Function at 0x1006f1d
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
xor ecx, ecx
push esi
push edi
cmp dword [0x1010190], ecx
je 0x1006f94
mov dword [0x1010190], ecx
cmp dword [0x101667c], ecx
jne 0x1006f49
mov dword [0x101667c], 1
mov eax, dword [sym.imp.msvcrt.dll__iob]
cmp dword [0x1016680], ecx
jne 0x1006f5b
mov dword [0x1016680], eax
cmp dword [0x1016684], ecx
jne 0x1006f6b
add eax, 0x20
mov dword [0x1016684], eax
mov edi, dword [0x1016674]
cmp edi, ecx
jne 0x1006f8d
push 0x4000
push dword [0x1016680]
call fcn.01006c62
mov edi, eax
mov dword [0x1016674], edi
call fcn.01006b83
jmp 0x1006f9a
mov edi, dword [0x1016674]
mov cl, byte [0x1016660]
mov esi, dword [0x1016678]
mov byte [esi], cl
mov eax, dword [edi + 0x1c]
add eax, dword [0x101667c]
mov ebx, esi
movzx ecx, byte [esi]
mov dl, byte [ecx*4 + 0x1010300]
lea ecx, [eax + eax]
cmp word [ecx + 0x1010198], 0
mov byte [ebp - 1], dl
mov dword [ebp - 8], ecx
je 0x1006fdb
mov dword [0x1016670], eax
mov dword [0x1016664], esi
movzx edx, dl
jmp 0x1007005
mov eax, dword [ebp - 8]
movsx eax, word [eax + 0x1010920]
cmp eax, 0xb2
jl 0x1006ffb
mov cl, byte [edx*4 + 0x1010700]
mov byte [ebp - 1], cl
movzx edx, byte [ebp - 1]
lea ecx, [eax + eax]
mov dword [ebp - 8], ecx
movsx ecx, word [ecx + 0x1010778]
add ecx, edx
movsx ecx, word [ecx*2 + 0x1010ff8]
cmp ecx, eax
jne 0x1006fe0
movsx eax, word [eax*2 + 0x1010778]
movzx ecx, byte [ebp - 1]
add eax, ecx
movsx eax, word [eax*2 + 0x1010ac8]
mov ecx, 0x27a
inc esi
cmp word [eax*2 + 0x1010778], cx
jne 0x1006fb3
movsx eax, word [eax*2 + 0x1010198]
test eax, eax
jne 0x1007063
mov eax, dword [0x1016670]
mov esi, dword [0x1016664]
movsx eax, word [eax*2 + 0x1010198]
mov ecx, esi
sub ecx, ebx
mov dword [0x101aa38], ebx
mov dword [0x101aa3c], ecx
mov cl, byte [esi]
mov byte [0x1016660], cl
mov byte [esi], 0
mov dword [0x1016678], esi
mov edx, dword [0x101aa38]
cmp eax, 0x19
ja case.default.0x1007093
jmp dword [eax*4 + 0x1007739]
mov eax, esi
sub eax, edx
dec eax
mov byte [esi], cl
cmp dword [edi + 0x24], 0
mov dword [ebp - 8], eax
jne 0x10070c0
mov eax, dword [edi + 0x10]
mov dword [0x1016668], eax
mov eax, dword [0x1016680]
mov dword [edi], eax
mov dword [edi + 0x24], 1
mov eax, dword [edi + 4]
add eax, dword [0x1016668]
cmp dword [0x1016678], eax
jbe 0x100714f
call fcn.01006cf6
sub eax, 0
je 0x1007182
dec eax
jne 0x1007123
and dword [0x101666c], eax
mov eax, dword [0x101aa38]
mov edi, dword [0x1016674]
mov cl, byte [0x1016660]
mov dword [0x1016678], eax
mov eax, dword [0x101667c]
dec eax
cdq
sub eax, edx
sar eax, 1
add eax, 0x19
jmp 0x1007084
mov eax, dword [0x1016670]
mov byte [esi], cl
mov esi, dword [0x1016664]
jmp 0x1007044
dec eax
jne 0x1006f94
mov edi, dword [0x1016674]
mov esi, dword [edi + 4]
add esi, dword [0x1016668]
mov dword [0x1016678], esi
call fcn.01006a47
mov ebx, dword [0x101aa38]
mov dword [ebp - 8], eax
jmp 0x1007174
mov eax, dword [ebp - 8]
mov ebx, dword [0x101aa38]
lea esi, [ebx + eax]
mov dword [0x1016678], esi
call fcn.01006a47
mov ecx, eax
mov dword [ebp - 8], ecx
call fcn.01006aef
test eax, eax
jne 0x100717c
mov eax, dword [ebp - 8]
jmp 0x1007044
inc esi
jmp 0x1006fb3
mov eax, dword [ebp - 8]
mov ebx, dword [0x101aa38]
lea esi, [ebx + eax]
mov dword [0x1016678], esi
call fcn.01006a47
mov edi, dword [0x1016674]
mov dword [ebp - 8], eax
jmp 0x1006fb3
mov esi, dword [0x101aa3c]
test esi, esi
jle 0x1006fa0
xor eax, eax
cmp byte [esi + edx - 1], 0xa
sete al
mov dword [edi + 0x1c], eax
jmp 0x1006fa0
mov eax, dword [0x101aa3c]
test eax, eax
jle 0x10071e2
xor ecx, ecx
cmp byte [eax + edx - 1], 0xa
sete cl
mov dword [edi + 0x1c], ecx
mov eax, dword [0x101aa3c]
push dword [0x1016684]
push 1
push eax
push dword [0x101aa38]
call dword [sym.imp.msvcrt.dll_fwrite]
add esp, 0x10
jmp 0x1006f94
mov byte [esi], cl
dec esi
mov eax, esi
sub eax, ebx
mov dword [0x101aa3c], eax
mov dword [0x101aa38], ebx
mov al, byte [esi]
mov byte [0x1016660], al
mov byte [esi], 0
mov eax, dword [0x101aa3c]
mov dword [0x1016678], esi
test eax, eax
jle 0x100723d
mov edx, dword [0x101aa38]
xor ecx, ecx
cmp byte [eax + edx - 1], 0xa
sete cl
mov dword [edi + 0x1c], ecx
push 0
push dword [0x101aa38]
call fcn.01005585
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret
mov byte [esi], cl
dec esi
mov eax, esi
sub eax, ebx
mov dword [0x101aa3c], eax
mov dword [0x101aa38], ebx
mov al, byte [esi]
mov byte [0x1016660], al
mov byte [esi], 0
mov eax, dword [0x101aa3c]
mov dword [0x1016678], esi
test eax, eax
jle 0x1007290
mov edx, dword [0x101aa38]
xor ecx, ecx
cmp byte [eax + edx - 1], 0xa
sete cl
mov dword [edi + 0x1c], ecx
push 1
jmp 0x100723f
mov byte [esi], cl
dec esi
mov eax, esi
sub eax, ebx
mov dword [0x101aa3c], eax
mov dword [0x101aa38], ebx
mov al, byte [esi]
mov byte [0x1016660], al
mov byte [esi], 0
mov eax, dword [0x101aa3c]
mov dword [0x1016678], esi
test eax, eax
jle case.0x1007093.25
mov edx, dword [0x101aa38]
xor ecx, ecx
cmp byte [eax + edx - 1], 0xa
sete cl
mov dword [edi + 0x1c], ecx
xor eax, eax
jmp 0x100724d
mov byte [esi], cl
dec esi
mov eax, esi
sub eax, ebx
mov dword [0x101aa3c], eax
mov dword [0x101aa38], ebx
mov al, byte [esi]
mov byte [0x1016660], al
mov byte [esi], 0
mov eax, dword [0x101aa3c]
mov dword [0x1016678], esi
test eax, eax
jle 0x1007317
mov edx, dword [0x101aa38]
xor ecx, ecx
cmp byte [eax + edx - 1], 0xa
sete cl
mov dword [edi + 0x1c], ecx
push 1
push str.A.ROOT_SERVERS.NET.
jmp 0x1007245
mov byte [esi], cl
dec esi
mov eax, esi
sub eax, ebx
mov dword [0x101aa3c], eax
mov dword [0x101aa38], ebx
mov al, byte [esi]
mov byte [0x1016660], al
mov byte [esi], 0
mov eax, dword [0x101aa3c]
mov dword [0x1016678], esi
test eax, eax
jle 0x1007361
mov edx, dword [0x101aa38]
xor ecx, ecx
cmp byte [eax + edx - 1], 0xa
sete cl
mov dword [edi + 0x1c], ecx
push 1
push dword [0x101aa38]
call fcn.01009585
jmp 0x100724a
mov byte [esi], cl
dec esi
mov eax, esi
sub eax, ebx
mov dword [0x101aa3c], eax
mov dword [0x101aa38], ebx
mov al, byte [esi]
mov byte [0x1016660], al
mov byte [esi], 0
mov eax, dword [0x101aa3c]
mov dword [0x1016678], esi
test eax, eax
jle 0x10073b1
mov edx, dword [0x101aa38]
xor ecx, ecx
cmp byte [eax + edx - 1], 0xa
sete cl
mov dword [edi + 0x1c], ecx
push 0
jmp 0x1007363
mov byte [esi], cl
dec esi
mov eax, esi
sub eax, ebx
mov dword [0x101aa3c], eax
mov dword [0x101aa38], ebx
mov al, byte [esi]
mov byte [0x1016660], al
mov byte [esi], 0
mov eax, dword [0x101aa3c]
mov dword [0x1016678], esi
test eax, eax
jle 0x10073f3
mov edx, dword [0x101aa38]
xor ecx, ecx
cmp byte [eax + edx - 1], 0xa
sete cl
mov dword [edi + 0x1c], ecx
push dword [0x101aa38]
call fcn.010094ee
jmp 0x100724a
mov byte [esi], cl
dec esi
mov eax, esi
sub eax, ebx
mov dword [0x101aa3c], eax
mov dword [0x101aa38], ebx
mov al, byte [esi]
mov byte [0x1016660], al
mov byte [esi], 0
mov eax, dword [0x101aa3c]
mov dword [0x1016678], esi
test eax, eax
jle 0x1007441
mov edx, dword [0x101aa38]
xor ecx, ecx
cmp byte [eax + edx - 1], 0xa
sete cl
mov dword [edi + 0x1c], ecx
push 1
push dword [0x101aa38]
call fcn.01009b77
jmp 0x100724a
mov byte [esi], cl
dec esi
mov eax, esi
sub eax, ebx
mov dword [0x101aa3c], eax
mov dword [0x101aa38], ebx
mov al, byte [esi]
mov byte [0x1016660], al
mov byte [esi], 0
mov eax, dword [0x101aa3c]
mov dword [0x1016678], esi
test eax, eax
jle 0x1007491
mov edx, dword [0x101aa38]
xor ecx, ecx
cmp byte [eax + edx - 1], 0xa
sete cl
mov dword [edi + 0x1c], ecx
push 0
jmp 0x1007443
mov byte [esi], cl
dec esi
mov eax, esi
sub eax, ebx
mov dword [0x101aa3c], eax
mov dword [0x101aa38], ebx
mov al, byte [esi]
mov byte [0x1016660], al
mov byte [esi], 0
mov eax, dword [0x101aa3c]
mov dword [0x1016678], esi
test eax, eax
jle 0x10074d3
mov edx, dword [0x101aa38]
xor ecx, ecx
cmp byte [eax + edx - 1], 0xa
sete cl
mov dword [edi + 0x1c], ecx
push 1
push dword [0x101aa38]
call fcn.01009a61
jmp 0x100724a
mov byte [esi], cl
dec esi
mov eax, esi
sub eax, ebx
mov dword [0x101aa3c], eax
mov dword [0x101aa38], ebx
mov al, byte [esi]
mov byte [0x1016660], al
mov byte [esi], 0
mov eax, dword [0x101aa3c]
mov dword [0x1016678], esi
test eax, eax
jle 0x1007523
mov edx, dword [0x101aa38]
xor ecx, ecx
cmp byte [eax + edx - 1], 0xa
sete cl
mov dword [edi + 0x1c], ecx
push 0
jmp 0x10074d5
mov byte [esi], cl
dec esi
mov eax, esi
sub eax, ebx
mov dword [0x101aa3c], eax
mov dword [0x101aa38], ebx
mov al, byte [esi]
mov byte [0x1016660], al
mov byte [esi], 0
mov eax, dword [0x101aa3c]
mov dword [0x1016678], esi
test eax, eax
jle 0x1007565
mov edx, dword [0x101aa38]
xor ecx, ecx
cmp byte [eax + edx - 1], 0xa
sete cl
mov dword [edi + 0x1c], ecx
push dword [0x101aa38]
call fcn.01005de3
jmp 0x100724a
mov byte [esi], cl
dec esi
mov eax, esi
sub eax, ebx
mov dword [0x101aa3c], eax
mov dword [0x101aa38], ebx
mov al, byte [esi]
mov byte [0x1016660], al
mov byte [esi], 0
mov eax, dword [0x101aa3c]
mov dword [0x1016678], esi
test eax, eax
jle 0x10075b3
mov edx, dword [0x101aa38]
xor ecx, ecx
cmp byte [eax + edx - 1], 0xa
sete cl
mov dword [edi + 0x1c], ecx
call fcn.01005dcf
jmp 0x100724a
mov byte [esi], cl
dec esi
mov eax, esi
sub eax, ebx
mov dword [0x101aa3c], eax
mov dword [0x101aa38], ebx
mov al, byte [esi]
mov byte [0x1016660], al
mov byte [esi], 0
mov eax, dword [0x101aa3c]
mov dword [0x1016678], esi
test eax, eax
jle 0x10075fb
mov edx, dword [0x101aa38]
xor ecx, ecx
cmp byte [eax + edx - 1], 0xa
sete cl
mov dword [edi + 0x1c], ecx
push 1
push dword [0x101aa38]
call fcn.010058a3
jmp 0x100724a
mov byte [esi], cl
dec esi
mov eax, esi
sub eax, ebx
mov dword [0x101aa3c], eax
mov dword [0x101aa38], ebx
mov al, byte [esi]
mov byte [0x1016660], al
mov byte [esi], 0
mov eax, dword [0x101aa3c]
mov dword [0x1016678], esi
test eax, eax
jle 0x100764b
mov edx, dword [0x101aa38]
xor ecx, ecx
cmp byte [eax + edx - 1], 0xa
sete cl
mov dword [edi + 0x1c], ecx
push 0
jmp 0x10075fd
mov byte [esi], cl
dec esi
mov eax, esi
sub eax, ebx
mov dword [0x101aa3c], eax
mov dword [0x101aa38], ebx
mov al, byte [esi]
mov byte [0x1016660], al
mov byte [esi], 0
mov eax, dword [0x101aa3c]
mov dword [0x1016678], esi
test eax, eax
jle 0x100768d
mov edx, dword [0x101aa38]
xor ecx, ecx
cmp byte [eax + edx - 1], 0xa
sete cl
mov dword [edi + 0x1c], ecx
push 1
push dword [0x101aa38]
call fcn.010059e9
jmp 0x100724a
mov byte [esi], cl
dec esi
mov eax, esi
sub eax, ebx
mov dword [0x101aa3c], eax
mov dword [0x101aa38], ebx
mov al, byte [esi]
mov byte [0x1016660], al
mov byte [esi], 0
mov eax, dword [0x101aa3c]
mov dword [0x1016678], esi
test eax, eax
jle 0x10076dd
mov edx, dword [0x101aa38]
xor ecx, ecx
cmp byte [eax + edx - 1], 0xa
sete cl
mov dword [edi + 0x1c], ecx
push 0
jmp 0x100768f
mov eax, dword [0x101aa3c]
test eax, eax
jle 0x100724a
xor ecx, ecx
cmp byte [eax + edx - 1], 0xa
sete cl
mov dword [edi + 0x1c], ecx
jmp 0x100724a
mov eax, dword [0x101aa3c]
test eax, eax
jle 0x1007716
xor ecx, ecx
cmp byte [eax + edx - 1], 0xa
sete cl
mov dword [edi + 0x1c], ecx
push dword [0x101aa38]
push 0x1001474
call dword [sym.imp.msvcrt.dll_printf]
pop ecx
pop ecx
jmp 0x100724a
push 0x1001440
call fcn.01006bf6
nop
adc dword [ecx], esi
add edi, edi
jno 0x1007740
add dword [edx + 0x72], edx
add byte [ecx], al
xchg esp, eax
jb 16807752
add dword [edx + esi*2 + 0x72d90100], edx
add byte [ecx], al
and esi, dword [ebx]
add dword [ebx + 115], esi
add byte [ecx], al
mov ch, 0x73
add byte [ecx], al
add esi, dword [eax + eax + 1]
push ebx
je 16807780
add dword [ebp - 0x1afeff8c], edx
je 0x100776c
add dword [edi], esp
jne 0x1007770
add dword [ebp + 0x75], esi
add byte [ecx], al
jne 0x10077ec
add byte [ecx], al
mov ebp, 0xd010075
jbe 16807808
add dword [edi + 0x76], ecx
add byte [ecx], al
lahf
jbe 16807816
add ecx, esp
jbe 0x100778c
add dword [eax], eax
ja 0x1007790
add dword [edi - 0x38feff8f], esp
jno 0x1007798
add dword [edx - 0x2dfeff90], ebx
jb 0x10077a0
add esp, ecx
int3
sar byte [ebp + 0x1b], 0x2b
not dword [esi + 0x68]
mov al, byte [0xff010014]
mov ch, 0xf8
invalid