Function at 0x100ab9b0
Capabilities:
Get file size
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100e9f6b
mov eax, dword fs:[0]
push eax
sub esp, 0x864
mov eax, dword [0x101a12fc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
cmp byte [ebp + 8], 0
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x860], esi
je 0x100abd4b
cmp byte [ebx + 0x30], 0
je 0x100aba02
push 0
push 0
call fcn.100ab9b0
call dword [0x100ef920]
test al, al
je 0x100abbe4
lea eax, [ebp - 0x144]
push esi
push eax
call fcn.1009ef60
add esp, 8
cmp dword [eax + 0x14], 8
jb 0x100aba28
mov eax, dword [eax]
push 0
push 0x80
push 4
push 0
push 5
push 4
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp dword [ebp - 0x130], 8
mov dword [ebx + 0x34], eax
jb 0x100aba58
push dword [ebp - 0x144]
call fcn.100dd8b4
add esp, 4
mov eax, dword [ebx + 0x34]
cmp eax, 0xffffffff
je 0x100abce1
lea ecx, [ebp - 0x870]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x100abc43
mov eax, dword [ebp - 0x870]
or eax, dword [ebp - 0x86c]
je 0x100aba9c
push 2
push 0
push 0
push dword [ebx + 0x34]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x100abc43
call dword [0x100ef698]
mov esi, eax
push 0
push 1
mov dword [ebp - 0x858], esi
call dword [0x100ef6a0]
mov edi, dword [0x100ef6b0]
push eax
push 0x1010dc74
push esi
call edi
mov esi, dword [0x100ef690]
push 0x1010dc78
call esi
push eax
push str.arch
push dword [ebp - 0x858]
call edi
push str.murmurhash
call esi
push eax
push str.hashAlgorithm
push dword [ebp - 0x858]
call edi
call fcn.100ca030
mov eax, dword [eax + 0x110]
call eax
push 0
push eax
call fcn.100ac160
push eax
push str.hash
push dword [ebp - 0x858]
call edi
add esp, 0x48
push 0x100efbd8
call esi
push eax
push str.compression
push dword [ebp - 0x858]
call edi
add esp, 0x10
lea eax, [ebp - 0x114]
push 0x104
push eax
call fcn.10051a30
push eax
call fcn.10083150
lea eax, [ebp - 0x114]
push eax
call esi
push eax
push str.path
push dword [ebp - 0x858]
call edi
mov edi, dword [ebp - 0x858]
push 0x20
push edi
call dword [0x100ef670]
mov esi, eax
mov dword [ebp - 0x858], eax
add esp, 0x24
lea eax, [esi + 1]
lea esp, [esp]
mov cl, byte [esi]
inc esi
test cl, cl
jne 0x100abb80
sub esi, eax
mov dword [ebp - 0x868], 0x43415254
push 0
lea eax, [ebp - 0x85c]
mov dword [ebp - 0x864], esi
push eax
push 8
lea eax, [ebp - 0x868]
push eax
push dword [ebx + 0x34]
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [ebp - 0x85c], 8
jae 0x100abbeb
push dword [ebx + 0x34]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x858]
call fcn.100cacb0
push edi
call fcn.100aca70
push str.Trace_recording_failed_to_start_because_the_file_header_cannot_be_written.
call fcn.10044e50
add esp, 0xc
xor al, al
jmp 0x100abd6f
push 0
lea eax, [ebp - 0x85c]
push eax
push esi
push dword [ebp - 0x858]
push dword [ebx + 0x34]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebp - 0x858]
call fcn.100cacb0
push edi
call fcn.100aca70
add esp, 8
cmp dword [ebp - 0x85c], esi
jae 0x100abc3d
push dword [ebx + 0x34]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.Trace_recording_failed_to_start_because_the_file_header_cannot_be_written.
call fcn.10044e50
add esp, 4
xor al, al
jmp 0x100abd6f
mov esi, dword [ebp - 0x860]
mov eax, 0x1010101
mov word [ebx + 0x30], 1
mov dword [ebx + 0x6a0], 0
lea edi, [ebx + 0x4b0]
mov byte [ebx + 0x58c], 1
mov ecx, 0x36
push esi
rep stosd dword es:[edi], eax
push str.Started_trace_recording_to_file:__s_r_n
call fcn.10044d60
add esp, 8
lea ecx, [ebp - 0x854]
push 0
call fcn.100d08e0
push 0x23
push dword [0x101b9790]
call fcn.100d07d8
push 0
push 0
mov edi, eax
lea eax, [ebp - 0x13c]
push 0x10
push eax
push edi
call fcn.10079fb0
add esp, 0x1c
test al, al
je 0x100abcd5
push 0x10
lea eax, [ebp - 0x13c]
push eax
push 0
push edi
lea ecx, [ebp - 0x854]
call fcn.100d0bd0
lea eax, [ebp - 0x854]
mov ecx, ebx
push eax
call fcn.100aadd0
push esi
call dword [0x100ef730]
jmp 0x100abd6a
call dword [sym.imp.KERNEL32.dll_GetLastError]
sub esp, 0x18
mov ecx, esp
push eax
push str.winerror__x
push ecx
call fcn.1009f310
add esp, 0xc
lea eax, [ebp - 0x12c]
push eax
call fcn.1009ce80
cmp dword [ebp - 0x118], 0x10
lea eax, [ebp - 0x12c]
mov dword [ebp - 4], 0
cmovae eax, dword [ebp - 0x12c]
push eax
push str.Cannot_create_trace_recording_file._GetLastError_____s._r_n
call fcn.10044d60
add esp, 0x24
cmp dword [ebp - 0x118], 0x10
jb 0x100abd47
push dword [ebp - 0x12c]
call fcn.100dd8b4
add esp, 4
xor al, al
jmp 0x100abd6f
cmp byte [ebx + 0x30], 0
je 0x100abd6d
push dword [ebx + 0x34]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.Trace_recording_stopped.
mov word [ebx + 0x30], 0
call fcn.10044e50
add esp, 4
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100dd9b4
mov esp, ebp
pop ebp
ret 8