Function at 0x1054cef
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xf4
or dword [ebp - 0x1c], 0xffffffff
push ebx
push esi
xor ebx, ebx
push edi
push 0x1021768
push 0x5e
lea ecx, [ebp - 0x44]
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0xc], 0x100000
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x14], ebx
xor edi, edi
call sub.vdsutil.dll_public:_void___thiscall_CVdsCallTracer::constructor_unsigned_long_int__char_const__
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x44]
lea edx, [ebp - 0x10]
push edx
mov dword [ebp - 8], eax
mov eax, dword [eax + 0x24]
mov ecx, dword [eax]
push 0x1001b60
push eax
call dword [ecx]
mov esi, eax
cmp esi, ebx
jge 0x1054d72
push esi
push 0x1021720
push ebx
push 0x5e
call sub.vdsutil.dll_void___cdecl_VdsTraceEx_unsigned_long_int__unsigned_long_int__char__
mov ecx, dword [ebp - 8]
add esp, 0x10
push esi
call fcn.01046504
jmp 0x10551c3
mov eax, dword [ebp + 0xc]
cmp dword [eax + 0x4c], ebx
je 0x1054d85
call dword [sym.imp.API_MS_Win_Core_ProcessThreads_L1_1_0.dll_GetCurrentThreadId]
mov dword [0x106b694], eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
lea edx, [ebp - 0xf4]
push edx
lea edx, [ebp - 4]
push edx
push eax
call dword [ecx + 0x10]
mov esi, eax
cmp esi, ebx
mov dword [ebp - 0x24], esi
jl 0x1055190
cmp dword [ebp - 4], ebx
jl 0x1055190
mov esi, dword [ebp + 0xc]
cmp dword [esi + 0x48], 1
jne 0x1054dcb
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x38], ebx
mov dword [ecx + 0x3c], 0x64
push ebx
jmp 0x10551b1
cmp dword [esi + 0x4c], ebx
je 0x1054e9d
call sub.vdsutil.dll_void___stdcall_GarbageCollectDriveLetters_void_
lea eax, [esi + 0x18]
push eax
call sub.vdsutil.dll_long_int___stdcall_DeleteBcdObjects_struct__VDS_PARTITION_IDENTITY__
cmp eax, ebx
jge 0x1054df8
push eax
push 0x10216ec
push 1
push 0x5e
call sub.vdsutil.dll_void___cdecl_VdsTraceEx_unsigned_long_int__unsigned_long_int__char__
add esp, 0x10
mov eax, dword [ebp + 0xc]
push ebx
push ebx
add esi, 4
push esi
push dword [eax + 0x40]
call fcn.0103ee89
test eax, eax
je 0x1054e2a
mov ecx, dword [ebp - 8]
push 0x8000ffff
call fcn.01046504
push esi
push 9
call fcn.01033927
mov dword [ebp - 0x14], ebx
jmp 0x10551b6
call fcn.0102cd35
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x68]
cmp eax, ebx
je 0x1054e43
mov edi, eax
mov eax, dword [edi]
push edi
call dword [eax + 4]
jmp 0x1054e54
push 0x10216b4
push 1
push 0x5e
call sub.vdsutil.dll_void___cdecl_VdsTraceEx_unsigned_long_int__unsigned_long_int__char__
add esp, 0xc
call fcn.0102cd46
cmp edi, ebx
je 0x1054e9d
push ebx
push ebx
push edi
push esi
call fcn.0103adf7
mov dword [ebp - 0x24], eax
mov eax, dword [edi]
push edi
call dword [eax + 8]
cmp dword [ebp - 0x24], ebx
jge 0x1054e9d
push dword [ebp - 0x24]
push 0x1021688
push ebx
push 0x5e
call sub.vdsutil.dll_void___cdecl_VdsTraceEx_unsigned_long_int__unsigned_long_int__char__
mov ecx, dword [ebp - 8]
add esp, 0x10
mov esi, 0x80042419
push esi
call fcn.01046504
mov dword [ebp - 0x14], esi
jmp 0x10551b6
mov eax, dword [ebp + 0xc]
cmp dword [eax + 0x50], 1
jne 0x1054efa
lea ecx, [ebp - 0x3c]
push ecx
lea ecx, [ebp - 0x30]
push ecx
sub esp, 0x10
lea esi, [eax + 4]
mov edi, esp
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.01036842
mov dword [ebp - 0x28], eax
cmp eax, ebx
jne 0x1054ef0
push dword [ebp - 0x24]
mov dword [ebp - 4], 0x80042405
push 0x102165c
push ebx
push 0x5e
call sub.vdsutil.dll_void___cdecl_VdsTraceEx_unsigned_long_int__unsigned_long_int__char__
mov ecx, dword [ebp - 8]
add esp, 0x10
push dword [ebp - 4]
call fcn.01046504
jmp 0x1054e22
mov dword [eax + 0xc0], 1
mov esi, dword [ebp + 0xc]
cmp dword [esi + 0x4c], ebx
je 0x1054f1d
push ebx
push 0x106b694
call dword [sym.imp.API_MS_Win_Core_Interlocked_L1_1_0.dll_InterlockedExchange]
push ebx
push 1
push dword [0x106b60c]
call dword [sym.imp.API_MS_Win_Core_Synch_L1_1_0.dll_ReleaseSemaphore]
cmp dword [esi + 0x50], 1
jne 0x10550ee
lea eax, [ebp - 0x1c]
push eax
push 0xc0000000
push dword [ebp - 0x30]
call sub.vdsutil.dll_unsigned_long_int___stdcall_OpenDevice_unsigned_short_int___unsigned_long_int__void___
cmp eax, ebx
je 0x1054f61
jle 0x1054f48
and eax, 0xffff
or eax, 0x80070000
push eax
mov dword [ebp - 4], eax
push 0x1021630
push ebx
push 0x5e
call sub.vdsutil.dll_void___cdecl_VdsTraceEx_unsigned_long_int__unsigned_long_int__char__
add esp, 0x10
jmp 0x10550f1
lea eax, [ebp - 0xd4]
push eax
push dword [ebp - 0x1c]
call sub.vdsutil.dll_unsigned_long_int___stdcall_GetPartitionInformation_void___struct__PARTITION_INFORMATION_EX__
cmp eax, ebx
je 0x1054f8b
jle 0x1054f80
and eax, 0xffff
or eax, 0x80070000
push eax
mov dword [ebp - 4], eax
push 0x1021604
jmp 0x1054f51
cmp dword [ebp - 0xc], 0x200
jb 0x1054fb8
push dword [ebp - 0xc]
push 8
call dword [sym.imp.API_MS_Win_Core_Heap_L1_1_0.dll_GetProcessHeap]
push eax
call sub.vdsutil.dll_void____stdcall_VdsHeapAlloc_void___unsigned_long_int__unsigned_long_int_
push eax
lea ecx, [ebp - 0x20]
call sym.vds.exe_public:_char____thiscall_CVdsHeapPtr_char_::operator_char__
cmp dword [ebp - 0x20], ebx
jne 0x1054fda
shr dword [ebp - 0xc], 1
jmp 0x1054f8b
call dword [sym.imp.API_MS_Win_Core_ErrorHandling_L1_1_0.dll_GetLastError]
cmp eax, ebx
jle 0x1054fcc
and eax, 0xffff
or eax, 0x80070000
push eax
mov dword [ebp - 4], eax
push 0x10215d8
jmp 0x1054f51
push dword [ebp - 0xc]
push ebx
push dword [ebp - 0x20]
call sub.msvcrt.dll_memset
mov ecx, dword [ebp - 0xc0]
mov edx, dword [ebp - 0xc4]
add esp, 0xc
xor edi, edi
mov dword [ebp - 0x14], ebx
mov dword [ebp + 8], ebx
xor esi, esi
mov dword [ebp - 0x34], ebx
mov eax, edx
sub eax, edi
sbb ecx, dword [ebp - 0x14]
cmp ebx, ecx
jl 0x1055019
jg 0x1055014
cmp dword [ebp - 0xc], eax
jbe 0x1055019
sub edx, edi
mov dword [ebp - 0xc], edx
push ebx
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 0xc]
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
call dword [sym.imp.API_MS_Win_Core_File_L1_1_0.dll_WriteFile]
cmp eax, 1
jne 0x105514c
add esi, dword [ebp - 0x2c]
push ebx
adc dword [ebp - 0x34], ebx
push ebx
push dword [ebp - 0x34]
push esi
push dword [ebp - 0x1c]
call dword [sym.imp.API_MS_Win_Core_File_L1_1_0.dll_SetFilePointerEx]
cmp eax, 1
jne 0x105516e
add edi, dword [ebp - 0xc]
adc dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], edi
fild qword [ebp - 0x18]
fild qword [ebp - 0xc4]
fdivp st(1)
fmul qword [0x10215d0]
call sub.msvcrt.dll__ftol2
mov ecx, dword [ebp - 8]
cmp eax, dword [ebp + 8]
je 0x1055088
mov dword [ebp + 8], eax
mov dword [ecx + 0x38], 0x80042409
mov dword [ecx + 0x3c], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0xc0]
jg 0x10550ba
jl 0x105509d
cmp edi, dword [ebp - 0xc4]
jae 0x10550ba
call fcn.0105e5a0
test eax, eax
je 0x10550c1
push dword [ebp - 0x24]
mov dword [ebp - 4], 0x4241a
push 0x10215a4
jmp 0x1054f51
push 1
call fcn.0105e56f
mov ecx, dword [ebp - 0xc0]
cmp dword [ebp - 0x14], ecx
jg 0x10550e0
mov edx, dword [ebp - 0xc4]
jl 0x1055002
cmp edi, edx
jb 0x1055002
mov eax, dword [ebp + 0xc]
add eax, 4
push eax
push 0xa
call fcn.01033927
mov dword [ebp - 4], ebx
mov eax, dword [ebp + 0xc]
cmp dword [eax + 0x50], 1
jne 0x1055103
mov eax, dword [ebp - 0x28]
mov dword [eax + 0xc0], ebx
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 4]
mov dword [ecx + 0x38], eax
mov dword [ecx + 0x3c], 0x64
push dword [ebp - 4]
call fcn.01046504
mov eax, dword [ebp - 0x10]
cmp eax, ebx
je 0x105512b
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [ebp - 0x10], ebx
lea ecx, [ebp - 0x44]
call sub.vdsutil.dll_public:_void___thiscall_CVdsCallTracer::destructor_void_
lea ecx, [ebp - 0x20]
call sym.vds.exe_public:_void___thiscall_CVdsHeapPtr_char_::destructor_void_
lea ecx, [ebp - 0x1c]
call sym.vds.exe_public:_void___thiscall_CVdsHandleImpl__1_::destructor_void_
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 8
call dword [sym.imp.API_MS_Win_Core_ErrorHandling_L1_1_0.dll_GetLastError]
cmp eax, ebx
jle 0x1055160
and eax, 0xffff
or eax, 0x80070000
push eax
mov dword [ebp - 4], eax
push 0x1021578
jmp 0x1054f51
call dword [sym.imp.API_MS_Win_Core_ErrorHandling_L1_1_0.dll_GetLastError]
cmp eax, ebx
jle 0x1055182
and eax, 0xffff
or eax, 0x80070000
push eax
mov dword [ebp - 4], eax
push 0x102154c
jmp 0x1054f51
push dword [ebp - 4]
push esi
push 0x102151c
push ebx
push 0x5e
call sub.vdsutil.dll_void___cdecl_VdsTraceEx_unsigned_long_int__unsigned_long_int__char__
mov ecx, dword [ebp - 8]
add esp, 0x14
cmp esi, ebx
jge 0x10551ae
push esi
jmp 0x10551b1
push dword [ebp - 4]
call fcn.01046504
mov eax, dword [ebp - 0x10]
cmp eax, ebx
je 0x10551c6
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [ebp - 0x10], ebx
mov eax, dword [ebp + 0xc]
cmp dword [eax + 0x4c], ebx
je 0x10551e9
push ebx
push 0x106b694
call dword [sym.imp.API_MS_Win_Core_Interlocked_L1_1_0.dll_InterlockedExchange]
push ebx
push 1
push dword [0x106b60c]
call dword [sym.imp.API_MS_Win_Core_Synch_L1_1_0.dll_ReleaseSemaphore]
mov ebx, dword [ebp - 0x14]
jmp 0x105512b