Function at 0x1006bad0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push ebx
push esi
push edi
xor edi, edi
mov esi, eax
xor ecx, ecx
xor eax, eax
xor edx, edx
mov dword [ebp - 8], edi
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x24], eax
mov word [ebp - 0x20], dx
mov dword [ebp - 0x18], edi
mov dword [ebp - 0xc], edi
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], edi
cmp esi, edi
je 0x1006bcc8
mov eax, dword [ebp + 8]
mov eax, dword [eax]
cmp dword [eax - 0xc], edi
je 0x1006bcc8
push edi
push edi
push 2
push edi
push 1
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
xor eax, eax
cmp ebx, 0xffffffff
je 0x1006bcca
lea ecx, [ebp - 0x48]
push ecx
push esi
mov dword [ebp - 0x24], eax
mov word [ebp - 0x20], ax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
call dword [sym.imp.USER32.dll_GetIconInfo]
mov ecx, dword [ebp - 0x3c]
lea eax, [edi + 1]
lea edi, [ebp - 0x14]
lea esi, [ebp - 0x18]
call fcn.1006bdc0
mov ecx, dword [ebp - 0x38]
mov eax, 0x20
lea edi, [ebp - 0x10]
lea esi, [ebp - 0xc]
call fcn.1006bdc0
mov edx, dword [ebp - 0x18]
mov edi, dword [sym.imp.MSVCR100.dll_malloc]
push edx
call edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0xc]
add esp, 4
push eax
call edi
mov ecx, dword [ebp - 0x14]
add esp, 4
push ecx
mov esi, eax
call edi
mov edx, dword [ebp - 0x10]
add esp, 4
push edx
mov dword [ebp - 0x18], eax
call edi
mov edi, dword [ebp - 0x3c]
add esp, 4
mov dword [ebp + 8], eax
mov eax, dword [ebp - 0x18]
push 1
push eax
mov eax, dword [ebp - 0x1c]
call fcn.1006be20
mov ecx, dword [ebp + 8]
mov edi, dword [ebp - 0x38]
push 0x20
push ecx
mov eax, esi
call fcn.1006be20
push 0
lea ecx, [ebp - 8]
push ecx
push 6
lea edx, [ebp - 0x24]
push edx
push ebx
mov dword [ebp - 0x22], 0x10001
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edi, eax
mov al, byte [esi + 4]
mov byte [ebp - 0x34], al
mov cl, byte [esi + 8]
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 0x14]
mov byte [ebp - 0x33], cl
mov dx, word [esi + 0xe]
imul dx, word [esi + 0xc]
and edi, 1
add eax, dword [ebp - 0xc]
mov word [ebp - 0x32], dx
push 0
lea edx, [ebp - 8]
push edx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], 0x16
push 0x10
lea eax, [ebp - 0x34]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [esi + 8]
push 0
lea edx, [ebp - 8]
push edx
and edi, eax
mov eax, dword [ebp - 0xc]
push eax
push esi
add ecx, ecx
push ebx
mov dword [esi + 8], ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [ebp - 0x10]
push 0
lea ecx, [ebp - 8]
push ecx
and edi, eax
mov eax, dword [ebp + 8]
push edx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [ebp - 0x14]
push 0
lea ecx, [ebp - 8]
push ecx
and edi, eax
mov eax, dword [ebp - 0x18]
push edx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
mov esi, dword [sym.imp.MSVCR100.dll_free]
and edi, eax
call esi
mov ecx, dword [ebp - 0x1c]
add esp, 4
push ecx
call esi
mov edx, dword [ebp + 8]
add esp, 4
push edx
call esi
mov eax, dword [ebp - 0x18]
add esp, 4
push eax
call esi
mov ecx, dword [ebp - 0x38]
mov esi, dword [sym.imp.GDI32.dll_DeleteObject]
add esp, 4
push ecx
call esi
mov edx, dword [ebp - 0x3c]
push edx
call esi
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4