Function at 0xe989e2
Capabilities:
Write file on windows

Disassembly:
push 0
lea ecx, [ebp - 0x38]
call fcn.00e98cbf
mov dword [ebp - 4], 1
test esi, esi
jl 0xe91a47
push dword [ebp - 0x34]
mov ecx, edi
call fcn.00e9174b
mov esi, eax
test esi, esi
jl 0xe91a47
push dword [ebp + 0xc]
mov ecx, edi
call fcn.00e91b46
mov esi, eax
push dword [ebp - 0x34]
mov dword [ebp - 0x38], 0xe91660
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
or dword [ebp - 4], 0xffffffff
xor ebx, ebx
inc ebx
test esi, esi
jl 0xe91b1f
xor eax, eax
cmp dword [edi + 0x3c], 2
je 0xe9f6cc
test esi, esi
jl 0xe91b1f
push dword [edi + eax*4 + 0x34]
mov ecx, edi
push dword [0xeab46c]
call fcn.00e916c1
mov dword [ebp - 0x2c], eax
test eax, eax
je 0xe997fd
push ebx
push eax
mov ecx, edi
call fcn.00e91570
mov esi, eax
test esi, esi
jl 0xe91b02
push ebx
push dword [0xeab490]
mov ecx, edi
call fcn.00e91570
mov esi, eax
test esi, esi
jl 0xe91b02
push ebx
push dword [0xeab444]
mov ecx, edi
call fcn.00e91570
mov esi, eax
test esi, esi
jl 0xe91b02
push ebx
push dword [ebp - 0x2c]
mov ecx, edi
call fcn.00e91570
mov esi, eax
test esi, esi
jl 0xe91b02
push ebx
push dword [0xeab498]
mov ecx, edi
call fcn.00e91570
mov esi, eax
test esi, esi
jl 0xe91b02
push ebx
push dword [0xeab444]
mov ecx, edi
call fcn.00e91570
mov esi, eax
push dword [ebp - 0x2c]
call fcn.00e913c0
pop ecx
test esi, esi
jl 0xe91b1f
push ebx
push dword [0xeab444]
mov ecx, edi
call fcn.00e91570
mov esi, eax
xor eax, eax
cmp esi, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x34], eax
jl 0xe9982f
cmp dword [ebp + 0x10], 0xffffffff
je 0xe9920d
mov dword [ebp - 0x20], eax
jmp 0xe91c83
test esi, esi
jl 0xe91c2c
push 1
push dword [0xeab444]
mov ecx, edi
call fcn.00e91570
mov esi, eax
cmp dword [ebp + 0xc], 0
je 0xe91c4b
test esi, esi
jl 0xe91c4b
push 0xbb8
push 0xa
push 0x64
push 0x3e8
push 3
call sub.wbemcomn.dll_long_int___stdcall_Throttle_unsigned_long_int__unsigned_long_int__unsigned_long_int__unsigned_long_int__unsigned_long_int_
lea ecx, [ebp - 0x2c]
call fcn.00e913f8
inc dword [ebp - 0x1c]
mov ebx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x20]
imul eax, eax, 0x18
cmp ebx, dword [eax + edi + 0x10]
je 0xe99204
test esi, esi
jl 0xe99204
mov eax, dword [ebx + 0x10]
add eax, 8
mov eax, dword [eax + 8]
and dword [ebp - 0x14], 0
mov dword [ebp - 0x30], eax
jmp 0xe91cae
mov eax, dword [ebp - 0x20]
cmp eax, dword [edi + 0x30]
jae 0xe9920d
test esi, esi
jl 0xe9982f
imul eax, eax, 0x18
add eax, edi
cmp dword [eax + 0x14], 0
jne 0xe91ef7
inc dword [ebp - 0x20]
xor ebx, ebx
inc ebx
jmp 0xe91c83
mov eax, dword [ebp - 0x14]
cmp eax, dword [edi + 0x3c]
jae 0xe91c17
test esi, esi
jl 0xe91c2c
cmp eax, dword [ebp - 0x30]
jae 0xe91c17
mov eax, dword [ebx + 0x10]
push dword [ebp - 0x1c]
mov eax, dword [eax + 4]
push eax
mov ecx, edi
call fcn.00e914ef
mov esi, eax
test esi, esi
je 0xe99807
mov eax, dword [ebp - 0x14]
push dword [edi + eax*4 + 0x34]
mov ecx, edi
push esi
call fcn.00e916c1
push esi
mov dword [ebp - 0x24], eax
call fcn.00e913c0
cmp dword [ebp - 0x24], 0
pop ecx
je 0xe99807
push 1
push dword [ebp - 0x24]
mov ecx, edi
call fcn.00e91570
mov esi, eax
test esi, esi
jl 0xe91e03
push 1
push dword [0xeab44c]
mov ecx, edi
call fcn.00e91570
mov esi, eax
test esi, esi
jl 0xe91e03
push 1
push dword [0xeab448]
mov ecx, edi
call fcn.00e91570
mov esi, eax
test esi, esi
jl 0xe91e03
mov eax, dword [ebx + 0x10]
mov ecx, dword [ebp - 0x14]
add eax, 8
mov eax, dword [eax + 4]
shl ecx, 2
add eax, ecx
mov eax, dword [eax]
mov eax, dword [eax + 4]
push 1
push eax
mov ecx, edi
call fcn.00e91570
mov esi, eax
test esi, esi
jl 0xe91e03
push 1
push dword [0xeab444]
mov ecx, edi
call fcn.00e91570
mov esi, eax
test esi, esi
jl 0xe91e03
push 1
push dword [ebp - 0x24]
mov ecx, edi
call fcn.00e91570
mov esi, eax
test esi, esi
jl 0xe91e03
push 1
push dword [0xeab450]
mov ecx, edi
call fcn.00e91570
mov esi, eax
test esi, esi
jl 0xe91e03
push 1
push dword [0xeab448]
mov ecx, edi
call fcn.00e91570
mov esi, eax
test esi, esi
jl 0xe91e03
mov eax, dword [ebx + 0x10]
mov ecx, dword [ebp - 0x14]
add eax, 8
mov eax, dword [eax + 4]
shl ecx, 2
add eax, ecx
mov eax, dword [eax]
mov eax, dword [eax + 8]
push 1
push eax
mov ecx, edi
call fcn.00e91570
mov esi, eax
test esi, esi
jl 0xe91e03
push 1
push dword [0xeab444]
mov ecx, edi
call fcn.00e91570
mov esi, eax
push dword [ebp - 0x24]
call fcn.00e913c0
pop ecx
inc dword [ebp - 0x14]
jmp 0xe91cae
mov eax, dword [eax + 0x10]
mov ebx, dword [eax]
mov dword [ebp - 4], 5
mov dword [ebp - 0x2c], ebx
jmp 0xe91c59
push 0x2c
mov eax, 0xea6d28
call fcn.00e91350
mov edi, ecx
mov dword [ebp - 0x28], edi
mov eax, dword [ebp + 8]
xor ecx, ecx
mov esi, 0x8000ffff
cmp eax, ecx
je 0xe997d4
cmp word [eax], cx
je 0xe997d4
cmp dword [ebp + 0x10], ecx
jne 0xe98a1c
cmp dword [edi + 0x30], ecx
je 0xe997d4
push dword [ebp + 8]
and dword [ebp - 4], 0
mov dword [ebp - 0x18], ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ebx, eax
add ebx, 0xa
xor ecx, ecx
push 2
pop edx
mov eax, ebx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00e913e0
pop ecx
mov dword [ebp - 0x18], eax
test eax, eax
je 0xe9f687
push dword [ebp + 8]
push ebx
push eax
call fcn.00e921cb
mov esi, eax
test esi, esi
jl 0xe91a57
push 0xe98ca8
push ebx
push dword [ebp - 0x18]
call fcn.00e92436
mov esi, eax
test esi, esi
jl 0xe91a57
push dword [ebp - 0x18]
mov ecx, edi
call fcn.00e97f3e
mov esi, eax
test esi, esi
jl 0xe91a57
and dword [ebp - 0x24], 0
mov ebx, 0xe98ca4
push ebx
mov esi, 0x80004005
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push 0
lea ecx, [ebp - 0x24]
push ecx
mov dword [ebp - 0x2c], eax
push dword [ebp - 0x2c]
mov eax, dword [edi + 0x44]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0xe91a57
mov eax, dword [ebp - 0x2c]
cmp eax, dword [ebp - 0x24]
jne 0xe91a57
xor esi, esi
mov dword [ebp - 0x38], 0xe91660
mov dword [ebp - 0x34], esi
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 1
call fcn.00e98742
push esi
lea ecx, [ebp - 0x38]
call fcn.00e983a7
push 0xe97ec8
lea ecx, [ebp - 0x38]
call fcn.00e983a7
push esi
lea ecx, [ebp - 0x38]
call fcn.00e983a7
push 0xe97eac
lea ecx, [ebp - 0x38]
call fcn.00e983a7
push dword [ebp + 8]
lea ecx, [ebp - 0x38]
call fcn.00e983a7
push esi
lea ecx, [ebp - 0x38]
call fcn.00e983a7
push 0xe97e98
lea ecx, [ebp - 0x38]
call fcn.00e983a7
push esi
lea ecx, [ebp - 0x38]
call fcn.00e983a7
push 0xe98c18
lea ecx, [ebp - 0x38]
call fcn.00e983a7
push esi
lea ecx, [ebp - 0x38]
call fcn.00e983a7
lea ecx, [ebp - 0x38]
call fcn.00e986ef
push esi
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 2
call fcn.00e98cbf
push dword [0xeab4a4]
lea ecx, [ebp - 0x38]
call fcn.00e98cbf
push dword [0xeab49c]
lea ecx, [ebp - 0x38]
call fcn.00e98cbf
push dword [ebp + 8]
lea ecx, [ebp - 0x38]
call fcn.00e98cbf
push esi
lea ecx, [ebp - 0x38]
call fcn.00e98cbf
push dword [0xeab4a0]
lea ecx, [ebp - 0x38]
call fcn.00e98cbf
push dword [ebp + 8]
lea ecx, [ebp - 0x38]
call fcn.00e98cbf
push 0xe988c4
lea ecx, [ebp - 0x38]
call fcn.00e98cbf
push esi
lea ecx, [ebp - 0x38]
call fcn.00e98cbf
push esi
lea ecx, [ebp - 0x38]
call fcn.00e98cbf
push dword [0xeab4ac]
lea ecx, [ebp - 0x38]
call fcn.00e98cbf
xor ebx, ebx
cmp ebx, dword [edi + 0x3c]
jae 0xe91a16
push dword [edi + ebx*4 + 0x34]
mov ecx, edi
call fcn.00e988ef
mov dword [ebp - 0x2c], eax
test eax, eax
je 0xe997f3
push eax
lea ecx, [ebp - 0x38]
call fcn.00e98cbf
push dword [ebp - 0x2c]
call fcn.00e913c0
pop ecx
inc ebx
jmp 0xe98be4
cmp dword [ebp + 0xc], 0
je 0xe98e21
test esi, esi
jl 0xe98e21
push 0xbb8
push 0xa
push 0x64
push 0x3e8
push 3
call sub.wbemcomn.dll_long_int___stdcall_Throttle_unsigned_long_int__unsigned_long_int__unsigned_long_int__unsigned_long_int__unsigned_long_int_
lea ecx, [ebp - 0x20]
call fcn.00e913f8
inc dword [ebp - 0x1c]
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x20]
imul eax, eax, 0x18
cmp ecx, dword [eax + edi + 0x10]
je 0xe997ea
test esi, esi
jl 0xe997ea
and dword [ebp + 0x10], 0
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0x10]
mov ecx, dword [ebp + 0x10]
cmp ecx, dword [eax + 0x1c]
jae 0xe98e02
test esi, esi
jl 0xe98e02
mov eax, dword [eax + 0x18]
shl ecx, 2
mov eax, dword [ecx + eax]
cmp dword [eax + 0x10], 0
je 0xe9902c
mov eax, dword [eax + 0x14]
and dword [ebp - 0x14], 0
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [edi + 0x3c]
jae 0xe99017
test esi, esi
jl 0xe9902c
cmp eax, dword [ebp - 0x34]
jae 0xe99017
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0x10]
mov ecx, dword [ebp + 0x10]
push dword [ebp - 0x1c]
add eax, 0x14
mov eax, dword [eax + 4]
shl ecx, 2
add eax, ecx
mov eax, dword [eax]
mov eax, dword [eax + 4]
push eax
mov ecx, edi
call fcn.00e914ef
mov esi, eax
test esi, esi
je 0xe99825
mov eax, dword [ebp - 0x14]
push dword [edi + eax*4 + 0x34]
mov ecx, edi
push esi
call fcn.00e916c1
push esi
mov dword [ebp - 0x2c], eax
call fcn.00e913c0
cmp dword [ebp - 0x2c], 0
pop ecx
je 0xe99825
push 1
push dword [ebp - 0x2c]
mov ecx, edi
call fcn.00e91570
mov esi, eax
test esi, esi
jl 0xe99006
push 1
push dword [0xeab44c]
mov ecx, edi
call fcn.00e91570
mov esi, eax
test esi, esi
jl 0xe99006
push 1
push dword [0xeab448]
mov ecx, edi
call fcn.00e91570
mov esi, eax
test esi, esi
jl 0xe99006
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0x10]
mov ecx, dword [ebp + 0x10]
mov ebx, dword [ebp - 0x14]
add eax, 0x14
mov eax, dword [eax + 4]
shl ecx, 2
add eax, ecx
mov eax, dword [eax]
add eax, 0xc
mov eax, dword [eax + 4]
shl ebx, 2
add eax, ebx
mov eax, dword [eax]
mov eax, dword [eax + 4]
push 1
push eax
mov ecx, edi
call fcn.00e91570
mov esi, eax
test esi, esi
jl 0xe99006
push 1
push dword [0xeab444]
mov ecx, edi
call fcn.00e91570
mov esi, eax
test esi, esi
jl 0xe99006
push 1
push dword [ebp - 0x2c]
mov ecx, edi
call fcn.00e91570
mov esi, eax
test esi, esi
jl 0xe99006
push 1
push dword [0xeab450]
mov ecx, edi
call fcn.00e91570
mov esi, eax
test esi, esi
jl 0xe99006
push 1
push dword [0xeab448]
mov ecx, edi
call fcn.00e91570
mov esi, eax
test esi, esi
jl 0xe99006
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0x10]
mov ecx, dword [ebp + 0x10]
add eax, 0x14
mov eax, dword [eax + 4]
shl ecx, 2
add eax, ecx
mov eax, dword [eax]
add eax, 0xc
mov eax, dword [eax + 4]
add eax, ebx
mov eax, dword [eax]
mov eax, dword [eax + 8]
push 1
push eax
mov ecx, edi
call fcn.00e91570
mov esi, eax
test esi, esi
jl 0xe99006
push 1
push dword [0xeab444]
mov ecx, edi
call fcn.00e91570
mov esi, eax
push dword [ebp - 0x2c]
call fcn.00e913c0
pop ecx
inc dword [ebp - 0x14]
jmp 0xe98e7a
test esi, esi
jl 0xe9902c
push 1
push dword [0xeab444]
mov ecx, edi
call fcn.00e91570
mov esi, eax
inc dword [ebp + 0x10]
jmp 0xe98e4b
mov eax, dword [ebp - 0x24]
cmp eax, dword [edi + 0x30]
jae 0xe99724
test esi, esi
jl 0xe9982f
imul eax, eax, 0x18
lea ebx, [eax + edi]
cmp dword [ebx + 0x14], 0
jne 0xe99390
inc dword [ebp - 0x24]
xor ebx, ebx
inc ebx
jmp 0xe99034
or dword [ebp - 4], 0xffffffff
jmp 0xe91ca6
test esi, esi
jl 0xe9982f
xor eax, eax
cmp dword [edi + 0x3c], 2
je 0xe9f830
test esi, esi
jl 0xe9982f
lea eax, [edi + eax*4 + 0x34]
push dword [eax]
mov ecx, edi
push dword [0xeab4b0]
mov dword [ebp - 0x30], eax
call fcn.00e916c1
mov dword [ebp - 0x2c], eax
test eax, eax
je 0xe99811
push ebx
push eax
mov ecx, edi
call fcn.00e91570
mov esi, eax
test esi, esi
jl 0xe992a2
push ebx
push dword [0xeab4b8]
mov ecx, edi
call fcn.00e91570
mov esi, eax
test esi, esi
jl 0xe992a2
push ebx
push dword [0xeab444]
mov ecx, edi
call fcn.00e91570
mov esi, eax
test esi, esi
jl 0xe992a2
push ebx
push dword [ebp - 0x2c]
mov ecx, edi
call fcn.00e91570
mov esi, eax
test esi, esi
jl 0xe992a2
push ebx
push dword [0xeab4c0]
mov ecx, edi
call fcn.00e91570
mov esi, eax
push dword [ebp - 0x2c]
call fcn.00e913c0
pop ecx
test esi, esi
jl 0xe9982f
push ebx
push dword [0xeab444]
mov ecx, edi
call fcn.00e91570
mov esi, eax
test esi, esi
jl 0xe9982f
mov eax, dword [ebp - 0x30]
push dword [eax]
mov ecx, edi
push dword [0xeab4b4]
call fcn.00e916c1
mov dword [ebp - 0x2c], eax
test eax, eax
je 0xe9981b
push ebx
push dword [0xeab444]
mov ecx, edi
call fcn.00e91570
mov esi, eax
test esi, esi
jl 0xe99356
push ebx
push dword [ebp - 0x2c]
mov ecx, edi
call fcn.00e91570
mov esi, eax
test esi, esi
jl 0xe99356
push ebx
push dword [0xeab4bc]
mov ecx, edi
call fcn.00e91570
mov esi, eax
test esi, esi
jl 0xe99356
push ebx
push dword [0xeab444]
mov ecx, edi
call fcn.00e91570
mov esi, eax
test esi, esi
jl 0xe99356
push ebx
push dword [ebp - 0x2c]
mov ecx, edi
call fcn.00e91570
mov esi, eax
test esi, esi
jl 0xe99356
push ebx
push dword [0xeab4c4]
mov ecx, edi
call fcn.00e91570
mov esi, eax
push dword [ebp - 0x2c]
call fcn.00e913c0
pop ecx
test esi, esi
jl 0xe9982f
cmp dword [ebp + 0x10], 0xffffffff
je 0xe99724
push ebx
push dword [0xeab444]
mov ecx, edi
call fcn.00e91570
and dword [ebp - 0x24], 0
mov esi, eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x1c], eax
jmp 0xe99034
push 1
push dword [0xeab444]
mov ecx, edi
mov dword [ebp - 4], 7
call fcn.00e91570
mov ebx, dword [ebx + 0x10]
mov esi, eax
mov eax, dword [ebx]
mov dword [ebp - 0x20], eax
jmp 0xe98e2c
test esi, esi
jl 0xe9982f
push ebx
mov ecx, edi
call fcn.00e92667
mov esi, eax
test esi, esi
jl 0xe9982f
push dword [ebp + 8]
and dword [ebp + 0x10], 0
mov dword [ebp - 4], 9
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ebx, eax
add ebx, 6
xor ecx, ecx
push 2
pop edx
mov eax, ebx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00e913e0
pop ecx
mov dword [ebp + 0x10], eax
test eax, eax
je 0xe9fae5
push dword [ebp + 8]
push ebx
push dword [ebp + 0x10]
call fcn.00e921cb
mov esi, eax
test esi, esi
jl 0xe997ae
push 0xe997e0
push ebx
push dword [ebp + 0x10]
call fcn.00e92436
mov esi, eax
test esi, esi
jl 0xe997ae
push dword [ebp + 0x10]
mov ecx, edi
push dword [ebp - 0x18]
call fcn.00e924ed
mov esi, eax
or dword [ebp - 4], 0xffffffff
cmp dword [ebp + 0x10], 0
je 0xe997c1
push dword [ebp + 0x10]
call fcn.00e913c0
pop ecx
test esi, esi
jl 0xe9982f
cmp dword [ebp - 0x18], 0
je 0xe997d4
push dword [ebp - 0x18]
call fcn.00e913c0
pop ecx
mov eax, esi
call fcn.00e91390
ret 0xc
or dword [ebp - 4], 0xffffffff
jmp 0xe99058
mov esi, 0x8007000e
jmp 0xe98c15
mov esi, 0x8007000e
jmp 0xe91b0b
mov esi, 0x8007000e
jmp 0xe91e0c
mov esi, 0x8007000e
jmp 0xe992ab
mov esi, 0x8007000e
jmp 0xe9935f
mov esi, 0x8007000e
jmp 0xe9900f
mov ecx, edi
call fcn.00e926bf
jmp 0xe9fb0b