Function at 0x10006af0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x344
mov eax, dword [0x10011098]
mov dword [esp + 0x340], eax
mov eax, dword [esp + 0x348]
test eax, eax
jne 0x10006b2a
mov eax, 0x10000
mov dword [0x100110a0], eax
mov ecx, dword [esp + 0x340]
call fcn.1000c09f
add esp, 0x344
ret
cmp dword [eax], 1
je 0x10006b4c
mov eax, 0x80000
mov dword [0x100110a0], eax
mov ecx, dword [esp + 0x340]
call fcn.1000c09f
add esp, 0x344
ret
push ebx
push esi
push edi
mov edi, dword [eax + 4]
mov eax, dword [edi + 4]
or ebx, 0xffffffff
cmp eax, ebx
je 0x10006b67
mov eax, dword [edi]
push eax
call fcn.10004290
add esp, 4
mov eax, dword [edi]
mov esi, dword [esp + 0x358]
mov dword [edi + 4], ebx
cmp esi, dword [eax + 4]
jl 0x10006b82
mov eax, 0x10000
jmp 0x10006de0
cmp esi, dword [eax + 0x10]
jge 0x10006b90
push eax
call fcn.10003fd0
add esp, 4
mov ecx, dword [edi]
cmp dword [ecx + 0x10], esi
jge 0x10006bab
mov edx, dword [edi]
push edx
call fcn.10004020
mov eax, dword [edi]
mov ecx, dword [eax + 0x10]
add esp, 4
cmp ecx, esi
jl 0x10006b97
lea ecx, [esp + 0x11c]
push ecx
push esi
mov ecx, edi
call fcn.10004420
test byte [esp + 0x224], 0x10
je 0x10006c09
mov ecx, dword [esp + 0x35c]
mov al, byte [ecx]
cmp al, 0x2f
je 0x10006be0
cmp al, 0x5c
je 0x10006be0
test al, al
je 0x10006bf2
cmp byte [ecx + 1], 0x3a
jne 0x10006bf2
push ecx
push 0
call fcn.100049c0
add esp, 8
xor eax, eax
jmp 0x10006de0
push ecx
add edi, 0x140
push edi
call fcn.100049c0
add esp, 8
xor eax, eax
jmp 0x10006de0
mov edx, dword [esp + 0x35c]
mov al, byte [edx]
test al, al
push ebp
mov ebp, edx
mov ecx, edx
je 0x10006c33
jmp 0x10006c20
cmp al, 0x2f
je 0x10006c28
cmp al, 0x5c
jne 0x10006c2b
lea ebp, [ecx + 1]
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x10006c20
lea esi, [esp + 0x1c]
mov eax, edx
sub esi, edx
jmp 0x10006c40
mov cl, byte [eax]
mov byte [esi + eax], cl
inc eax
test cl, cl
jne 0x10006c40
cmp ebp, edx
jne 0x10006cb3
mov byte [esp + 0x1c], cl
push ebp
lea ecx, [esp + 0x20]
push ecx
lea esi, [edi + 0x140]
push esi
lea edx, [esp + 0x258]
push str._s_s_s
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [esp + 0x30]
push eax
push esi
call fcn.100049c0
add esp, 0x1c
mov ecx, dword [esp + 0x228]
push 0
push ecx
push 2
push 0
push 0
push 0x40000000
lea edx, [esp + 0x264]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebp, eax
cmp ebp, ebx
jne 0x10006d04
mov eax, 0x200
jmp 0x10006ddf
mov eax, ebp
sub eax, edx
mov byte [esp + eax + 0x1c], 0
mov al, byte [esp + 0x1c]
cmp al, 0x2f
je 0x10006cd7
cmp al, 0x5c
je 0x10006cd7
test al, al
je 0x10006c52
cmp byte [esp + 0x1d], 0x3a
jne 0x10006c52
push ebp
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x254]
push str._s_s
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [esp + 0x2c]
push eax
push 0
call fcn.100049c0
add esp, 0x18
jmp 0x10006c80
mov eax, dword [edi + 0x138]
mov ecx, dword [edi]
push eax
push ecx
call fcn.10006490
mov eax, dword [edi + 0x13c]
add esp, 8
test eax, eax
jne 0x10006d33
push 0x4000
call fcn.1000bfe4
add esp, 4
mov dword [edi + 0x13c], eax
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [esp + 0x14], 0
mov eax, dword [edi + 0x13c]
mov ecx, dword [edi]
lea edx, [esp + 0x13]
push edx
push 0x4000
push eax
push ecx
call fcn.10006620
mov esi, eax
add esp, 0x10
cmp esi, 0xffffff96
je 0x10006d96
test esi, esi
jl 0x10006d8c
jle 0x10006d80
mov eax, dword [edi + 0x13c]
push 0
lea edx, [esp + 0x1c]
push edx
push esi
push eax
push ebp
call ebx
test eax, eax
je 0x10006da0
mov al, byte [esp + 0x13]
test al, al
jne 0x10006daa
test esi, esi
jne 0x10006d41
mov dword [esp + 0x14], 0x5000000
jmp 0x10006dc9
mov dword [esp + 0x14], 0x1000
jmp 0x10006dc9
mov dword [esp + 0x14], 0x400
jmp 0x10006dc9
lea ecx, [esp + 0x23c]
push ecx
lea edx, [esp + 0x230]
push edx
lea eax, [esp + 0x23c]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [edi]
push ecx
call fcn.10004290
mov eax, dword [esp + 0x18]
add esp, 4
pop ebp
mov ecx, dword [esp + 0x34c]
pop edi
pop esi
pop ebx
mov dword [0x100110a0], eax
call fcn.1000c09f
add esp, 0x344
ret