Function at 0x10008e00
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x70
mov eax, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov eax, esp
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x10], 0xffffffff
lea eax, [ebp - 0x18]
mov dword [ebp - 0x14], 0x1000ee60
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
mov dword [ebp - 0x24], 0
mov ecx, dword [ebp + 8]
call fcn.1000efd0
test al, 1
jne 0x10009038
mov ecx, dword [ebp + 0xc]
call fcn.1000f1b0
test al, 1
jne 0x10009038
mov ecx, dword [ebp + 8]
call fcn.1000f110
mov ecx, eax
mov dword [ebp - 0x10], 0
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 0x18], 0
mov dword [eax + 0x14], 0x80
mov dword [eax + 0x10], 3
mov dword [eax + 0xc], 0
mov dword [eax + 8], 0
mov dword [eax + 4], 4
mov eax, dword [sym.imp.KERNEL32.dll_CreateFileA]
call eax
sub esp, 0x1c
mov dword [ebp - 0x58], eax
jmp 0x10008ead
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x28], eax
mov eax, 0xffffffff
cmp dword [ebp - 0x28], eax
jne 0x10008f2f
mov ecx, dword [ebp + 8]
call fcn.1000f110
mov ecx, eax
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 0x18], 0
mov dword [eax + 0x14], 0x80
mov dword [eax + 0x10], 1
mov dword [eax + 0xc], 0
mov dword [eax + 8], 0
mov dword [eax + 4], 0x40000000
mov eax, dword [sym.imp.KERNEL32.dll_CreateFileA]
call eax
sub esp, 0x1c
mov dword [ebp - 0x5c], eax
jmp 0x10008f0b
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x28], eax
mov eax, 0xffffffff
cmp dword [ebp - 0x28], eax
jne 0x10008f2a
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x20], eax
jmp 0x1000903e
jmp 0x10008f2f
mov dword [ebp - 0x2c], 0
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x30]
lea eax, [ebp - 0x34]
mov dword [esp], eax
call fcn.1000f1f0
sub esp, 4
mov ecx, dword [ebp - 0x30]
lea eax, [ebp - 0x38]
mov dword [esp], eax
call fcn.1000f240
sub esp, 4
lea ecx, [ebp - 0x34]
lea eax, [ebp - 0x38]
mov dword [esp], eax
call fcn.1000f280
sub esp, 4
test al, 1
jne 0x10008f7c
jmp 0x1000901d
lea ecx, [ebp - 0x34]
call fcn.1000f340
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp - 0x3c]
mov eax, esp
mov dword [eax + 4], ecx
lea ecx, [ebp - 0x54]
mov dword [eax], ecx
call fcn.10002120
jmp 0x10008f9e
lea ecx, [ebp - 0x54]
mov dword [ebp - 0x60], ecx
call fcn.10004cb0
mov ecx, dword [ebp - 0x60]
mov esi, eax
call fcn.1000f110
mov edx, eax
mov ecx, dword [ebp - 0x28]
mov eax, esp
lea edi, [ebp - 0x2c]
mov dword [eax + 0xc], edi
mov dword [eax + 8], esi
mov dword [eax + 4], edx
mov dword [eax], ecx
mov dword [eax + 0x10], 0
mov eax, dword [sym.imp.KERNEL32.dll_WriteFile]
call eax
sub esp, 0x14
jmp 0x10008fde
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
sub ecx, dword [ebp - 0x24]
mov edx, 0xab114b9
sub edx, eax
sub edx, 0xab114b9
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, 0x6a836877
sub eax, ecx
sub eax, 0x6a836877
mov dword [ebp - 0x24], eax
lea ecx, [ebp - 0x54]
call fcn.10004bb0
lea ecx, [ebp - 0x34]
call fcn.1000f360
jmp 0x10008f5e
mov ecx, dword [ebp - 0x28]
mov eax, esp
mov dword [eax], ecx
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
jmp 0x10009033
jmp 0x10009038
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x18]
mov dword fs:[0], ecx
add esp, 0x70
pop esi
pop edi
pop ebx
pop ebp
ret