Function at 0x100174e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1003831e
mov eax, dword fs:[0]
push eax
sub esp, 0x10c
mov eax, dword [0x10049390]
xor eax, esp
mov dword [esp + 0x104], eax
push esi
push edi
mov eax, dword [0x10049390]
xor eax, esp
push eax
lea eax, [esp + 0x118]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
cmp dword [eax + 0x14], 8
jb 0x1001752d
mov eax, dword [eax]
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
sub esp, 8
lea ecx, [esp + 0x1c]
mov edi, eax
call fcn.10017de0
mov dword [esp + 0x120], 0
mov edx, 0x10040e70
lea ecx, [esp + 0x24]
call fcn.10005c40
mov edx, 0x10040e6c
mov ecx, eax
call fcn.10005c40
mov edx, 0x10040e4c
mov ecx, eax
call fcn.10005c40
mov edx, 0x10040e68
mov ecx, eax
call fcn.10005c40
mov edx, 0x10040e80
lea ecx, [esp + 0x24]
call fcn.10005c40
mov edx, 0x10040e3c
mov ecx, eax
call fcn.10005c40
mov edx, 0x10040e50
mov ecx, eax
call fcn.10005c40
mov edx, 0x10040e7c
mov ecx, eax
call fcn.10005c40
mov edx, 0x10040e70
mov ecx, eax
call fcn.10005c40
mov edx, 0x10040e78
mov ecx, eax
call fcn.10005c40
mov edx, 0x10040e50
mov ecx, eax
call fcn.10005c40
mov edx, 0x10040e74
mov ecx, eax
call fcn.10005c40
push 1
push ecx
push 0
push ecx
push 0
push ecx
push 2
push ecx
mov edx, 0x10040e8c
lea ecx, [esp + 0x44]
call fcn.10005c40
mov edx, 0x10040e88
mov ecx, eax
call fcn.10005c40
mov edx, 0x10040e5c
mov ecx, eax
call fcn.10005c40
mov edx, 0x10040e84
mov ecx, eax
call fcn.10005c40
mov edx, 0x10040e7c
mov ecx, eax
call fcn.10005c40
add esp, 4
mov ecx, eax
call fcn.10017a80
mov edx, str..th_:pelgomcdu_rv_anis
mov ecx, eax
call fcn.10005c40
add esp, 4
mov ecx, eax
call fcn.10017a80
mov edx, str..th_:pelgomcdu_rv_anis
mov ecx, eax
call fcn.10005c40
add esp, 4
mov ecx, eax
call fcn.10017a80
mov edx, str..th_:pelgomcdu_rv_anis
mov ecx, eax
call fcn.10005c40
add esp, 4
mov ecx, eax
call fcn.10017a80
mov edx, 0x10040e70
mov ecx, eax
call fcn.10005c40
mov edx, 0x10040e44
lea ecx, [esp + 0x24]
call fcn.10005c40
mov edx, 0x10040e78
mov ecx, eax
call fcn.10005c40
mov edx, 0x10040e50
mov ecx, eax
call fcn.10005c40
mov edx, 0x10040e74
mov ecx, eax
call fcn.10005c40
mov edx, 0x10040e8c
mov ecx, eax
call fcn.10005c40
mov edx, 0x10040e88
mov ecx, eax
call fcn.10005c40
mov edx, 0x10040e5c
lea ecx, [esp + 0x24]
call fcn.10005c40
mov edx, 0x10040e84
mov ecx, eax
call fcn.10005c40
mov edx, 0x10040e7c
mov ecx, eax
call fcn.10005c40
mov edx, 0x10040e70
mov ecx, eax
call fcn.10005c40
mov eax, dword [esi]
lea ecx, [esp + 0xf8]
push ecx
mov ecx, esi
call dword [eax + 0x3c]
mov esi, eax
mov byte [esp + 0x120], 1
mov edx, 0x10040e6c
lea ecx, [esp + 0x24]
call fcn.10005c40
mov edx, 0x10040e74
mov ecx, eax
call fcn.10005c40
mov edx, 0x10040e54
mov ecx, eax
call fcn.10005c40
mov edx, 0x10040e7c
mov ecx, eax
call fcn.10005c40
mov edx, esi
mov ecx, eax
call fcn.10019930
mov edx, 0x10040e70
mov ecx, eax
call fcn.10005c40
mov edx, 0x10040e44
mov ecx, eax
call fcn.10005c40
mov edx, 0x10040e6c
mov ecx, eax
call fcn.10005c40
mov edx, 0x10040e74
mov ecx, eax
call fcn.10005c40
mov edx, 0x10040e54
mov ecx, eax
call fcn.10005c40
mov edx, 0x10040e7c
mov ecx, eax
call fcn.10005c40
mov byte [esp + 0x120], 0
cmp dword [esp + 0x10c], 8
jb 0x100177ce
push dword [esp + 0xf8]
call fcn.10020454
add esp, 4
xor eax, eax
mov dword [esp + 0x10c], 7
mov edx, 0x10040e70
mov dword [esp + 0x108], 0
lea ecx, [esp + 0x24]
mov word [esp + 0xf8], ax
call fcn.10005c40
mov edx, 0x10040e44
mov ecx, eax
call fcn.10005c40
mov edx, 0x10040e6c
mov ecx, eax
call fcn.10005c40
mov edx, 0x10040e4c
mov ecx, eax
call fcn.10005c40
mov edx, 0x10040e68
mov ecx, eax
call fcn.10005c40
mov edx, 0x10040e80
mov ecx, eax
call fcn.10005c40
mov edx, 0x10040e3c
mov ecx, eax
call fcn.10005c40
mov edx, 0x10040e50
mov ecx, eax
call fcn.10005c40
mov edx, 0x10040e7c
mov ecx, eax
call fcn.10005c40
lea eax, [esp + 0xe0]
push eax
lea ecx, [esp + 0x18]
call fcn.10017f80
mov byte [esp + 0x120], 2
lea ecx, [esp + 0xe0]
cmp dword [esp + 0xf4], 8
mov eax, dword [esp + 0xf0]
cmovae ecx, dword [esp + 0xe0]
push dword [esp + 0xc]
mov dword [esp + 0xdc], 0
mov dword [esp + 0xe0], 0
lea eax, [ecx + eax*2]
mov dword [esp + 0xe0], 0xf
lea ecx, [esp + 0xe4]
mov dword [esp + 0xdc], 0
cmovae ecx, dword [esp + 0xe4]
push eax
push ecx
lea ecx, [esp + 0xd4]
mov byte [esp + 0xd4], 0
call fcn.10003120
mov byte [esp + 0x120], 3
lea ecx, [esp + 0xc]
cmp dword [esp + 0xdc], 0x10
lea eax, [esp + 0xc8]
push 0
cmovae eax, dword [esp + 0xcc]
push ecx
push dword [esp + 0xe0]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [esp + 0x120], 2
cmp dword [esp + 0xdc], 0x10
jb 0x10017948
push dword [esp + 0xc8]
call fcn.10020454
add esp, 4
mov dword [esp + 0xdc], 0xf
mov dword [esp + 0xd8], 0
mov byte [esp + 0xc8], 0
mov byte [esp + 0x120], 0
cmp dword [esp + 0xf4], 8
jb 0x10017987
push dword [esp + 0xe0]
call fcn.10020454
add esp, 4
xor eax, eax
mov dword [esp + 0xf4], 7
mov dword [esp + 0xf0], 0
mov word [esp + 0xe0], ax
mov dword [esp + 0x120], 0xffffffff
lea ecx, [esp + 0x7c]
call fcn.10017eb0
lea eax, [esp + 0x7c]
mov dword [esp + 0x7c], 0x10040214
mov dword [esp + 0x10], eax
mov dword [esp + 0x120], 0xffffffff
push eax
mov dword [esp + 0x80], 0x1003fa58
call fcn.1001fdab
add esp, 4
mov ecx, dword [esp + 0x118]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.10020459
mov esp, ebp
pop ebp
ret 8