dword [esp + 0x8c], eax
cmp dword [ecx + 0x10], 0
sete byte [esp + 3]
mov dword [esp + 0x68], ecx
lea eax, [ecx + 0x14]
mov dword [esp + 0x60], eax
mov dword [esp + 0x64], edx
lea eax, [edx + 4]
mov dword [esp + 0x5c], eax
mov ebp, 0x71a955ff
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileA]
lea ebx, [esp + 0x74]
jmp 0x1000b570
mov edi, ebx
mov ebx, esi
mov esi, dword [esp + 4]
cmp ebp, 0x66be679
jg 0x1000b5f0
cmp ebp, 0xcecb5960
jg 0x1000b650
cmp ebp, 0xb1988ad0
jg 0x1000b6ee
cmp ebp, 0xa7c1c6c7
je 0x1000b7c5
cmp ebp, 0xaac2c905
jne 0x1000b570
mov eax, dword [esp + 0x14]
mov dword [esp + 0x38], eax
lea eax, [esp + 0x70]
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x70], 0
mov eax, dword [esp + 0x24]
mov eax, dword [eax]
mov dword [esp + 0x40], eax
mov eax, dword [esp + 0x28]
mov eax, dword [eax]
mov dword [esp + 0x44], eax
mov ecx, dword [esp + 0x40]
mov ebp, 0x66be67a
cmp ecx, dword [esp + 0x44]
je 0x1000b570
mov ebp, 0x1a1fd00d
jmp 0x1000b570
cmp ebp, 0x1a1fd00c
jg 0x1000b6b0
cmp ebp, 0x12cf36e0
jg 0x1000b758
cmp ebp, 0x66be67a
je 0x1000b813
cmp ebp, 0x1091673a
jne 0x1000b570
mov eax, dword [esp + 0xc]
mov ecx, eax
and ecx, 0xffffffdb
add ecx, eax
or eax, 0x24
sub ecx, eax
add ecx, 0x48
mov dword [esp + 0x1c], ecx
mov eax, dword [esp + 0x58]
mov dword [esp + 0x18], eax
mov ebp, 0x16d9ca09
jmp 0x1000b570
cmp ebp, 0xd97ce347
jg 0x1000b77e
cmp ebp, 0xcecb5961
je 0x1000b82b
cmp ebp, 0xcfdd97f6
jne 0x1000b570
mov eax, dword [esp + 8]
mov esi, dword [esp + 0x50]
add esi, 0x18
mov ebp, 0x66be67a
cmp esi, dword [esp + 0x44]
mov ecx, dword [esp + 0x54]
mov ecx, dword [esp + 0x54]
mov dword [esp + 0x20], ecx
je 0x1000b570
mov ebp, 0xdd0b967f
jmp 0x1000b570
cmp ebp, 0x1a1fd00d
je 0x1000b85c
cmp ebp, 0x548ca325
je 0x1000b890
cmp ebp, 0x71a955ff
jne 0x1000b570
cmp byte [esp + 3], 0
mov ebp, 0x12cf36e1
jne 0x1000b570
mov ebp, 0xcecb5961
jmp 0x1000b570
cmp ebp, 0xb1988ad1
je 0x1000b8aa
cmp ebp, 0xcd84d9de
jne 0x1000b570
mov eax, dword [esp + 0x4c]
mov eax, dword [eax]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0xc]
mov ecx, eax
not ecx
and ecx, 1
sub ecx, eax
mov edx, eax
or edx, 1
add edx, ecx
lea ecx, [eax + eax]
or ecx, 0xfffffffc
add ecx, edx
add ecx, eax
add ecx, 3
mov eax, dword [esp + 0x10]
mov dword [esp + 0x18], eax
mov ebp, 0xa7c1c6c7
mov dword [esp + 0x1c], ecx
cmp ecx, 0x1000
jae 0x1000b570
mov ebp, 0x16d9ca09
jmp 0x1000b570
cmp ebp, 0x16d9ca09
jne 0x1000b9be
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call fcn.10012fd2
add esp, 8
mov ebp, 0xcfdd97f6
jmp 0x1000b570
cmp ebp, 0xdd0b967f
jne 0x1000b9cc
mov dword [esp + 4], esi
mov dword [esp + 0x50], esi
mov eax, dword [esp + 8]
mov edx, dword [esp + 0x50]
mov esi, ebx
mov ecx, ebx
call fcn.10011b30
mov eax, dword [esp + 0x6c]
mov eax, dword [eax]
mov ecx, dword [esp + 0x48]
cmp dword [ecx], 0x10
mov ecx, dword [esp + 0x4c]
mov ebx, edi
jae 0x1000b8d8
mov ecx, dword [esp + 8]
jmp 0x1000b8da
mov dword [esp + 4], esi
mov esi, ebx
mov ebx, edi
mov eax, dword [esp + 0x10]
mov eax, dword [eax - 4]
mov dword [esp + 0x58], eax
mov eax, dword [esp + 0x10]
mov edx, eax
and edx, 0xfffffffc
mov ecx, eax
and ecx, 3
lea ebp, [ecx + eax]
sub ebp, edx
or eax, 3
add eax, ebp
not ecx
add ecx, eax
sub ecx, dword [esp + 0x58]
add ecx, 0xfffffffa
mov ebp, 0x1091673a
cmp ecx, 0x20
jb 0x1000b568
mov ebp, 0xd97ce348
jmp 0x1000b568
push dword [esp + 0x38]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x3c]
mov ebp, 0x12cf36e1
jmp 0x1000b570
mov eax, dword [esp + 0x64]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x24]
mov ecx, dword [eax]
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x28], eax
mov edx, dword [esp + 0x28]
mov ebp, 0x12cf36e1
cmp ecx, dword [edx]
je 0x1000b570
mov ebp, 0xb1988ad1
jmp 0x1000b570
mov dword [esp + 8], ebx
lea eax, [esp + 0x84]
mov dword [esp + 0x6c], eax
lea eax, [esp + 0x88]
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x20], 0
mov ebp, 0xdd0b967f
mov esi, dword [esp + 0x40]
jmp 0x1000b570
mov eax, dword [esp + 0x30]
cmp dword [eax], 0x10
mov eax, dword [esp + 0x34]
jae 0x1000b93a
mov eax, dword [esp + 0x2c]
jmp 0x1000b93c
mov ecx, dword [esp + 0x68]
mov dword [esp + 0x2c], ecx
mov eax, dword [esp + 0x60]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x30]
cmp dword [eax], 0x10
mov dword [esp + 0x34], ecx
mov eax, dword [esp + 0x34]
jae 0x1000b97c
mov eax, dword [esp + 0x2c]
jmp 0x1000b97e
mov ecx, dword [ecx]
push 0
lea edx, [esp + 0x74]
push edx
push eax
push ecx
push dword [esp + 0x48]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 0x70]
mov ebp, dword [esp + 0x20]
lea ecx, [eax + ebp]
mov edx, eax
or edx, ebp
add edx, edx
sub ecx, edx
lea ecx, [ecx + ebp*2]
lea ecx, [ecx + eax*2]
and eax, ebp
not eax
lea eax, [ecx + eax*2]
add eax, 2
mov dword [esp + 0x54], eax
mov eax, dword [esp + 0x48]
mov eax, dword [eax]
mov dword [esp + 0xc], eax
mov ecx, dword [esp + 0xc]
mov ebp, 0xcd84d9de
cmp ecx, 0x10
jae 0x1000b568
mov ebp, 0xcfdd97f6
jmp 0x1000b568
mov eax, dword [eax]
sub esp, 0x1c
movaps xmm0, xmmword [0x10021950]
movups xmmword [esp + 4], xmm0
mov dword [esp], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x80
call edi
mov ebp, 0x12cf36e1
mov dword [esp + 0x14], eax
cmp eax, 0xffffffff
je 0x1000b570
mov ebp, 0xaac2c905
jmp 0x1000b570
mov eax, dword [eax]
sub esp, 0x1c
movaps xmm0, xmmword [0x10021960]
movups xmmword [esp + 4], xmm0
mov dword [esp], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x80
call edi
mov ebp, 0x548ca325
mov dword [esp + 0x14], eax
cmp eax, 0xffffffff
je 0x1000b570
mov ebp, 0xaac2c905
jmp 0x1000b570
cmp ebp, 0x12cf36e1
jne 0x1000b570
jmp 0x1000b9dd
cmp ebp, 0xd97ce348
jne 0x1000b570
call fcn.10014f8d
mov ecx, dword [esp + 0x8c]
xor ecx, esp
call fcn.100134da
add esp, 0x90
pop esi
pop edi
pop ebx
pop ebp
ret