Function at 0x10007dc0
Capabilities:
Write file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x90
mov eax, dword [0x10022040]
xor eax, esp
mov dword [esp + 0x8c], eax
cmp dword [ecx + 0x10], 0
sete byte [esp + 3]
mov dword [esp + 0x64], ecx
lea eax, [ecx + 0x14]
mov dword [esp + 0x5c], eax
mov dword [esp + 0x60], edx
lea eax, [edx + 4]
mov dword [esp + 0x58], eax
mov ebx, 0x4fbd72e0
lea ebp, [esp + 0x74]
lea edi, [esp + 0x70]
jmp 0x10007e20
push dword [esp + 0x34]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x38]
mov ebx, 0x6266c34f
nop dword [eax]
cmp ebx, 0x382e1fd5
jg 0x10007ea0
cmp ebx, 0xba617bf0
jle 0x10007f10
cmp ebx, 0x1f5d6af2
jg 0x10007fae
cmp ebx, 0xba617bf1
je 0x10008059
cmp ebx, 0x75f0bde
jne 0x10007e20
mov dword [esp + 0x68], esi
mov esi, edi
mov eax, dword [esp + 0xc]
mov eax, dword [eax - 4]
mov dword [esp + 0x54], eax
mov eax, dword [esp + 0xc]
lea edx, [eax - 4]
mov ecx, dword [esp + 0x54]
mov ebx, 3
sub ebx, eax
and ebx, ecx
add ebx, ecx
not ecx
or ecx, edx
add ecx, ebx
neg ecx
add ecx, eax
add ecx, 0xfffffffb
mov ebx, 0x609b7546
cmp ecx, 0x20
jb 0x10007e97
mov ebx, 0xb0340fe0
mov edi, esi
mov esi, dword [esp + 0x68]
jmp 0x10007e20
cmp ebx, 0x4fbd72df
jle 0x10007f70
cmp ebx, 0x6266c34e
jg 0x10007fe0
cmp ebx, 0x4fbd72e0
je 0x1000808c
cmp ebx, 0x609b7546
jne 0x10007e20
mov eax, dword [esp + 8]
mov ecx, eax
and ecx, 0x24
mov edx, eax
or edx, 0xffffffdb
add edx, ecx
mov ecx, eax
sub ecx, edx
add eax, eax
or eax, 0xffffffb6
add eax, ecx
add eax, 0x49
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x54]
mov dword [esp + 0x14], eax
mov ebx, 0x29599383
jmp 0x10007e20
cmp ebx, 0x9d07015e
jg 0x1000801d
cmp ebx, 0x85bc52b1
je 0x100080a6
cmp ebx, 0x8c9389c1
jne 0x10007e20
mov dword [esp + 4], ebp
lea eax, [esp + 0x84]
mov dword [esp + 0x6c], eax
lea eax, [esp + 0x88]
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], ebp
mov dword [esp + 0x1c], 0
mov ebx, 0xba617bf1
mov esi, dword [esp + 0x3c]
jmp 0x10007e20
cmp ebx, 0x382e1fd6
je 0x100080d4
cmp ebx, 0x3f95ae65
je 0x10007e06
cmp ebx, 0x48ed43e7
jne 0x10007e20
mov eax, dword [esp + 0x2c]
cmp dword [eax], 0x10
mov eax, dword [esp + 0x30]
jae 0x10008155
mov eax, dword [esp + 0x28]
jmp 0x10008157
cmp ebx, 0x1f5d6af3
je 0x1000811d
cmp ebx, 0x29599383
jne 0x10007e20
push dword [esp + 0x18]
push dword [esp + 0x18]
call fcn.1000fafc
add esp, 8
mov ebx, 0x9d07015f
jmp 0x10007e20
cmp ebx, 0x6f1a5338
jne 0x10008237
mov eax, dword [esp + 0x60]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x20]
mov ecx, dword [eax]
mov eax, dword [esp + 0x58]
mov dword [esp + 0x24], eax
mov edx, dword [esp + 0x24]
mov ebx, 0x6266c34f
cmp ecx, dword [edx]
je 0x10007e20
mov ebx, 0x85bc52b1
jmp 0x10007e20
cmp ebx, 0x9d07015f
jne 0x10008245
mov eax, dword [esp + 4]
mov esi, dword [esp + 0x4c]
add esi, 0x18
mov ebx, 0x3f95ae65
cmp esi, dword [esp + 0x40]
mov ecx, dword [esp + 0x50]
mov ecx, dword [esp + 0x50]
mov dword [esp + 0x1c], ecx
je 0x10007e20
mov ebx, 0xba617bf1
jmp 0x10007e20
mov dword [esp + 0x4c], esi
mov eax, dword [esp + 4]
mov edx, dword [esp + 0x4c]
mov ecx, ebp
call fcn.1000e520
mov eax, dword [esp + 0x6c]
mov eax, dword [eax]
mov ecx, dword [esp + 0x44]
cmp dword [ecx], 0x10
mov ecx, dword [esp + 0x48]
jae 0x1000819b
mov ecx, dword [esp + 4]
jmp 0x1000819d
cmp byte [esp + 3], 0
mov ebx, 0x6266c34f
jne 0x10007e20
mov ebx, 0x6f1a5338
jmp 0x10007e20
mov ecx, dword [esp + 0x64]
mov dword [esp + 0x28], ecx
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x2c]
cmp dword [eax], 0x10
mov dword [esp + 0x30], ecx
mov eax, dword [esp + 0x30]
jae 0x100081f1
mov eax, dword [esp + 0x28]
jmp 0x100081f3
mov eax, dword [esp + 0x10]
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], edi
mov eax, dword [esp + 0x38]
mov dword [esp + 0x70], 0
mov eax, dword [esp + 0x20]
mov eax, dword [eax]
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x24]
mov eax, dword [eax]
mov dword [esp + 0x40], eax
mov ecx, dword [esp + 0x3c]
mov ebx, 0x3f95ae65
cmp ecx, dword [esp + 0x40]
je 0x10007e20
mov ebx, 0x8c9389c1
jmp 0x10007e20
mov eax, dword [esp + 0x48]
mov eax, dword [eax]
mov dword [esp + 0xc], eax
mov ecx, dword [esp + 8]
add ecx, 1
mov eax, dword [esp + 0xc]
mov dword [esp + 0x14], eax
mov ebx, 0x75f0bde
mov dword [esp + 0x18], ecx
cmp ecx, 0x1000
jae 0x10007e20
mov ebx, 0x29599383
jmp 0x10007e20
mov eax, dword [eax]
sub esp, 0x1c
movaps xmm0, xmmword [0x1001e950]
movups xmmword [esp + 4], xmm0
mov dword [esp], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x80
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, 0x6266c34f
mov dword [esp + 0x10], eax
cmp eax, 0xffffffff
je 0x10007e20
mov ebx, 0x382e1fd6
jmp 0x10007e20
mov ecx, dword [ecx]
push 0
push edi
push eax
push ecx
push dword [esp + 0x44]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 0x70]
mov edx, dword [esp + 0x1c]
mov ecx, edx
not ecx
and ecx, eax
add ecx, eax
add ecx, edx
not eax
or eax, edx
add eax, ecx
add eax, 1
mov dword [esp + 0x50], eax
mov eax, dword [esp + 0x44]
mov eax, dword [eax]
mov dword [esp + 8], eax
mov ecx, dword [esp + 8]
mov ebx, 0x1f5d6af3
cmp ecx, 0x10
jae 0x10007e20
mov ebx, 0x9d07015f
jmp 0x10007e20
mov eax, dword [eax]
sub esp, 0x1c
movaps xmm0, xmmword [0x1001e960]
movups xmmword [esp + 4], xmm0
mov dword [esp], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x80
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, 0x48ed43e7
mov dword [esp + 0x10], eax
cmp eax, 0xffffffff
je 0x10007e20
mov ebx, 0x382e1fd6
jmp 0x10007e20
cmp ebx, 0x6266c34f
jne 0x10007e20
jmp 0x10008256
cmp ebx, 0xb0340fe0
jne 0x10007e20
call fcn.10011abd
mov ecx, dword [esp + 0x8c]
xor ecx, esp
call fcn.1001000a
add esp, 0x90
pop esi
pop edi
pop ebx
pop ebp
ret