Function at 0x1001de40
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x6a0
mov eax, dword [0x10063790]
xor eax, esp
mov dword [esp + 0x69c], eax
push esi
push edi
push 0x206
lea eax, [esp + 0x296]
push 0
push eax
mov esi, ecx
mov dword [esp + 0x18], 0
mov dword [esp + 0x24], 0xfeff
mov word [esp + 0x29c], 0
call fcn.1003d360
push 0x206
lea ecx, [esp + 0x4aa]
push 0
push ecx
mov word [esp + 0x4b0], 0
call fcn.1003d360
push 0
call fcn.1004055f
mov dword [esp + 0x2c], eax
mov eax, dword [0x10065ef4]
add esp, 0x1c
test eax, eax
jne 0x1001e15e
mov eax, esi
mov edx, 0x104
mov ecx, 0x10065acc
call fcn.10002060
lea edx, [esp + 0x40]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
je 0x1001def5
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov edi, 3
jmp 0x1001defa
mov edi, 1
push 0
push 0
push edi
push 0
push 3
push 0xc0000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [0x10065edc], eax
je 0x1001e14f
cmp edi, 3
jne 0x1001df34
push 2
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x1001e14a
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea ecx, [esp + 0x10]
push ecx
push 2
lea edx, [esp + 0x24]
push edx
push eax
call edi
lea eax, [esp + 0x290]
mov esi, str._________________________________________________________________________________r_n
mov ecx, eax
sub esi, ecx
mov edx, 0x104
mov dword [esp + 0x14], esi
lea ecx, [edx + 0x7ffffefa]
test ecx, ecx
je 0x1001df84
movzx ecx, word [esi + eax]
test cx, cx
je 0x1001df84
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x1001df64
jmp 0x1001df88
test edx, edx
jne 0x1001df8b
sub eax, 2
mov word [eax], 0
lea eax, [esp + 0x290]
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1001dfa0
sub eax, edx
push 0
sar eax, 1
lea edx, [esp + 0x10]
push edx
mov edx, dword [0x10065edc]
add eax, eax
push eax
lea ecx, [esp + 0x29c]
push ecx
push edx
call edi
push 0
call fcn.1004055f
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x24]
push ecx
call fcn.10040598
lea edx, [esp + 0x28]
push edx
push str._A__Y__m__d__at__H:_M:_S
lea eax, [esp + 0x4ac]
push 0x104
push eax
call fcn.1003eed2
lea ecx, [esp + 0x4b4]
push ecx
push str.Log_started__s__r_n
lea edx, [esp + 0x2b4]
push 0x800
push edx
call fcn.10003980
lea eax, [esp + 0x2bc]
add esp, 0x2c
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1001e030
sub eax, edx
push 0
sar eax, 1
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [0x10065edc]
lea edx, [eax + eax]
push edx
lea eax, [esp + 0x29c]
push eax
push ecx
call edi
lea eax, [esp + 0x290]
mov edx, 0x1005ba58
mov ecx, eax
mov esi, 0x104
sub edx, ecx
lea ecx, [esi + 0x7ffffefa]
test ecx, ecx
je 0x1001e090
movzx ecx, word [edx + eax]
test cx, cx
je 0x1001e090
mov word [eax], cx
add eax, 2
sub esi, 1
jne 0x1001e070
jmp 0x1001e094
test esi, esi
jne 0x1001e097
sub eax, 2
mov word [eax], 0
lea eax, [esp + 0x290]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1001e0a6
sub eax, edx
push 0
sar eax, 1
lea edx, [esp + 0x10]
push edx
mov edx, dword [0x10065edc]
add eax, eax
push eax
lea ecx, [esp + 0x29c]
push ecx
push edx
call edi
mov edx, 0x104
lea eax, [esp + 0x290]
lea esp, [esp]
lea ecx, [edx + 0x7ffffefa]
test ecx, ecx
je 0x1001e104
mov ecx, dword [esp + 0x14]
movzx ecx, word [ecx + eax]
test cx, cx
je 0x1001e104
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x1001e0e0
jmp 0x1001e108
test edx, edx
jne 0x1001e10b
sub eax, 2
mov word [eax], 0
lea eax, [esp + 0x290]
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1001e120
sub eax, edx
push 0
sar eax, 1
lea edx, [esp + 0x10]
push edx
mov edx, dword [0x10065edc]
add eax, eax
push eax
lea ecx, [esp + 0x29c]
push ecx
push edx
call edi
mov eax, dword [0x10065edc]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
mov dword [0x10065ef4], eax
mov ecx, dword [esp + 0x6a4]
pop edi
pop esi
xor ecx, esp
call fcn.1003c13d
mov esp, ebp
pop ebp
ret