Function at 0x10af814
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x10de03c]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], ecx
mov ecx, dword [eax + 4]
mov ax, word [ecx + reloc.ADVAPI32.dll_RegDeleteValueW]
push edi
or edi, 0xffffffff
mov word [ebp - 0x30], ax
mov eax, edi
xor edx, edx
div dword [ecx + 0xa4]
mov ebx, dword [esi + 0x38]
sub edi, edx
cmp edi, 0xffffffff
jne 0x10af862
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 4]
or edi, edi
sub edi, dword [eax + 0xa4]
mov eax, dword [esi + 0x44]
cmp edi, eax
jb 0x10af86b
mov edi, eax
and dword [esi + 0x50], 0
push edi
push ebx
push dword [ebp - 0x30]
call fcn.01097324
test ax, ax
je 0x10af895
mov ax, 0xfdff
mov ecx, dword [ebp - 4]
pop edi
pop ebx
call fcn.01075bbb
leave
ret 4
call fcn.01075adf
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 0x30]
call fcn.010977fd
cmp ax, 1
je 0x10af890
mov dx, word [ebp - 0x20]
test dx, dx
je 0x10af8ba
cmp dx, 5
jne 0x10af9c7
mov eax, dword [esi + 0x40]
mov ecx, dword [ebp - 0x24]
cmp ecx, eax
jb 0x10af8c9
mov dword [esi + 0x48], eax
jmp 0x10af8cc
mov dword [esi + 0x48], ecx
push 0xa
push ebx
mov word [esi + 0x58], dx
call fcn.0109dd22
cmp ax, word [ebx + 0x14]
je 0x10af8e4
mov ax, 0xfdf6
jmp 0x10af882
mov ebx, dword [ebx + 8]
push 0x16
push esi
call fcn.010ac48d
jmp 0x10af97a
mov eax, dword [esi + 0x48]
push dword [ebp - 0x34]
sub ebx, eax
push eax
mov eax, dword [esi + 0x38]
add eax, dword [esi + 0x50]
push 1
push eax
call dword [sym.imp.msvcrt.dll_fwrite]
add esp, 0x10
cmp eax, dword [esi + 0x48]
jne 0x10af9ad
cmp word [esi + 0x58], 5
je 0x10af9b6
and dword [esi + 0x50], 0
push edi
push dword [esi + 0x38]
push dword [ebp - 0x30]
call fcn.01097324
test ax, ax
jne 0x10af87e
jmp 0x10af943
call fcn.01075adf
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 0x30]
call fcn.010977fd
cmp ax, 1
je 0x10af93e
mov dx, word [ebp - 0x20]
test dx, dx
je 0x10af964
cmp dx, 5
jne 0x10af9c7
mov eax, dword [esi + 0x40]
mov ecx, dword [ebp - 0x24]
cmp ecx, eax
jb 0x10af973
mov dword [esi + 0x48], eax
jmp 0x10af976
mov dword [esi + 0x48], ecx
mov word [esi + 0x58], dx
cmp ebx, dword [esi + 0x48]
ja 0x10af8f4
push dword [ebp - 0x34]
mov eax, dword [esi + 0x38]
add eax, dword [esi + 0x50]
xor edi, edi
push ebx
inc edi
push edi
push eax
call dword [sym.imp.msvcrt.dll_fwrite]
add esp, 0x10
cmp eax, ebx
jne 0x10af9ad
push dword [ebp - 0x34]
call dword [sym.imp.msvcrt.dll_fflush]
test eax, eax
pop ecx
je 0x10af9d0
mov ax, 0xfde7
jmp 0x10af882
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 4]
or word [eax + reloc.ADVAPI32.dll_RegDeleteValueW], 0x204
jmp 0x10afa23
mov ax, 0xfdf8
jmp 0x10af882
cmp word [esi + 0x58], 5
je 0x10afa0a
push 0
push edi
push dword [ebp - 0x30]
call fcn.0109772a
test ax, ax
jne 0x10af87e
jmp 0x10af9f2
call fcn.01075adf
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 0x30]
call fcn.010977fd
cmp ax, di
je 0x10af9ed
cmp word [ebp - 0x20], 0
jne 0x10af9c7
mov ecx, dword [ebp - 0x38]
mov eax, dword [ecx + 4]
and word [eax + reloc.ADVAPI32.dll_RegDeleteValueW], 0xfefa
mov eax, dword [ecx + 4]
or dword [eax + 0x528], 2
xor ax, ax
jmp 0x10af882