Function at 0x100b9d9
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x814
mov eax, dword [0x101647c]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 4], eax
xor ebx, ebx
push ebx
lea eax, [ebp - 0x810]
push eax
push 2
lea eax, [ebp - 0x804]
push eax
push esi
mov dword [ebp - 0x808], esi
mov byte [ebp - 0x804], 0xff
mov byte [ebp - 0x803], 0xfe
call edi
push dword [ebp + 0xc]
push esi
call fcn.0100b942
cmp dword [ebp + 0x14], ebx
je 0x100ba47
push dword [ebp + 0x14]
push esi
call fcn.0100b942
cmp dword [ebp + 0x18], ebx
je 0x100ba47
push dword [ebp + 0x18]
push esi
call fcn.0100b942
cmp dword [0x1018f50], ebx
mov dword [ebp - 0x814], ebx
je 0x100ba5f
mov dword [ebp - 0x814], 1
cmp dword [0x1018f54], ebx
je 0x100ba6d
inc dword [ebp - 0x814]
cmp dword [0x1018f58], ebx
je 0x100ba7b
inc dword [ebp - 0x814]
cmp dword [0x1018f5c], ebx
je 0x100ba89
inc dword [ebp - 0x814]
cmp dword [0x1018f60], ebx
je 0x100ba97
inc dword [ebp - 0x814]
cmp dword [0x1018f64], ebx
je 0x100baa5
inc dword [ebp - 0x814]
cmp dword [ebp - 0x814], ebx
je 0x100c1cf
cmp dword [ebp - 0x814], 1
jbe 0x100bac8
cmp dword [ebp + 0x1c], ebx
je 0x100bac8
push dword [ebp + 0x1c]
push esi
call fcn.0100b942
cmp dword [0x1018f50], ebx
mov ebx, dword [sym.imp.msvcrt.dll_wcscpy]
mov esi, dword [sym.imp.msvcrt.dll_wcslen]
je 0x100bbfd
cmp dword [ebp - 0x814], 1
jbe 0x100baee
push dword [ebp + 0x20]
jmp 0x100baf1
push dword [ebp + 0x24]
push dword [ebp - 0x808]
call fcn.0100b942
lea eax, [ebp - 0x804]
push 0x10028d4
push eax
call ebx
pop ecx
pop ecx
push 0
lea eax, [ebp - 0x810]
push eax
lea eax, [ebp - 0x804]
push eax
call esi
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x804]
push eax
push dword [ebp - 0x808]
call edi
mov eax, dword [0x1018f50]
test eax, eax
mov dword [ebp - 0x80c], eax
je 0x100bbc6
jmp 0x100bb4e
mov eax, dword [ebp - 0x80c]
cmp dword [eax], 0
je 0x100bbb9
lea eax, [ebp - 0x804]
push 0x10028c8
push eax
call ebx
pop ecx
pop ecx
push 0
lea eax, [ebp - 0x810]
push eax
lea eax, [ebp - 0x804]
push eax
call esi
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x804]
push eax
push dword [ebp - 0x808]
call edi
push 0
lea eax, [ebp - 0x810]
push eax
mov eax, dword [ebp - 0x80c]
push dword [eax]
call esi
pop ecx
lea eax, [eax + eax + 2]
push eax
mov eax, dword [ebp - 0x80c]
push dword [eax]
push dword [ebp - 0x808]
call edi
mov eax, dword [ebp - 0x80c]
mov eax, dword [eax + 8]
test eax, eax
mov dword [ebp - 0x80c], eax
jne 0x100bb48
lea eax, [ebp - 0x804]
push 0x10028b8
push eax
call ebx
pop ecx
pop ecx
push 0
lea eax, [ebp - 0x810]
push eax
lea eax, [ebp - 0x804]
push eax
call esi
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x804]
push eax
push dword [ebp - 0x808]
call edi
cmp dword [0x1018f54], 0
je 0x100bd27
cmp dword [ebp - 0x814], 1
jbe 0x100bc18
push dword [ebp + 0x28]
jmp 0x100bc1b
push dword [ebp + 0x2c]
push dword [ebp - 0x808]
call fcn.0100b942
lea eax, [ebp - 0x804]
push 0x10028d4
push eax
call ebx
pop ecx
pop ecx
push 0
lea eax, [ebp - 0x810]
push eax
lea eax, [ebp - 0x804]
push eax
call esi
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x804]
push eax
push dword [ebp - 0x808]
call edi
mov eax, dword [0x1018f54]
test eax, eax
mov dword [ebp - 0x80c], eax
je 0x100bcf0
jmp 0x100bc78
mov eax, dword [ebp - 0x80c]
cmp dword [eax], 0
je 0x100bce3
lea eax, [ebp - 0x804]
push 0x10028c8
push eax
call ebx
pop ecx
pop ecx
push 0
lea eax, [ebp - 0x810]
push eax
lea eax, [ebp - 0x804]
push eax
call esi
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x804]
push eax
push dword [ebp - 0x808]
call edi
push 0
lea eax, [ebp - 0x810]
push eax
mov eax, dword [ebp - 0x80c]
push dword [eax]
call esi
pop ecx
lea eax, [eax + eax + 2]
push eax
mov eax, dword [ebp - 0x80c]
push dword [eax]
push dword [ebp - 0x808]
call edi
mov eax, dword [ebp - 0x80c]
mov eax, dword [eax + 8]
test eax, eax
mov dword [ebp - 0x80c], eax
jne 0x100bc72
lea eax, [ebp - 0x804]
push 0x10028b8
push eax
call ebx
pop ecx
pop ecx
push 0
lea eax, [ebp - 0x810]
push eax
lea eax, [ebp - 0x804]
push eax
call esi
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x804]
push eax
push dword [ebp - 0x808]
call edi
cmp dword [0x1018f58], 0
je 0x100be51
cmp dword [ebp - 0x814], 1
jbe 0x100bd42
push dword [ebp + 0x30]
jmp 0x100bd45
push dword [ebp + 0x34]
push dword [ebp - 0x808]
call fcn.0100b942
lea eax, [ebp - 0x804]
push 0x10028d4
push eax
call ebx
pop ecx
pop ecx
push 0
lea eax, [ebp - 0x810]
push eax
lea eax, [ebp - 0x804]
push eax
call esi
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x804]
push eax
push dword [ebp - 0x808]
call edi
mov eax, dword [0x1018f58]
test eax, eax
mov dword [ebp - 0x80c], eax
je 0x100be1a
jmp 0x100bda2
mov eax, dword [ebp - 0x80c]
cmp dword [eax], 0
je 0x100be0d
lea eax, [ebp - 0x804]
push 0x10028c8
push eax
call ebx
pop ecx
pop ecx
push 0
lea eax, [ebp - 0x810]
push eax
lea eax, [ebp - 0x804]
push eax
call esi
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x804]
push eax
push dword [ebp - 0x808]
call edi
push 0
lea eax, [ebp - 0x810]
push eax
mov eax, dword [ebp - 0x80c]
push dword [eax]
call esi
pop ecx
lea eax, [eax + eax + 2]
push eax
mov eax, dword [ebp - 0x80c]
push dword [eax]
push dword [ebp - 0x808]
call edi
mov eax, dword [ebp - 0x80c]
mov eax, dword [eax + 8]
test eax, eax
mov dword [ebp - 0x80c], eax
jne 0x100bd9c
lea eax, [ebp - 0x804]
push 0x10028b8
push eax
call ebx
pop ecx
pop ecx
push 0
lea eax, [ebp - 0x810]
push eax
lea eax, [ebp - 0x804]
push eax
call esi
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x804]
push eax
push dword [ebp - 0x808]
call edi
cmp dword [0x1018f5c], 0
je 0x100bf7b
cmp dword [ebp - 0x814], 1
jbe 0x100be6c
push dword [ebp + 0x38]
jmp 0x100be6f
push dword [ebp + 0x3c]
push dword [ebp - 0x808]
call fcn.0100b942
lea eax, [ebp - 0x804]
push 0x10028d4
push eax
call ebx
pop ecx
pop ecx
push 0
lea eax, [ebp - 0x810]
push eax
lea eax, [ebp - 0x804]
push eax
call esi
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x804]
push eax
push dword [ebp - 0x808]
call edi
mov eax, dword [0x1018f5c]
test eax, eax
mov dword [ebp - 0x80c], eax
je 0x100bf44
jmp 0x100becc
mov eax, dword [ebp - 0x80c]
cmp dword [eax], 0
je 0x100bf37
lea eax, [ebp - 0x804]
push 0x10028c8
push eax
call ebx
pop ecx
pop ecx
push 0
lea eax, [ebp - 0x810]
push eax
lea eax, [ebp - 0x804]
push eax
call esi
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x804]
push eax
push dword [ebp - 0x808]
call edi
push 0
lea eax, [ebp - 0x810]
push eax
mov eax, dword [ebp - 0x80c]
push dword [eax]
call esi
pop ecx
lea eax, [eax + eax + 2]
push eax
mov eax, dword [ebp - 0x80c]
push dword [eax]
push dword [ebp - 0x808]
call edi
mov eax, dword [ebp - 0x80c]
mov eax, dword [eax + 8]
test eax, eax
mov dword [ebp - 0x80c], eax
jne 0x100bec6
lea eax, [ebp - 0x804]
push 0x10028b8
push eax
call ebx
pop ecx
pop ecx
push 0
lea eax, [ebp - 0x810]
push eax
lea eax, [ebp - 0x804]
push eax
call esi
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x804]
push eax
push dword [ebp - 0x808]
call edi
cmp dword [0x1018f60], 0
je 0x100c0a5
cmp dword [ebp - 0x814], 1
jbe 0x100bf96
push dword [ebp + 0x40]
jmp 0x100bf99
push dword [ebp + 0x44]
push dword [ebp - 0x808]
call fcn.0100b942
lea eax, [ebp - 0x804]
push 0x10028d4
push eax
call ebx
pop ecx
pop ecx
push 0
lea eax, [ebp - 0x810]
push eax
lea eax, [ebp - 0x804]
push eax
call esi
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x804]
push eax
push dword [ebp - 0x808]
call edi
mov eax, dword [0x1018f60]
test eax, eax
mov dword [ebp - 0x80c], eax
je 0x100c06e
jmp 0x100bff6
mov eax, dword [ebp - 0x80c]
cmp dword [eax], 0
je 0x100c061
lea eax, [ebp - 0x804]
push 0x10028c8
push eax
call ebx
pop ecx
pop ecx
push 0
lea eax, [ebp - 0x810]
push eax
lea eax, [ebp - 0x804]
push eax
call esi
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x804]
push eax
push dword [ebp - 0x808]
call edi
push 0
lea eax, [ebp - 0x810]
push eax
mov eax, dword [ebp - 0x80c]
push dword [eax]
call esi
pop ecx
lea eax, [eax + eax + 2]
push eax
mov eax, dword [ebp - 0x80c]
push dword [eax]
push dword [ebp - 0x808]
call edi
mov eax, dword [ebp - 0x80c]
mov eax, dword [eax + 8]
test eax, eax
mov dword [ebp - 0x80c], eax
jne 0x100bff0
lea eax, [ebp - 0x804]
push 0x10028b8
push eax
call ebx
pop ecx
pop ecx
push 0
lea eax, [ebp - 0x810]
push eax
lea eax, [ebp - 0x804]
push eax
call esi
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x804]
push eax
push dword [ebp - 0x808]
call edi
cmp dword [0x1018f64], 0
je 0x100c1cf
cmp dword [ebp - 0x814], 1
jbe 0x100c0c0
push dword [ebp + 0x48]
jmp 0x100c0c3
push dword [ebp + 0x4c]
push dword [ebp - 0x808]
call fcn.0100b942
lea eax, [ebp - 0x804]
push 0x10028d4
push eax
call ebx
pop ecx
pop ecx
push 0
lea eax, [ebp - 0x810]
push eax
lea eax, [ebp - 0x804]
push eax
call esi
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x804]
push eax
push dword [ebp - 0x808]
call edi
mov eax, dword [0x1018f64]
test eax, eax
mov dword [ebp - 0x80c], eax
je 0x100c198
jmp 0x100c120
mov eax, dword [ebp - 0x80c]
cmp dword [eax], 0
je 0x100c18b
lea eax, [ebp - 0x804]
push 0x10028c8
push eax
call ebx
pop ecx
pop ecx
push 0
lea eax, [ebp - 0x810]
push eax
lea eax, [ebp - 0x804]
push eax
call esi
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x804]
push eax
push dword [ebp - 0x808]
call edi
push 0
lea eax, [ebp - 0x810]
push eax
mov eax, dword [ebp - 0x80c]
push dword [eax]
call esi
pop ecx
lea eax, [eax + eax + 2]
push eax
mov eax, dword [ebp - 0x80c]
push dword [eax]
push dword [ebp - 0x808]
call edi
mov eax, dword [ebp - 0x80c]
mov eax, dword [eax + 8]
test eax, eax
mov dword [ebp - 0x80c], eax
jne 0x100c11a
lea eax, [ebp - 0x804]
push 0x10028b8
push eax
call ebx
pop ecx
pop ecx
push 0
lea eax, [ebp - 0x810]
push eax
lea eax, [ebp - 0x804]
push eax
call esi
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x804]
push eax
push dword [ebp - 0x808]
call edi
push dword [ebp + 0x10]
push dword [ebp - 0x808]
call fcn.0100b942
mov ecx, dword [ebp - 4]
pop edi
xor eax, eax
pop esi
inc eax
pop ebx
call fcn.01011c2a
leave
ret 0x48