Function at 0x1e00522c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x294
push edi
xor edi, edi
cmp dword [0x1e02a540], edi
mov dword [ebp - 4], edi
jne 0x1e0054a3
cmp dword [0x1e02a534], edi
je 0x1e0054a3
cmp dword [0x1e02a53c], edi
je 0x1e0054a3
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
and esi, 0xfffffff
dec eax
mov dword [0x1e02a9b8], edi
je 0x1e005409
dec eax
jne 0x1e0054a1
push edi
push edi
lea eax, [ebp - 0x2c]
push eax
push dword [ebp + 0x10]
mov eax, esi
or eax, 0x20000000
push eax
call sym.MIGISM.dll_IsmAcquireObjectEx
test eax, eax
je 0x1e0054a1
push 2
mov ebx, 0x1e02a9b0
push ebx
call fcn.1e01b38e
push 4
push ebx
call fcn.1e01b25b
push dword [ebp + 0x10]
mov dword [eax], esi
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
lea eax, [eax + eax + 2]
push eax
push ebx
call fcn.1e01b38e
push dword [ebp + 0x10]
push ebx
call fcn.1e01b475
push 0x28
push ebx
call fcn.1e01b38e
push 0x28
push ebx
call fcn.1e01b25b
push 0xa
pop ecx
lea esi, [ebp - 0x2c]
mov edi, eax
rep movsd dword es:[edi], dword [esi]
xor esi, esi
cmp dword [ebp - 0x14], esi
je 0x1e00532a
cmp dword [ebp - 0x10], esi
je 0x1e00532a
push dword [ebp - 0x14]
push ebx
call fcn.1e01b38e
mov eax, dword [ebp - 0x14]
mov esi, dword [ebp - 0x10]
push eax
push ebx
mov dword [ebp + 0x10], eax
call fcn.1e01b25b
mov edi, eax
mov eax, dword [ebp + 0x10]
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor esi, esi
jmp 0x1e005331
push esi
push ebx
call fcn.1e01b38e
cmp dword [ebp - 0x28], esi
je 0x1e0053c3
lea eax, [ebp - 0x294]
push eax
push dword [ebp - 0x24]
call fcn.1e0175b1
test eax, eax
je 0x1e0053ba
test byte [ebp - 0x294], 0x10
jne 0x1e0053ba
inc dword [0x1e02a9c4]
push dword [0x1e02a9c4]
lea eax, [ebp - 0x44]
push 0x1e0016d4
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
push esi
lea eax, [ebp - 0x44]
push eax
push dword [0x1e02a534]
push esi
call fcn.1e01a608
add esp, 0x1c
push esi
mov edi, eax
push edi
push dword [ebp - 0x24]
call fcn.1e017b8b
push edi
push esi
call fcn.1e018041
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
lea eax, [eax + eax + 2]
push eax
push ebx
call fcn.1e01b38e
lea eax, [ebp - 0x44]
push eax
push ebx
call fcn.1e01b475
jmp 0x1e0053f4
push esi
push ebx
call fcn.1e01b38e
jmp 0x1e0053f4
push dword [ebp - 0x20]
push ebx
call fcn.1e01b38e
cmp dword [ebp - 0x20], esi
je 0x1e0053f4
mov eax, dword [ebp - 0x20]
mov esi, dword [ebp - 0x24]
push eax
push ebx
mov dword [ebp + 0x10], eax
call fcn.1e01b25b
mov edi, eax
mov eax, dword [ebp + 0x10]
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [0x1e02a9b8]
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sym.MIGISM.dll_IsmReleaseObject
xor edi, edi
jmp 0x1e005446
push 1
mov ebx, 0x1e02a9b0
push ebx
call fcn.1e01b38e
push 4
push ebx
call fcn.1e01b25b
push dword [ebp + 0x10]
mov dword [eax], esi
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
lea eax, [eax + eax + 2]
push eax
push ebx
call fcn.1e01b38e
push dword [ebp + 0x10]
push ebx
call fcn.1e01b475
mov eax, dword [0x1e02a9b8]
mov dword [ebp - 4], eax
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
lea eax, [ebp + 0xc]
push eax
push 4
lea eax, [ebp - 4]
push eax
push dword [0x1e02a53c]
call esi
push edi
lea eax, [ebp + 0xc]
push eax
push dword [0x1e02a9b8]
push dword [0x1e02a9b0]
push dword [0x1e02a53c]
call esi
push edi
lea eax, [ebp + 0xc]
push eax
push 4
lea eax, [ebp - 4]
push eax
push dword [0x1e02a53c]
call esi
push dword [0x1e02a53c]
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov dword [0x1e02a544], 1
pop esi
pop ebx
pop edi
leave
ret 0xc