Function at 0x100956f
Capabilities:
Check if file exists
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
xor ebx, ebx
test byte [ebp + 0xc], 0x10
push esi
push edi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x34], ebx
je 0x10095ba
test byte [ebp + 0xc], 0x40
push 3
pop eax
je 0x10095b4
xor eax, eax
push eax
call fcn.0100a38e
xor esi, esi
inc esi
test byte [ebp + 0xc], 1
je 0x10095ca
and dword [ebp + 0xc], 0xfffffff7
mov dword [ebp - 0x24], esi
lea eax, [ebp - 0x4c]
push eax
push dword [ebp + 8]
call fcn.01008d7f
test eax, eax
jne 0x10095e7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x1009bb3
lea eax, [ebp - 0x2c]
push eax
push esi
push 4
push 0x100f334
call fcn.0100ad7e
test eax, eax
je 0x10095da
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x2c]
call fcn.0100b07f
test eax, eax
je 0x10095da
push 0x1001710
lea eax, [ebp - 0x4c]
push eax
mov dword [ebp - 0x28], ebx
call fcn.0100a97b
test eax, eax
je 0x1009624
mov dword [ebp - 0x28], esi
push 0x10016ec
lea eax, [ebp - 0x4c]
push eax
mov dword [ebp + 8], ebx
call fcn.0100a97b
test eax, eax
je 0x100963c
mov dword [ebp + 8], esi
push 0x10023b0
lea eax, [ebp - 0x4c]
push eax
call fcn.0100abe6
mov edi, eax
mov dword [ebp - 0x1c], edi
cmp edi, ebx
je 0x10095da
push 0x1002378
lea eax, [ebp - 0x4c]
push eax
call fcn.0100abe6
mov esi, eax
mov dword [ebp - 0x14], esi
cmp esi, ebx
je 0x10095da
test byte [ebp + 0xc], 0x20
je 0x100968b
push 0x1002318
push 3
mov dword [ebp - 0x10], 1
call fcn.0100a40e
pop ecx
pop ecx
jmp 0x1009702
cmp dword [ebp - 0x28], ebx
je 0x10096d8
push 1
push edi
call fcn.0100b4a1
test eax, eax
jne 0x10096b9
mov eax, 0xc1
push eax
push edi
mov esi, eax
push 0x1002298
push 4
call fcn.0100a40e
add esp, 0x10
jmp 0x1009bb3
push 0x1002270
lea eax, [ebp - 0x4c]
push eax
call fcn.0100abe6
mov esi, eax
mov dword [ebp - 8], esi
cmp esi, ebx
je 0x10095da
push 1
jmp 0x10096e4
push ebx
push edi
call fcn.0100b4a1
test eax, eax
je 0x100969c
push ebx
push esi
call fcn.0100b4a1
test eax, eax
jne 0x10096f7
mov dword [ebp - 0x10], 1
jmp 0x1009702
push ebx
push esi
push edi
call fcn.01008cd0
mov dword [ebp - 0x10], eax
push 0x100224c
lea eax, [ebp - 0x4c]
push eax
call fcn.0100abe6
mov dword [ebp - 4], eax
cmp eax, ebx
je 0x10095da
push 0x1002228
lea eax, [ebp - 0x4c]
push eax
call fcn.0100abe6
mov edi, eax
mov dword [ebp - 0x18], edi
cmp edi, ebx
je 0x10095da
push edi
push dword [ebp - 4]
push 0x10021e0
push 2
call fcn.0100a40e
add esp, 0x10
push ebx
push dword [ebp - 0x24]
push dword [ebp + 8]
push dword [ebp + 8]
push dword [ebp - 0x10]
push edi
push dword [ebp - 4]
call fcn.01009015
test eax, eax
jne 0x1009784
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push edi
push dword [ebp - 4]
push 0x1002168
push 4
call fcn.0100a40e
add esp, 0x14
jmp 0x1009bb3
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [ebp - 0x28], ebx
jne 0x10098d0
push 0x1002138
lea eax, [ebp - 0x4c]
push eax
call fcn.0100abe6
mov dword [ebp - 0xc], eax
push 0x10020f0
lea eax, [ebp - 0x4c]
push eax
call fcn.0100abe6
mov edi, eax
cmp dword [ebp - 0xc], ebx
je 0x1009820
cmp edi, ebx
je 0x1009820
push edi
call fcn.010089dd
push 2
push edi
mov ebx, eax
call fcn.0100a5bf
push 1
push edi
push dword [ebp - 0x1c]
mov dword [ebp - 0x40], eax
call fcn.01008cd0
test ebx, ebx
je 0x10097e9
cmp dword [ebp - 0x40], 1
jne 0x100982e
test eax, eax
je 0x100982e
push dword [ebp - 0xc]
call fcn.0100c346
test eax, eax
jne 0x1009809
call esi
push eax
push 0x1002068
push 3
call fcn.0100a40e
add esp, 0xc
jmp 0x100982e
push edi
push dword [ebp - 0x1c]
call fcn.0100895b
test eax, eax
jne 0x100982e
call esi
push eax
push 0x1001fd0
jmp 0x10097fd
push 0x1001f68
push 3
call fcn.0100a40e
pop ecx
pop ecx
cmp dword [ebp - 0xc], 0
je 0x1009846
push dword [ebp - 0xc]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test edi, edi
je 0x100985a
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push dword [ebp - 4]
xor ebx, ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test eax, eax
je 0x1009874
mov dword [ebp - 4], ebx
push 0x1001f2c
lea eax, [ebp - 0x4c]
push eax
call fcn.0100abe6
test byte [ebp + 0xc], 0x80
push 0
pop ecx
setne cl
push ebx
push 6
mov dword [ebp - 0xc], eax
inc ecx
mov edi, ecx
push edi
push ebx
push ebx
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x40], eax
cmp eax, 0xffffffff
jne 0x10099af
call esi
cmp eax, 0x50
jne 0x10098c0
cmp edi, 2
jne 0x1009a6b
call esi
push eax
push dword [ebp - 0xc]
push 0x1001eb8
jmp 0x1009a61
cmp dword [ebp - 0x24], ebx
jne 0x100985a
mov edi, 0x1001858
cmp dword [ebp + 8], ebx
je 0x1009919
cmp dword [ebp - 8], ebx
jne 0x10098fd
push 0x1002270
lea eax, [ebp - 0x4c]
push eax
call fcn.0100abe6
mov dword [ebp - 8], eax
cmp eax, ebx
je 0x10095da
push edi
push ebx
push dword [ebp - 8]
call fcn.0100b2d0
test eax, eax
jne 0x1009919
call esi
cmp eax, 2
je 0x1009919
call esi
jmp 0x10095e0
cmp dword [ebp - 0x10], ebx
je 0x100992d
push dword [ebp - 8]
push dword [ebp - 0x1c]
call fcn.0100895b
test eax, eax
je 0x1009912
push dword [ebp - 8]
call fcn.0100bb70
test eax, eax
jne 0x1009954
call esi
mov esi, eax
push esi
push dword [ebp - 8]
call fcn.0100a1af
push esi
push dword [ebp - 8]
push 0x1001e48
jmp 0x10096aa
push 7
push dword [ebp - 8]
call fcn.01008b27
test eax, eax
je 0x1009912
cmp dword [ebp + 8], ebx
je 0x1009984
push edi
push 1
push dword [ebp - 8]
call fcn.0100b2d0
test eax, eax
je 0x1009912
push edi
push ebx
push dword [ebp - 0x14]
call fcn.0100b2d0
test eax, eax
je 0x1009912
push dword [ebp - 0x14]
call fcn.0100bc59
test eax, eax
jne 0x100985a
call esi
mov esi, eax
push esi
push dword [ebp - 0x14]
call fcn.0100a1af
push esi
push dword [ebp - 0x14]
push 0x1001de0
jmp 0x10096aa
mov edi, 0x10000
push edi
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
test ebx, ebx
jne 0x10099de
push dword [ebp - 0xc]
push 0x1001d58
push 3
call fcn.0100a40e
add esp, 0xc
jmp 0x1009a41
push edi
push 0
push ebx
call sub.msvcrt.dll_memset
add esp, 0xc
push 0
lea eax, [ebp - 0x3c]
push eax
push edi
push ebx
push dword [ebp - 0x40]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1009a16
call esi
push eax
push dword [ebp - 0xc]
push 0x1001eb8
push 3
call fcn.0100a40e
add esp, 0x10
jmp 0x1009a31
cmp dword [ebp - 0x3c], edi
je 0x1009a31
push edi
push dword [ebp - 0x3c]
push dword [ebp - 0xc]
push 0x1001cc0
push 3
call fcn.0100a40e
add esp, 0x14
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push dword [ebp - 0x40]
call dword [sym.imp.ntdll.dll_NtClose]
push dword [ebp - 0xc]
call fcn.0100bb70
test eax, eax
jne 0x1009a6b
call esi
push eax
push dword [ebp - 0xc]
push 0x1001c40
push 3
call fcn.0100a40e
add esp, 0x10
xor edi, edi
mov ebx, 0x1001960
cmp dword [ebp - 0x28], edi
je 0x1009b04
cmp dword [ebp - 0x24], edi
jne 0x1009aed
push 0x1001c14
lea eax, [ebp - 0x4c]
push eax
call fcn.0100abe6
mov dword [ebp - 0x30], eax
push 0x1001be0
lea eax, [ebp - 0x4c]
push eax
call fcn.0100abe6
push 6
push dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
call fcn.01008b27
test eax, eax
jne 0x1009abb
call esi
cmp eax, 2
jne 0x1009912
push 6
push dword [ebp - 0x34]
call fcn.01008b27
test eax, eax
jne 0x1009ad4
call esi
cmp eax, 2
jne 0x1009912
push 6
push dword [ebp - 0xc]
call fcn.01008b27
test eax, eax
jne 0x1009aed
call esi
cmp eax, 2
jne 0x1009912
cmp dword [ebp + 8], edi
je 0x1009b04
push ebx
push edi
push dword [ebp - 0x18]
call fcn.0100b2d0
test eax, eax
je 0x1009912
test byte [ebp + 0xc], 8
je 0x1009b7f
push 0x1001bbc
lea eax, [ebp - 0x4c]
push eax
call fcn.0100abe6
mov dword [ebp - 4], eax
cmp eax, edi
je 0x1009912
push 0x1001b88
lea eax, [ebp - 0x4c]
push eax
call fcn.0100abe6
mov edi, eax
mov dword [ebp - 0x38], edi
test edi, edi
je 0x1009912
push edi
push dword [ebp - 4]
push 0x1001b40
push 2
call fcn.0100a40e
add esp, 0x10
push 0
push dword [ebp - 0x24]
push dword [ebp + 8]
push dword [ebp + 8]
push dword [ebp - 0x10]
push edi
push dword [ebp - 4]
call fcn.01009015
test eax, eax
jne 0x1009b7f
call esi
mov esi, eax
push esi
push edi
push dword [ebp - 4]
push 0x1001ad0
jmp 0x1009775
cmp dword [ebp - 0x28], 0
je 0x1009bb0
push 6
push dword [ebp - 0x18]
call fcn.01008b27
test eax, eax
je 0x1009912
cmp dword [ebp + 8], 0
je 0x1009bb0
push ebx
push 1
push dword [ebp - 0x18]
call fcn.0100b2d0
test eax, eax
je 0x1009912
mov esi, dword [ebp - 0x44]
call fcn.0100a3e8
xor edi, edi
cmp dword [ebp - 0x20], edi
je 0x1009bc8
push edi
push dword [ebp - 0x20]
call fcn.0100b07f
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
cmp dword [ebp - 4], edi
je 0x1009be5
push dword [ebp - 4]
push 0
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_HeapFree]
push eax
call edi
jmp 0x1009beb
mov edi, dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [ebp - 0x38], 0
je 0x1009bfb
push dword [ebp - 0x38]
push 0
call ebx
push eax
call edi
cmp dword [ebp - 0x18], 0
je 0x1009c0b
push dword [ebp - 0x18]
push 0
call ebx
push eax
call edi
cmp dword [ebp - 0x1c], 0
je 0x1009c1b
push dword [ebp - 0x1c]
push 0
call ebx
push eax
call edi
cmp dword [ebp - 0x14], 0
je 0x1009c2b
push dword [ebp - 0x14]
push 0
call ebx
push eax
call edi
cmp dword [ebp - 8], 0
je 0x1009c3b
push dword [ebp - 8]
push 0
call ebx
push eax
call edi
cmp dword [ebp - 0x30], 0
je 0x1009c4b
push dword [ebp - 0x30]
push 0
call ebx
push eax
call edi
cmp dword [ebp - 0x34], 0
je 0x1009c5b
push dword [ebp - 0x34]
push 0
call ebx
push eax
call edi
cmp dword [ebp - 0xc], 0
je 0x1009c6b
push dword [ebp - 0xc]
push 0
call ebx
push eax
call edi
cmp dword [ebp - 0x20], 0
je 0x1009c83
push dword [ebp - 0x20]
push 0
call ebx
push eax
call edi
test eax, eax
je 0x1009c83
and dword [ebp - 0x20], 0
cmp dword [ebp - 0x2c], 0
je 0x1009c9b
push dword [ebp - 0x2c]
push 0
call ebx
push eax
call edi
test eax, eax
je 0x1009c9b
and dword [ebp - 0x2c], 0
test esi, esi
je 0x1009caa
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x1009cad
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 8