Function at 0x1000b00c
Capabilities:
Write file on windows

Disassembly:
mov eax, 0x29d8
call sub.ntdll.dll__chkstk
push ebx
mov ebx, ecx
mov byte [esp + 0xf], dl
push ebp
xor edx, edx
mov dword [esp + 0x18], 0x2000
push esi
mov eax, dword [ebx]
mov esi, edx
push edi
mov dword [esp + 0x14], edx
or edi, 0xffffffff
mov dword [esp + 0x1c], edx
mov eax, dword [eax + 0x328]
test eax, eax
je 0x1000a8aa
push ebx
call eax
pop ecx
cmp eax, 1
je 0x1000a8a8
mov ecx, ebx
call fcn.1000f51d
xor eax, eax
jmp 0x1000aea6
xor edx, edx
movzx eax, byte [esp + 0x1b]
dec eax
cmp eax, 9
ja case.0x1000a8b9.2
jmp dword [eax*4 + 0x1000b28e]
movzx eax, byte [esp + 0x29ec]
sub eax, 1
je 0x1000a988
sub eax, 1
jne case.0x1000a8b9.2
lea eax, [esp + 0x2d0]
push eax
push 0x100
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
mov dword [esp + 0x20], eax
lea ebp, [eax - 3]
test ebp, ebp
je 0x1000a96a
lea edi, [esp + 0x28]
lea eax, [esp + 0x2d0]
sub edi, eax
lea ecx, [esp + esi + 0x2d0]
mov al, byte [ecx]
mov byte [edi + ecx], al
inc ecx
test al, al
jne 0x1000a90c
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
dec eax
sub eax, 1
je 0x1000a954
sub eax, 1
je 0x1000a94a
sub eax, 1
je 0x1000a940
sub eax, 1
jne 0x1000a95c
mov byte [esp + esi + 0x2d2], 0x63
jmp 0x1000a95c
mov byte [esp + esi + 0x2d2], 0x6e
jmp 0x1000a95c
mov byte [esp + esi + 0x2d2], 0x6c
jmp 0x1000a95c
mov byte [esp + esi + 0x2d2], 0x66
add esi, 4
sub edi, 4
cmp esi, ebp
jb 0x1000a905
mov eax, dword [esp + 0x20]
lea ecx, [esp + 0x2d0]
mov dl, 2
push ecx
push eax
push 0
push 3
mov ecx, ebx
call fcn.1000a2a3
add esp, 0x10
jmp 0x1000aea6
push 1
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov edx, dword [esp + 0x29f4]
mov ecx, ebx
call fcn.1000a644
mov esi, eax
test esi, esi
je 0x1000a8a1
mov edx, dword [esp + 0x29f4]
mov ecx, ebx
push esi
call fcn.1000a322
pop ecx
mov dword [esp + 0x14], eax
mov ecx, esi
call fcn.1001ce4a
mov eax, dword [esp + 0x14]
jmp 0x1000aea6
mov edx, dword [esp + 0x29f4]
mov ecx, ebx
call fcn.1000a644
mov ebp, eax
test ebp, ebp
je 0x1000a8a1
lea edx, [esp + 0x48]
mov ecx, ebp
sub edx, ebp
mov al, byte [ecx]
mov byte [edx + ecx], al
inc ecx
test al, al
jne 0x1000a9ec
lea edx, [esp + 0x48]
mov esi, 0x10045b9c
xor ecx, ecx
mov eax, dword [edx + ecx*4]
cmp eax, dword [esi + ecx*4]
jne 0x1000aa14
inc ecx
cmp ecx, 3
jne 0x1000aa01
push 5
pop esi
jmp 0x1000aa16
mov esi, edi
push 7
lea eax, [esp + 0x4c]
push 0x10045b94
push eax
call sub.ntdll.dll_memcmp
add esp, 0xc
xor ecx, ecx
test eax, eax
lea eax, [esp + 0x48]
cmove esi, ecx
push 0x11
push 0x10045b80
push eax
call sub.ntdll.dll_memcmp
add esp, 0xc
test eax, eax
jne 0x1000aa4e
push 0x13
pop esi
jmp 0x1000aa52
cmp esi, edi
je 0x1000aabe
push 0
push esi
lea eax, [esp + 0x7e8]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea eax, [esp + 0x48]
push 0x5c
push eax
call dword [sym.imp.ntdll.dll_strchr]
mov edx, eax
pop ecx
pop ecx
test edx, edx
je 0x1000aaac
cmp byte [edx + 1], 0
je 0x1000aaac
mov esi, edx
mov al, byte [edx]
inc edx
test al, al
jne 0x1000aa82
lea edi, [esp + 0x7e0]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x1000aa93
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
or edi, 0xffffffff
xor ecx, ecx
mov al, byte [esp + ecx + 0x7e0]
mov byte [esp + ecx + 0x48], al
inc ecx
test al, al
jne 0x1000aaae
lea ecx, [esp + 0x48]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1000aac5
sub ecx, edx
lea eax, [ecx + 1]
push eax
lea ecx, [esp + 0x3d4]
push ecx
push eax
lea eax, [esp + 0x54]
push eax
push 0
push 0x4e3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea eax, [esp + 0x3d0]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, edi
jne 0x1000acb5
lea ecx, [esp + 0x3d0]
call fcn.1000a83c
mov dword [esp + 0x20], eax
cmp word [eax], 0x5b
jne 0x1000acb5
lea ecx, [esp + 0x3d0]
sub eax, ecx
sar eax, 1
mov dword [esp + 0x2c], eax
lea esi, [eax + eax]
mov eax, ecx
push esi
push eax
lea eax, [esp + 0x5e0]
push eax
call fcn.10027640
xor eax, eax
add esp, 0xc
mov word [esp + esi + 0x5d8], ax
mov eax, dword [esp + 0x20]
add eax, 4
push eax
lea eax, [esp + 0x5dc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [esp + 0x5d8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
xor ecx, ecx
mov word [esp + eax*2 + 0x5d4], cx
lea eax, [esp + 0x5d8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, edi
je 0x1000acb5
test al, 0x10
je 0x1000acb5
and dword [esp + 0x34], 0
lea eax, [esp + 0x20]
mov dword [esp + 0x30], eax
lea eax, [esp + 0x7e0]
push eax
push 0x103
mov dword [esp + 0x28], 0x2e002a
mov dword [esp + 0x2c], 0x2a
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [esp + 0x3d0]
push eax
push 0
push 0x10045b7c
lea eax, [esp + 0x7ec]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
lea eax, [esp + 0x3d0]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
sub esp, 0x14
lea eax, [esp + 0x44]
lea edx, [esp + 0x5ec]
lea ecx, [esp + 0x3e4]
push eax
call fcn.10022bd0
add esp, 0x18
mov dword [ebx + 0x7650], 1
lea eax, [esp + 0x3d0]
push eax
lea eax, [ebx + 0x7654]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov esi, dword [esp + 0x2c]
lea eax, [esp + 0x48]
push esi
push eax
lea eax, [esp + 0x1d0]
push eax
call fcn.10027640
add esp, 0xc
mov byte [esp + esi + 0x1c8], 0
lea eax, [esp + 0x4a]
add eax, esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
push eax
lea eax, [esp + 0x1cc]
push eax
call esi
lea eax, [esp + 0x1c8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea ecx, [esp + 0x1c8]
mov edx, ecx
mov byte [eax + ecx - 2], 0
lea ecx, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x1000ac89
sub edx, ecx
mov ecx, ebp
add edx, 5
call fcn.1001cde6
mov ebp, eax
lea eax, [esp + 0x1c8]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str..zip
push ebp
call esi
xor eax, eax
push eax
push eax
push 3
push eax
push eax
push bind
lea eax, [esp + 0x3e8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ecx, eax
mov dword [ebx + 0x7638], ecx
cmp ecx, edi
je 0x1000ade9
lea eax, [esp + 0x154]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
je 0x1000add6
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0x15c]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
movzx eax, word [esp + 0x42]
push eax
movzx eax, word [esp + 0x44]
push eax
movzx eax, word [esp + 0x40]
push eax
movzx eax, word [esp + 0x4a]
push eax
movzx eax, word [esp + 0x4a]
push eax
lea eax, [esp + 0x19c]
push str._02d__02d__04d__02d:_02d
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
lea esi, [esp + 0x1a4]
add esp, 0x1c
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x1000ad48
push ebp
sub esi, ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, ebp
lea edx, [eax + 2]
add edx, esi
call fcn.1001cde6
mov ebp, eax
test ebp, ebp
je 0x1000a8a1
mov edx, 0x10045b54
mov esi, edx
mov al, byte [edx]
inc edx
test al, al
jne 0x1000ad75
sub edx, esi
lea edi, [ebp - 1]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x1000ad81
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [esp + 0x188]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, edx
mov al, byte [edx]
inc edx
test al, al
jne 0x1000ada0
sub edx, esi
lea edi, [ebp - 1]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x1000adac
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [ebx + 0x7638]
mov edx, eax
or edi, 0xffffffff
jmp 0x1000adf0
mov ecx, dword [ebx + 0x7638]
call fcn.1001cef9
mov dword [ebx + 0x7638], edi
mov ecx, edi
mov edx, dword [esp + 0x29f4]
xor eax, eax
cmp dword [esp + 0x29f0], 1
push ebp
sete al
cmp ecx, edi
mov dword [ebx + 0x763c], eax
mov ecx, ebx
mov eax, dword [esp + 0x17c]
push edx
cmove eax, edi
mov dl, 4
push eax
push 0
call fcn.1000a2a3
add esp, 0x10
mov dword [esp + 0x14], eax
cmp dword [ebx + 0x7638], edi
jne 0x1000ae37
test ebp, ebp
je 0x1000aea6
mov ecx, ebp
jmp 0x1000a9be
mov eax, dword [esp + 0x178]
lea edx, [esp + 0x1c]
and dword [ebx + 0x7648], 0
mov ecx, ebx
and dword [ebx + 0x764c], 0
mov dword [ebx + 0x7640], eax
shr eax, 0xd
push 4
mov dword [ebx + 0x7644], eax
call fcn.1000f83c
pop ecx
test eax, eax
jns 0x1000ae98
lfence
cmp dword [ebx + 0x7650], 0
je 0x1000ae84
lea eax, [esp + 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, ebx
call fcn.1000f51d
test ebp, ebp
je 0x1000a8a1
jmp 0x1000af49
test ebp, ebp
je case.0x1000a8b9.2
mov ecx, ebp
call fcn.1001ce4a
xor eax, eax
inc eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x29d8
ret
cmp dword [esp + 0x29f0], edi
jne 0x1000aecd
mov ecx, dword [ebx + 0x7638]
call fcn.1001cef9
mov dword [ebx + 0x7638], edi
jmp case.0x1000a8b9.2
mov ecx, ebx
mov dword [ebx + 0x764c], 1
call fcn.1000a6b4
jmp 0x1000aea6
mov esi, dword [esp + 0x29f4]
mov ecx, ebx
mov edx, esi
call fcn.1000a644
mov ebp, eax
test ebp, ebp
je 0x1000a8a1
mov al, byte [ebp]
mov edx, ebp
test al, al
je 0x1000af15
mov cl, al
mov al, cl
cmp cl, 0x2c
je 0x1000af15
inc edx
mov al, byte [edx]
mov cl, al
test al, al
jne 0x1000af05
xor ecx, ecx
test al, al
cmovne ecx, edx
test ecx, ecx
je 0x1000af25
mov byte [ecx], 0
jmp 0x1000af2d
mov byte [esp + 0x7e0], 0
push 4
lea edx, [esp + 0x20]
mov ecx, ebx
call fcn.1000f7ee
pop ecx
lfence
test eax, eax
jg 0x1000af58
mov ecx, ebx
call fcn.1000f51d
mov ecx, ebp
lfence
call fcn.1001ce4a
jmp 0x1000a8a1
mov ecx, dword [esp + 0x1c]
mov edx, ecx
and edx, 0xff0000
mov eax, ecx
shr eax, 0x10
or edx, eax
mov eax, ecx
and eax, 0xff00
shl ecx, 0x10
or eax, ecx
shr edx, 8
shl eax, 8
mov ecx, ebp
or edx, eax
mov dword [esp + 0x1c], edx
lea edx, [esp + 0x48]
sub edx, ebp
mov al, byte [ecx]
mov byte [edx + ecx], al
inc ecx
test al, al
jne 0x1000af8b
xor eax, eax
push eax
push eax
push 2
push eax
push eax
push 0x40000000
lea eax, [esp + 0x60]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
xor ecx, ecx
mov dword [ebx + 0x7638], eax
cmp eax, edi
mov dl, 9
push ebp
setne cl
dec ecx
push esi
push ecx
push 0
mov ecx, ebx
call fcn.1000a2a3
add esp, 0x10
mov dword [esp + 0x14], eax
cmp dword [ebx + 0x7638], edi
jne 0x1000afe0
lfence
jmp 0x1000ae30
mov eax, dword [esp + 0x29f0]
mov dword [ebx + 0x7640], eax
shr eax, 0xd
and dword [ebx + 0x764c], 0
mov dword [ebx + 0x7644], eax
mov dword [ebx + 0x7648], 1
jmp 0x1000ae9c
mov edx, dword [esp + 0x29f4]
mov ecx, ebx
call fcn.1000a644
mov ebp, eax
test ebp, ebp
je 0x1000a8a1
mov eax, dword [ebx + 0x7638]
cmp eax, edi
je 0x1000ae9c
cmp dword [esp + 0x29f0], esi
jne 0x1000b04d
push 0
lea ecx, [esp + 0x18]
push ecx
push dword [esp + 0x29fc]
push ebp
push eax
jmp 0x1000b080
push dword [esp + 0x29f4]
lea edx, [esp + 0x24]
push ebp
lea ecx, [esp + 0x9f0]
call fcn.1001d0bb
pop ecx
pop ecx
push 0
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x28]
lea eax, [esp + 0x9f4]
push eax
push dword [ebx + 0x7638]
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [esp + 0x14], edi
jne 0x1000ae9c
mov ecx, dword [ebx + 0x7638]
call fcn.1001cef9
and dword [ebx + 0x764c], esi
and dword [ebx + 0x7648], esi
mov dword [ebx + 0x7638], edi
jmp 0x1000ae9c
mov ecx, dword [ebx + 0x7638]
cmp ecx, edi
je 0x1000b0c1
call fcn.1001cef9
and dword [ebx + 0x764c], esi
and dword [ebx + 0x7648], esi
mov dword [ebx + 0x7638], edi
jmp case.0x1000a8b9.2
mov ecx, dword [ebx + 0x7638]
cmp ecx, edi
jne 0x1000b0bc
cmp byte [esp + 0x29ec], 0
jne 0x1000b0fb
push 0x10046d1e
push edx
push edi
push edx
mov dl, 7
jmp 0x1000a979
mov eax, dword [ebx]
mov eax, dword [eax + 0x328]
test eax, eax
je 0x1000b12d
push ebx
call eax
mov dl, 0xe
pop ecx
mov ecx, ebx
cmp eax, 1
jne 0x1000b123
push 0x10046d1d
push 0
push eax
push 0
jmp 0x1000a97b
push 0x10046d1c
push 0
push edi
jmp 0x1000b11c
push 0x10046cf3
push edx
push edi
push edx
mov dl, 0xe
jmp 0x1000a979
mov edx, dword [esp + 0x29f4]
mov ecx, ebx
call fcn.1000a644
mov ebp, eax
test ebp, ebp
je 0x1000a8a1
movzx eax, byte [esp + 0x29ec]
sub eax, 1
je 0x1000b249
sub eax, 3
je 0x1000b1fd
sub eax, 1
jne 0x1000ae9c
mov al, byte [ebp]
mov ecx, ebp
test al, al
je 0x1000b192
mov dl, al
mov al, dl
cmp dl, 0x2a
je 0x1000b192
inc ecx
mov al, byte [ecx]
mov dl, al
test al, al
jne 0x1000b182
xor esi, esi
test al, al
cmovne esi, ecx
test esi, esi
je 0x1000ae9c
lea edx, [esp + 0x48]
mov byte [esi], 0
mov ecx, ebp
sub edx, ebp
mov al, byte [ecx]
mov byte [ecx + edx], al
inc ecx
test al, al
jne 0x1000b1ac
lea ecx, [esi + 1]
lea edx, [esp + 0x1c8]
sub edx, ecx
mov al, byte [ecx]
mov byte [ecx + edx], al
inc ecx
test al, al
jne 0x1000b1c2
lea eax, [esp + 0x1c8]
push eax
lea eax, [esp + 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
neg eax
push ebp
push dword [esp + 0x29f8]
sbb eax, eax
neg eax
dec eax
mov dword [esp + 0x1c], eax
mov byte [esi], 0x2a
push dword [esp + 0x1c]
push 8
jmp 0x1000b277
lea edx, [esp + 0x48]
mov ecx, ebp
sub edx, ebp
mov al, byte [ecx]
mov byte [ecx + edx], al
inc ecx
test al, al
jne 0x1000b205
lea eax, [esp + 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, edi
je 0x1000b23c
test al, 0x10
lea eax, [esp + 0x48]
push eax
je 0x1000b22f
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
jmp 0x1000b235
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
neg eax
sbb edi, edi
neg edi
dec edi
push ebp
push dword [esp + 0x29f8]
push edi
push 7
jmp 0x1000b277
lea edx, [esp + 0x48]
mov ecx, ebp
sub edx, ebp
mov al, byte [ecx]
mov byte [ecx + edx], al
inc ecx
test al, al
jne 0x1000b251
push 0
lea eax, [esp + 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push ebp
push dword [esp + 0x29f8]
mov dword [esp + 0x1c], eax
push eax
push 4
mov dl, 0xb
mov ecx, ebx
call fcn.1000a2a3
add esp, 0x10
mov dword [esp + 0x14], eax
jmp 0x1000ae30