Function at 0x1000e200
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push esi
xor esi, esi
cmp ebx, esi
push edi
jne 0x1000e216
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
mov eax, dword [0x10023c30]
cmp ebx, eax
jle 0x1000e221
mov ebx, eax
cmp dword [0x10026fa4], esi
je 0x1000e244
mov eax, dword [ebp + 8]
mov ecx, dword [0x10023c20]
push ebx
push eax
push ecx
call fcn.10012baf
add esp, 0xc
pop edi
mov eax, ebx
pop esi
pop ebx
pop ebp
ret
cmp dword [0x10026fa8], esi
je 0x1000e285
call fcn.1000e100
test eax, eax
je 0x1000e25f
cmp ebx, 4
jle 0x1000e25f
mov ebx, 4
mov edx, dword [ebp + 8]
mov eax, dword [0x10031204]
push 0x10033d94
push ebx
push edx
push eax
call sub.WINSPOOL.DRV_WritePrinter
mov ecx, dword [0x10033d94]
pop edi
neg eax
sbb eax, eax
pop esi
and eax, ecx
pop ebx
pop ebp
ret
cmp dword [0x10026fac], esi
je 0x1000e420
cmp dword [0x10026fc8], esi
je 0x1000e2c5
mov edx, dword [0x10031244]
lea ecx, [ebp + 0xc]
push esi
push ecx
push 0x100348a0
push edx
mov dword [ebp + 0xc], esi
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
cmp dword [ebp + 0xc], esi
jne 0x1000e2bf
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
mov dword [0x10026fc8], esi
mov eax, dword [0x10026fcc]
mov edi, dword [0x10031294]
mov ecx, ebx
cmp eax, esi
mov esi, dword [ebp + 8]
mov eax, ecx
je 0x1000e3df
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
test ebx, ebx
mov edi, ebx
jle 0x1000e3cc
cmp edi, 0x1000
mov dword [ebp + 0xc], 0
push 0x100348a0
jle 0x1000e3ad
mov edx, dword [0x10031294]
mov eax, dword [0x10031244]
lea ecx, [ebp + 0xc]
sub edx, edi
push ecx
add edx, ebx
push 0x1000
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0x10031230
sub edi, 0x1000
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
xor esi, esi
mov si, word [0x1003123e]
mov edx, dword [0x10031244]
lea ecx, [ebp + 0xc]
push 0
push ecx
push 0x100348a0
push edx
mov dword [ebp + 0xc], 0
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
mov eax, dword [ebp + 0xc]
test eax, eax
jne 0x1000e392
push 0x10031230
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
xor eax, eax
mov ax, word [0x1003123e]
cmp eax, esi
jl 0x1000e38b
sub eax, esi
cmp eax, 0xa
jle 0x1000e347
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x1000e3cc
test edi, edi
jg 0x1000e2f5
mov eax, ebx
mov dword [0x10026fc8], 1
sub eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret
mov ecx, dword [0x10031294]
mov edx, dword [0x10031244]
lea eax, [ebp + 0xc]
sub ecx, edi
push eax
add ecx, ebx
push edi
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
xor edi, edi
mov eax, ebx
mov dword [0x10026fc8], 1
sub eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 0x100348a0
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edx, dword [0x10031294]
mov eax, dword [0x10031244]
lea ecx, [ebp + 0xc]
mov dword [ebp + 0xc], 0
push ecx
push ebx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop edi
mov eax, ebx
pop esi
mov dword [0x10026fc8], 1
pop ebx
pop ebp
ret
cmp dword [0x10026fbc], esi
je 0x1000e43a
mov ecx, dword [ebp + 8]
push ebx
push ecx
call fcn.1000e4e0
add esp, 8
pop edi
pop esi
pop ebx
pop ebp
ret
cmp dword [0x10023c38], 3
jne 0x1000e455
mov edx, dword [ebp + 8]
push edx
push ebx
call fcn.1000eb60
add esp, 8
pop edi
pop esi
pop ebx
pop ebp
ret
cmp dword [0x10026fb8], esi
je 0x1000e489
cmp dword [0x10026fb0], esi
je 0x1000e477
mov eax, dword [ebp + 8]
push eax
push ebx
call fcn.1000eb20
add esp, 8
pop edi
pop esi
pop ebx
pop ebp
ret
mov ecx, dword [ebp + 8]
push ecx
push ebx
call fcn.1000ea50
add esp, 8
pop edi
pop esi
pop ebx
pop ebp
ret
cmp ebx, esi
jle 0x1000e23d
mov edi, dword [ebp + 8]
mov dx, word [0x10023c2c]
mov al, byte [edi]
out dx, al
xor ecx, ecx
mov edx, dword [0x10023c2c]
inc edx
in al, dx
test al, 0x80
jne 0x1000e4b7
cmp ecx, dword [0x10023c24]
jg 0x1000e4d5
inc ecx
jmp 0x1000e4a0
mov eax, dword [0x10023c2c]
inc edi
inc esi
lea ecx, [eax + 2]
mov al, 0xd
mov dx, cx
cmp esi, ebx
out dx, al
mov al, 0xc
out dx, al
jl 0x1000e494
pop edi
mov eax, ebx
pop esi
pop ebx
pop ebp
ret
mov eax, esi
pop edi
pop esi
pop ebx
pop ebp
ret