Function at 0x1004a0d5
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x278
mov eax, dword [0x101844f8]
xor eax, esp
mov dword [esp + 0x274], eax
mov eax, dword [esp + 0x27c]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x28c]
push edi
mov edi, dword [esp + 0x2a4]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x294]
mov dword [esp + 0x18], eax
lea eax, [esp + 0x17c]
push 0x106
push eax
push 1
push esi
mov dword [esp + 0x20], edi
call sym.CoreFoundation.dll_CFURLGetFileSystemRepresentation
add esp, 0x10
test al, al
je 0x1004a1b6
push esi
push dword [sym.CoreFoundation.dll_kCFAllocatorSystemDefault]
call sym.CoreFoundation.dll_CFURLCreateCopyDeletingLastPathComponent
push esi
mov edi, eax
call sym.CoreFoundation.dll_CFURLCopyLastPathComponent
add esp, 0xc
mov ebx, eax
push ebx
push str.__.XXXXXXX
call sym.CoreFoundation.dll___CFStringMakeConstantString
pop ecx
push eax
push 0
push dword [sym.CoreFoundation.dll_kCFAllocatorSystemDefault]
call sym.CoreFoundation.dll_CFStringCreateWithFormat
push 0
mov esi, eax
push esi
push edi
push dword [sym.CoreFoundation.dll_kCFAllocatorSystemDefault]
call sym.CoreFoundation.dll_CFURLCreateCopyAppendingPathComponent
push esi
mov ebp, eax
call sym.CoreFoundation.dll_CFRelease
add esp, 0x24
test ebx, ebx
je 0x1004a18f
push ebx
call sym.CoreFoundation.dll_CFRelease
pop ecx
push 0x106
lea eax, [esp + 0x68]
push eax
push 1
push ebp
call sym.CoreFoundation.dll_CFURLGetFileSystemRepresentation
add esp, 0x10
test al, al
jne 0x1004a1d1
push ebp
call sym.CoreFoundation.dll_CFRelease
push edi
call sym.CoreFoundation.dll_CFRelease
pop ecx
pop ecx
xor al, al
mov ecx, dword [esp + 0x284]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1000234c
add esp, 0x278
ret
lea eax, [esp + 0x64]
xor esi, esi
push 0x116
push eax
call sym.CoreFoundation.dll__NS_mkstemp
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
jns 0x1004a231
test esi, esi
jne 0x1004a220
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov esi, dword [eax]
cmp esi, 2
je 0x1004a200
cmp esi, 0x14
jne 0x1004a224
push 1
push edi
call fcn.100010a0
lea eax, [esp + 0x6c]
push 0x116
push eax
call sym.CoreFoundation.dll__NS_mkstemp
mov ebx, eax
add esp, 0x10
test ebx, ebx
js 0x1004a1ea
test ebx, ebx
jns 0x1004a231
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [eax], esi
jmp 0x1004a1a8
push ebp
call sym.CoreFoundation.dll_CFRelease
push edi
call sym.CoreFoundation.dll_CFRelease
push dword [esp + 0x20]
push dword [esp + 0x20]
call fcn.1004bca1
mov ebp, eax
add esp, 0x10
test ebp, ebp
je 0x1004a1b6
push ebp
call sym.CoreFoundation.dll_CFDataGetLength
push ebp
mov esi, eax
call sym.CoreFoundation.dll_CFDataGetBytePtr
pop ecx
pop ecx
test esi, esi
je 0x1004a2ca
push 0
lea ecx, [esp + 0x18]
push ecx
push esi
push eax
push ebx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__get_osfhandle]
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
or ecx, 0xffffffff
test eax, eax
cmovne ecx, dword [esp + 0x14]
cmp ecx, esi
jne 0x1004a29d
push ebx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__commit]
pop ecx
test eax, eax
jns 0x1004a2ca
mov edi, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
call edi
push ebx
mov esi, dword [eax]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__close]
lea eax, [esp + 0x68]
push eax
call sym.CoreFoundation.dll__NS_unlink
call edi
push ebp
mov dword [eax], esi
call sym.CoreFoundation.dll_CFRelease
add esp, 0xc
jmp 0x1004a1b6
mov edi, dword [esp + 0x10]
test edi, edi
je 0x1004a342
or dword [esp + 0x44], 0xffffffff
lea esi, [esp + 0x34]
xor eax, eax
lea edi, [esp + 0x1c]
and dword [esp + 0x38], eax
xorps xmm0, xmm0
push 6
mov word [esp + 0x38], ax
lea eax, [esp + 0x38]
pop ecx
push eax
movlpd qword [esp + 0x40], xmm0
rep movsd dword es:[edi], dword [esi]
push ebx
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__fstat64i32]
pop ecx
pop ecx
test eax, eax
jne 0x1004a331
mov ax, word [esp + 0x38]
and dword [esp + 0x2c], 0
mov word [esp + 0x1c], ax
mov eax, dword [esp + 0x48]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x54]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x58]
mov dword [esp + 0x28], eax
mov edi, dword [esp + 0x10]
lea esi, [esp + 0x1c]
push 6
pop ecx
rep movsd dword es:[edi], dword [esi]
mov edi, dword [esp + 0x10]
push ebx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__close]
movzx eax, word [esp + 0x2a4]
push eax
lea eax, [esp + 0x6c]
push eax
call sym.CoreFoundation.dll__NS_chmod
lea eax, [esp + 0x188]
push eax
lea eax, [esp + 0x74]
push eax
call sym.CoreFoundation.dll__NS_rename
add esp, 0x14
test eax, eax
je 0x1004a3b6
lea eax, [esp + 0x64]
push eax
call sym.CoreFoundation.dll__NS_unlink
push ebp
call sym.CoreFoundation.dll_CFRelease
pop ecx
pop ecx
test edi, edi
je 0x1004a1b6
xor eax, eax
lea esi, [esp + 0x34]
and dword [esp + 0x38], eax
xorps xmm0, xmm0
or dword [esp + 0x44], 0xffffffff
push 6
pop ecx
mov word [esp + 0x34], ax
movlpd qword [esp + 0x3c], xmm0
rep movsd dword es:[edi], dword [esi]
jmp 0x1004a1b6
push ebp
call sym.CoreFoundation.dll_CFRelease
pop ecx
mov al, 1
jmp 0x1004a1b8