Function at 0x109d352
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x48
lea eax, [ebp - 0x14]
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x40], eax
push esi
lea eax, [ebp - 0x20]
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x48]
push eax
xor esi, esi
push 3
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 8], esi
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x44], 0x101e364
mov dword [ebp - 0x3c], 0x101e350
mov dword [ebp - 0x34], 0x101e2e4
call fcn.0109d28b
mov dword [ebp - 4], eax
cmp eax, esi
je 0x109d3b9
push eax
push 0x27a0197
call fcn.010893e6
jmp 0x109d502
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.0109d1d7
mov dword [ebp - 4], eax
cmp eax, esi
je 0x109d3d8
push eax
push 0x27d0197
jmp 0x109d4e9
lea eax, [ebp - 0x30]
push eax
push dword [ebp - 0xc]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [ebp - 0x14]
mov dword [ebp - 4], eax
cmp eax, esi
je 0x109d3fa
push eax
push 0x2820197
jmp 0x109d4e9
push esi
push esi
push 1
push esi
push esi
push 0x40000000
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp + 0xc], eax
cmp eax, 0xffffffff
jne 0x109d431
call fcn.0108edc3
push eax
push 0x2910197
push dword [ebp + 0x10]
mov dword [ebp - 4], eax
call fcn.01089421
jmp 0x109d4d9
mov ecx, dword [ebp - 0xc]
push ebx
xor eax, eax
add ecx, dword [ebp - 0x30]
push edi
mov edx, eax
adc edx, dword [ebp - 0x2c]
push eax
push dword [ebp - 0xc]
sub ecx, 1
sbb edx, esi
push edx
push ecx
call fcn.010bd540
mov edi, dword [ebp + 0x1c]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x30], esi
jne 0x109d460
cmp dword [ebp - 0x2c], esi
je 0x109d4c4
xor ebx, ebx
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0xc]
push dword [ebp - 8]
push dword [ebp + 8]
call dword [ebp - 0x18]
mov dword [ebp - 4], eax
cmp eax, esi
jne 0x109d518
push esi
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x1c]
push dword [ebp - 8]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x109d525
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x24], eax
jne 0x109d532
sub dword [ebp - 0x30], eax
sbb dword [ebp - 0x2c], esi
add ebx, dword [ebp + 0x18]
xor edx, edx
mov eax, ebx
div dword [ebp - 0x28]
add eax, dword [ebp + 0x14]
mov dword [edi], eax
cmp dword [ebp - 0x30], esi
jne 0x109d462
cmp dword [ebp - 0x2c], esi
jne 0x109d462
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x18]
add eax, ecx
mov dword [edi], eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop ebx
push dword [ebp + 8]
call dword [ebp - 0x20]
cmp eax, esi
je 0x109d4ee
push eax
push 0x2c50197
call fcn.010893e6
cmp dword [ebp - 8], esi
je 0x109d502
push 0x8000
push esi
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_VirtualFree]
cmp dword [ebp - 0x10], esi
pop esi
je 0x109d511
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 4]
leave
ret 0x18
push eax
push 0x29f0197
call fcn.010893e6
jmp 0x109d4ce
call fcn.0108edc3
push eax
push 0x2a60197
jmp 0x109d53d
mov eax, 0x80070026
push eax
push 0x2ab0197
push dword [ebp + 0x10]
mov dword [ebp - 4], eax
call fcn.01089421
jmp 0x109d4ce