Function at 0x10063b5
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x434
mov eax, dword [0x1009088]
push esi
xor esi, esi
mov dword [ebp - 4], eax
or eax, 0xffffffff
cmp dword [0x1009d24], esi
mov dword [ebp - 0x434], esi
mov dword [ebp - 0x420], eax
mov dword [ebp - 0x428], eax
mov dword [ebp - 0x424], eax
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x42c], eax
mov dword [0x1009d2c], esi
mov dword [0x1009d30], esi
jne 0x1006412
push esi
push esi
push 0x1009d24
call sub.WINTRUST.dll_CryptCATAdminAcquireContext
cmp dword [0x1009d48], esi
push ebx
push edi
je 0x10066ce
push 0x104
lea eax, [ebp - 0x20c]
push eax
call fcn.010051d2
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x1001444
lea eax, [ebp - 0x20c]
push eax
mov word [ebp - 0x206], si
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileW]
push esi
push 0x80
push 2
push esi
push 1
push 0xc0000000
lea eax, [ebp - 0x20c]
push eax
call edi
cmp eax, 0xffffffff
mov dword [ebp - 0x420], eax
je 0x100648c
push esi
push esi
push esi
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push dword [ebp - 0x420]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push 0x104
lea eax, [ebp - 0x20c]
push eax
call fcn.010051d2
push 0x100142c
lea eax, [ebp - 0x20c]
push eax
mov word [ebp - 0x206], si
call ebx
push esi
push 0x80
push 2
push esi
push 1
push 0xc0000000
lea eax, [ebp - 0x20c]
push eax
call edi
cmp eax, 0xffffffff
mov dword [ebp - 0x428], eax
je 0x10064ec
push esi
push esi
push esi
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push dword [ebp - 0x428]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push 0x104
lea eax, [ebp - 0x20c]
push eax
call fcn.010051d2
push 0x1001414
lea eax, [ebp - 0x20c]
push eax
mov word [ebp - 0x206], si
call ebx
push esi
push 0x80
push 2
push esi
push 1
push 0xc0000000
lea eax, [ebp - 0x20c]
push eax
call edi
cmp eax, 0xffffffff
mov dword [ebp - 0x424], eax
je 0x100654c
push esi
push esi
push esi
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push dword [ebp - 0x424]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push 0x104
lea eax, [ebp - 0x20c]
push eax
call fcn.010051d2
push 0x10013f8
lea eax, [ebp - 0x20c]
push eax
mov word [ebp - 0x206], si
call ebx
push esi
push 0x80
push 2
push esi
push 1
push 0xc0000000
lea eax, [ebp - 0x20c]
push eax
call edi
cmp eax, 0xffffffff
mov dword [ebp - 0x41c], eax
je 0x10065ac
push esi
push esi
push esi
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push dword [ebp - 0x41c]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push 0x104
lea eax, [ebp - 0x20c]
push eax
call fcn.010051d2
push 0x10013dc
lea eax, [ebp - 0x20c]
push eax
mov word [ebp - 0x206], si
call ebx
push esi
push 0x80
push 2
pop ebx
push ebx
push esi
push 1
push 0xc0000000
lea eax, [ebp - 0x20c]
push eax
call edi
mov edi, eax
cmp edi, 0xffffffff
mov dword [ebp - 0x42c], edi
je 0x100660b
push esi
push esi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push edi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
xor eax, eax
cmp dword [ebp - 0x420], 0xffffffff
mov ecx, 0x82
lea edi, [ebp - 0x20c]
rep stosd dword es:[edi], eax
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
mov word [ebp - 0x20c], 0xfeff
je 0x100664a
push esi
lea eax, [ebp - 0x418]
push eax
push ebx
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x420]
call edi
cmp dword [ebp - 0x428], 0xffffffff
je 0x100666b
push esi
lea eax, [ebp - 0x418]
push eax
push ebx
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x428]
call edi
cmp dword [ebp - 0x424], 0xffffffff
je 0x100668c
push esi
lea eax, [ebp - 0x418]
push eax
push ebx
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x424]
call edi
cmp dword [ebp - 0x41c], 0xffffffff
je 0x10066ad
push esi
lea eax, [ebp - 0x418]
push eax
push ebx
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x41c]
call edi
cmp dword [ebp - 0x42c], 0xffffffff
je 0x10066ce
push esi
lea eax, [ebp - 0x418]
push eax
push ebx
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x42c]
call edi
mov edi, dword [0x1009d1c]
cmp edi, esi
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
je 0x1006988
mov dword [ebp - 0x430], esi
cmp dword [0x1009d54], esi
jne 0x1006988
mov eax, dword [ebp - 0x430]
xor edx, edx
div dword [0x1009d28]
cmp eax, dword [ebp - 0x434]
jbe 0x100672f
push esi
push eax
push 0x402
push 0x3f0
push dword [0x10092e0]
mov dword [ebp - 0x434], eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
cmp dword [0x1009d48], esi
je 0x100679a
cmp dword [ebp - 0x420], 0xffffffff
je 0x100679a
push 0x46
lea eax, [ebp - 0x414]
push eax
call fcn.01005095
push dword [edi]
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push esi
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x20c]
push eax
call ebx
shl eax, 1
push eax
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x420]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebp - 0x420]
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
cmp dword [edi + 0x20], esi
jne 0x10067a5
push edi
call fcn.01005f50
cmp dword [edi + 8], esi
jne 0x10067b0
push edi
call fcn.01005ca9
cmp dword [edi + 0x20], esi
je 0x1006917
cmp dword [edi + 0x1c], esi
je 0x100682a
inc dword [0x1009d2c]
cmp dword [0x1009d48], esi
je 0x1006976
cmp dword [ebp - 0x424], 0xffffffff
je 0x1006976
push 0x46
lea eax, [ebp - 0x414]
push eax
call fcn.01005095
push dword [edi]
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push esi
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x20c]
push eax
call ebx
shl eax, 1
push eax
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x424]
jmp 0x1006970
inc dword [0x1009d30]
cmp dword [0x1009d48], esi
je 0x1006976
cmp dword [ebp - 0x41c], 0xffffffff
je 0x1006976
cmp dword [0x1009d4c], esi
je 0x10068cd
push dword [edi + 4]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x20c]
push eax
call ebx
cmp word [ebp + eax*2 - 0x20e], 0x5c
je 0x1006887
push 0x10013d8
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push dword [edi]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push esi
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x20c]
push eax
call ebx
shl eax, 1
push eax
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x41c]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0x34
lea eax, [ebp - 0x20c]
push eax
call fcn.01005095
jmp 0x10068f4
push 0x46
lea eax, [ebp - 0x414]
push eax
call fcn.01005095
push dword [edi]
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push esi
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x20c]
push eax
call ebx
shl eax, 1
push eax
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x41c]
jmp 0x1006970
cmp dword [0x1009d48], esi
je 0x1006976
cmp dword [ebp - 0x42c], 0xffffffff
je 0x1006976
push 0x46
lea eax, [ebp - 0x414]
push eax
call fcn.01005095
push dword [edi]
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push esi
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x20c]
push eax
call ebx
shl eax, 1
push eax
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x42c]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edi, dword [edi + 0x3c]
add dword [ebp - 0x430], 0x64
cmp edi, esi
jne 0x10066e8
cmp dword [0x1009d48], esi
je 0x1006a4d
push 0xd
lea eax, [ebp - 0x20c]
push eax
call fcn.01005095
mov eax, dword [0x1009d28]
mov ecx, dword [0x1009d30]
mov edx, dword [0x1009d2c]
mov edi, eax
sub edi, ecx
sub edi, edx
push edi
push ecx
push edx
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 0x18
cmp dword [ebp - 0x428], 0xffffffff
je 0x1006a12
push esi
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x414]
push eax
call ebx
shl eax, 1
push eax
lea eax, [ebp - 0x414]
push eax
push dword [ebp - 0x428]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebp - 0x428]
call edi
cmp dword [ebp - 0x420], 0xffffffff
je 0x1006a23
push dword [ebp - 0x420]
call edi
cmp dword [ebp - 0x424], 0xffffffff
je 0x1006a34
push dword [ebp - 0x424]
call edi
cmp dword [ebp - 0x41c], 0xffffffff
je 0x1006a4d
push dword [ebp - 0x41c]
call edi
push dword [ebp - 0x42c]
call edi
mov eax, dword [0x1009d24]
cmp eax, esi
pop edi
pop ebx
je 0x1006a65
push esi
push eax
call sub.WINTRUST.dll_CryptCATAdminReleaseContext
mov dword [0x1009d24], esi
cmp dword [0x1009d54], esi
jne 0x1006acc
cmp dword [0x1009d4c], esi
jne 0x1006acc
push esi
push 0x64
push 0x402
push 0x3f0
push dword [0x10092e0]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
cmp dword [0x1009d30], esi
jne 0x1006ab2
cmp dword [0x1009d2c], esi
je 0x1006aae
push 0xa
call fcn.01005107
jmp 0x1006acc
push 9
jmp 0x1006aa7
push esi
push 0x10038a0
push dword [0x10092e0]
push 0x68
push dword [0x10092f0]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
mov ecx, dword [ebp - 4]
xor eax, eax
inc eax
pop esi
call fcn.01006e99
leave
ret