Function at 0x656b60
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6956fa
mov eax, dword fs:[0]
push eax
sub esp, 0x180
mov eax, dword [0x6ade70]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov ecx, dword [ebp + 8]
test ecx, ecx
jne 0x656b9e
lea eax, [ecx - 7]
jmp 0x656ede
mov edi, dword [ebp + 0xc]
lea eax, [esi + 0x30]
push eax
lea eax, [ebp - 0x16c]
mov dword [ebp - 0x16c], 0
push eax
push edi
push ecx
push dword [esi + 0x50]
call dword [sym.imp.KERNEL32.dll_WriteFile_1]
test eax, eax
je 0x656d38
cmp dword [ebp - 0x16c], edi
je 0x656d28
push 0x6a920c
lea ecx, [ebp - 0x168]
mov dword [ebp - 0x168], 0x6a48b8
mov dword [ebp - 0x164], 0
mov dword [ebp - 0x160], 0
mov dword [ebp - 0x15c], 0
call fcn.00660810
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0
push eax
push ecx
lea ecx, [ebp - 0x158]
call fcn.006573b0
mov ecx, eax
call fcn.00657340
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 1
push eax
push ecx
lea ecx, [ebp - 0xb0]
call fcn.006572d0
mov ecx, eax
call fcn.00657000
mov esi, eax
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x17c], 0x6a48b8
cmovae ecx, dword [ebp - 0x28]
push ecx
lea ecx, [ebp - 0x17c]
mov dword [ebp - 0x178], 0
mov dword [ebp - 0x174], 0
mov dword [ebp - 0x170], 0
call fcn.00660810
mov dword [ebp - 0x17c], 0x6a48b8
lea eax, [ebp - 0x168]
push eax
lea eax, [ebp - 0x17c]
push eax
lea ecx, [ebp - 0x18c]
call fcn.0065ff40
mov byte [ebp - 4], 4
cmp dword [esi + 0x14], 0x10
jb 0x656cb6
mov esi, dword [esi]
push ecx
mov ecx, dword [0x6b04b4]
push 0
push 0xde
push esi
push dword [eax + 4]
call fcn.0066fda0
mov eax, dword [ebp - 0x188]
mov dword [ebp - 0x18c], 0x6a48b8
test eax, eax
je 0x656cea
push eax
call fcn.00684583
add esp, 4
mov eax, dword [ebp - 0x178]
test eax, eax
je 0x656cfd
push eax
call fcn.00684583
add esp, 4
lea ecx, [ebp - 0x40]
call fcn.00650140
lea ecx, [ebp - 0x28]
call fcn.00650140
mov eax, dword [ebp - 0x164]
test eax, eax
je 0x656d20
push eax
call fcn.00684583
add esp, 4
or eax, 0xffffffff
jmp 0x656ede
push dword [esi + 0x40]
call dword [sym.imp.KERNEL32.dll_SetEvent]
xor eax, eax
jmp 0x656ede
call dword [sym.imp.KERNEL32.dll_GetLastError_1]
mov esi, eax
cmp esi, 0xe9
ja 0x656d74
je case.0x656d59.109
cmp esi, 0xe8
ja case.0x656d59.1
movzx eax, byte [esi + 0x656f10]
jmp dword [eax*4 + 0x656efc]
mov eax, 0xfffffff2
jmp 0x656ede
mov eax, 0xffffffe7
jmp 0x656ede
sub eax, 0x3e5
je case.0x656d59.0
sub eax, 0x313
je case.0x656d59.8
sub eax, 0x20
je case.0x656d59.8
push 0x6a920c
lea ecx, [ebp - 0x168]
mov dword [ebp - 0x168], 0x6a48b8
mov dword [ebp - 0x164], 0
mov dword [ebp - 0x160], 0
mov dword [ebp - 0x15c], 0
call fcn.00660810
push esi
lea ecx, [ebp - 0x20]
mov dword [ebp - 4], 5
call fcn.006606c0
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 6
push eax
push ecx
lea ecx, [ebp - 0xa0]
call fcn.00657210
mov ecx, eax
call fcn.00657130
lea eax, [ebp - 0x58]
mov byte [ebp - 4], 7
push eax
push ecx
lea ecx, [ebp - 0x110]
call fcn.006570c0
mov ecx, eax
call fcn.00657000
mov esi, eax
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x17c]
call fcn.0064eb90
lea ecx, [ebp - 0x168]
push ecx
lea ecx, [ebp - 0x20]
push ecx
push eax
lea ecx, [ebp - 0x18c]
call fcn.00660000
mov byte [ebp - 4], 0xa
cmp dword [esi + 0x14], 0x10
jb 0x656e45
mov esi, dword [esi]
push ecx
mov ecx, dword [0x6b04b4]
push 0
push 0xfa
push esi
push dword [eax + 4]
call fcn.0066fda0
mov eax, dword [ebp - 0x188]
mov dword [ebp - 0x18c], 0x6a48b8
test eax, eax
je 0x656e79
push eax
call fcn.00684583
add esp, 4
mov eax, dword [ebp - 0x178]
mov dword [ebp - 0x17c], 0x6a48b8
test eax, eax
je 0x656e96
push eax
call fcn.00684583
add esp, 4
lea ecx, [ebp - 0x58]
call fcn.00650140
lea ecx, [ebp - 0x40]
call fcn.00650140
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x656eb6
push eax
call fcn.00684583
add esp, 4
mov eax, dword [ebp - 0x164]
test eax, eax
je 0x656d20
push eax
call fcn.00684583
add esp, 4
or eax, 0xffffffff
jmp 0x656ede
mov eax, 0xfffffff6
jmp 0x656ede
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0067efea
mov esp, ebp
pop ebp
ret 8