Function at 0x1006f200
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 0x10]
mov ebx, edx
mov edx, ecx
mov dword [ebp - 0x18], ebx
push edi
mov edi, dword [ebp + 8]
cmp dword [esi + 0x10ec], 0
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], eax
je 0x1006f28c
test eax, eax
jl 0x1006f28c
jg 0x1006f232
test edi, edi
je 0x1006f28c
lea eax, [ebp - 0xc]
mov dword [ebp + 0x10], edi
push eax
push dword [esi + 0x1104]
lea eax, [ebp + 0x10]
mov dword [ebp - 0xc], 3
push dword [esi + 0x10fc]
push dword [esi + 0x10f8]
push dword [esi + 0x10f4]
push dword [esi + 0x10f0]
push eax
mov eax, dword [esi + 0x1100]
push edx
push 2
call eax
mov eax, dword [ebp - 0xc]
sub eax, 0
je 0x1006f2e3
sub eax, 1
je 0x1006f2e3
sub eax, 1
je 0x1006f2e3
mov ecx, esi
call fcn.1005beb0
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp - 0x10]
cmp dword [esi + 0x10e4], 0
je 0x1006f343
lea eax, [ebp - 0xc]
mov dword [ebp + 0x10], edi
push eax
push dword [esi + 0x1104]
lea eax, [ebp + 0x10]
mov dword [ebp - 0xc], 3
push dword [esi + 0x10fc]
push dword [esi + 0x10f8]
push dword [esi + 0x10f4]
push dword [esi + 0x10f0]
push eax
mov eax, dword [esi + 0x1100]
push edx
push 1
call eax
mov eax, dword [ebp - 0xc]
cmp eax, 3
ja case.0x1006f2dc.0
jmp dword [eax*4 + 0x1006f4b8]
xor eax, eax
mov dword [esi + 0xa4], 1
xor edx, edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0x10]
cmp eax, edi
jne 0x1006f330
add dword [esi + 0x10f8], eax
mov ecx, esi
adc dword [esi + 0x10fc], 0
call fcn.1005beb0
mov eax, dword [ebp + 0x10]
xor edx, edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [esi + 0xa4], 1
mov dword [ebp + 0x10], 0
mov ecx, esi
call fcn.1005beb0
mov eax, dword [ebp + 0x10]
xor edx, edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test ebx, ebx
je 0x1006f4a5
mov ecx, dword [ebx]
cmp ecx, 0xffffffff
je 0x1006f4a5
cmp dword [esi + 0x9524], 0
je 0x1006f480
xor ecx, ecx
xor edx, edx
mov dword [ebp + 0xc], ecx
mov dword [ebp - 8], edx
test eax, eax
jl 0x1006f477
jg 0x1006f380
test edi, edi
je 0x1006f477
nop
mov ecx, esi
call fcn.1006bf90
mov ecx, edx
mov ebx, eax
mov dword [ebp - 0x14], ecx
cmp ecx, dword [ebp - 4]
jl 0x1006f3dc
jg 0x1006f399
cmp ebx, edi
jb 0x1006f3dc
push 0
lea eax, [ebp + 0x10]
push eax
push edi
push dword [ebp - 0x10]
push dword [esi + 0xac]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1006f44e
cmp dword [ebp + 0x10], edi
jne 0x1006f44e
add dword [ebp + 0xc], edi
mov eax, dword [ebp - 4]
adc dword [ebp - 8], eax
add dword [esi + 0x9548], edi
adc dword [esi + 0x954c], eax
xor edi, edi
mov dword [ebp - 4], edi
jmp 0x1006f44e
mov eax, dword [esi + 0x126b0]
sub eax, 2
je 0x1006f3ec
sub eax, 6
jne 0x1006f3f2
and ebx, 0xfffffff0
mov dword [ebp - 0x14], edx
push 0
lea eax, [ebp + 0x10]
push eax
push ebx
push dword [ebp - 0x10]
push dword [esi + 0xac]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1006f437
mov eax, dword [ebp + 0x10]
cdq
cmp eax, ebx
jne 0x1006f437
mov eax, dword [ebp - 0x14]
cmp edx, eax
jne 0x1006f437
sub edi, ebx
sbb dword [ebp - 4], eax
add dword [ebp + 0xc], ebx
adc dword [ebp - 8], eax
add dword [ebp - 0x10], ebx
add dword [esi + 0x9548], ebx
adc dword [esi + 0x954c], eax
jmp 0x1006f43c
xor edi, edi
mov dword [ebp - 4], edi
mov edx, dword [ebp - 0x18]
xor ecx, ecx
push esi
call fcn.1006c030
add esp, 4
test eax, eax
jne 0x1006f46a
mov ecx, esi
call fcn.1005beb0
cmp dword [ebp - 4], 0
jl 0x1006f471
jg 0x1006f380
test edi, edi
je 0x1006f471
jmp 0x1006f380
mov ecx, esi
call fcn.1005beb0
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 8]
mov eax, ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
lea eax, [ebp + 0x10]
push eax
push edi
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je case.0x1006f2dc.0
cmp dword [ebp + 0x10], edi
je 0x1006f330
jmp case.0x1006f2dc.0
mov ecx, esi
call fcn.1005beb0
pop edi
pop esi
xor eax, eax
xor edx, edx
pop ebx
mov esp, ebp
pop ebp
ret