Function at 0x1009af59
Capabilities:
Write file on windows

Disassembly:
push 0xc4c
push 0x10645700
call fcn.10458d80
mov edi, edx
mov dword [ebp - 0xc34], edi
xor ebx, ebx
test ecx, ecx
je 0x1009af78
mov byte [ecx], bl
call fcn.1009b4ec
lea eax, [ebp - 0xc30]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [ebp - 0xc24]
push eax
movzx eax, word [ebp - 0xc26]
push eax
movzx eax, word [ebp - 0xc28]
push eax
movzx eax, word [ebp - 0xc2a]
push eax
movzx eax, word [ebp - 0xc2e]
push eax
movzx eax, word [ebp - 0xc30]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push str.P_d_T_d_D_04ld__02ld__02ld_T_02ld__02ld__02ld
mov esi, 0x100
push esi
lea eax, [ebp - 0x220]
push eax
call fcn.104397a9
lea eax, [ebp - 0x220]
push eax
push 0x10786d50
push str._sCRASH_REPORT__s.txt
push esi
lea eax, [ebp - 0x120]
push eax
call fcn.104397a9
add esp, 0x40
push 2
pop ecx
cmp eax, ecx
jle 0x1009b025
mov dl, byte [ebp + ecx - 0x120]
cmp dl, 0x2f
je 0x1009b018
cmp dl, 0x3a
jne 0x1009b020
mov byte [ebp + ecx - 0x120], 0x5f
inc ecx
cmp ecx, eax
jl 0x1009b007
push ebx
push 0x80
push 2
push ebx
push ebx
push 0xc0000000
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
mov dword [ebp - 0xc3c], esi
cmp esi, 0xffffffff
je 0x1009b2c3
mov edi, dword [edi]
push 0x208
push ebx
lea eax, [ebp - 0x838]
push eax
call fcn.1043c810
add esp, 0xc
mov eax, dword [ebp - 0xc34]
mov eax, dword [eax + 4]
mov dword [ebp - 0xc38], eax
mov dword [ebp - 0xc34], 0x1054dc94
push 0x1c
lea ecx, [ebp - 0xc5c]
push ecx
push dword [eax + 0xb8]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x1009b0c8
push 0x206
lea eax, [ebp - 0x838]
push eax
push dword [ebp - 0xc58]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x1009b0c8
lea ecx, [ebp - 0x838]
call fcn.1009ad12
mov dword [ebp - 0xc34], eax
push 0x208
push ebx
lea eax, [ebp - 0x428]
push eax
call fcn.1043c810
add esp, 0xc
push 0x206
lea eax, [ebp - 0x428]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x1009b106
push 0x1054dc8c
lea eax, [ebp - 0x428]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [ebp - 0x428]
call fcn.1009ad12
push eax
lea eax, [ebp - 0x630]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [ebp - 0x630]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1009b125
dec ecx
lea eax, [ebp - 0x630]
cmp ecx, eax
je 0x1009b13c
cmp byte [ecx], 0x2e
jne 0x1009b12c
xor eax, eax
cmp byte [ecx], 0x2e
cmove eax, ecx
test eax, eax
je 0x1009b14a
mov byte [eax], bl
mov eax, dword [ebp - 0xc38]
push dword [eax + 0xb8]
push dword [eax + 0xbc]
push dword [ebp - 0xc34]
push dword [edi]
mov ecx, dword [edi]
call fcn.1009ab4f
push eax
lea eax, [ebp - 0x630]
push eax
push str._s_caused__s__0x_08x___r_nin_module__s_at__04x:_08x._r_n_r_n
push esi
call fcn.1009a04c
add esp, 0x20
mov ecx, esi
call fcn.1009a981
cmp dword [edi], 0xc0000005
jne 0x1009b1d0
cmp dword [edi + 0x10], 2
jb 0x1009b1d0
mov ecx, str.Read_from
mov eax, str.Write_to
cmp dword [edi + 0x14], ebx
cmove eax, ecx
push dword [edi + 0x18]
push eax
push str._s_location__08x_caused_an_access_violation._r_n
lea eax, [ebp - 0xc20]
push eax
call fcn.1043834b
lea eax, [ebp - 0xc20]
push eax
push 0x1054dd34
push esi
call fcn.1009a04c
add esp, 0x1c
mov edx, dword [ebp - 0xc38]
mov ecx, esi
call fcn.1009aec0
push str._r_nBytes_at_CS:EIP:_r_n
push esi
call fcn.1009a04c
pop ecx
pop ecx
mov eax, dword [ebp - 0xc38]
mov eax, dword [eax + 0xb8]
mov dword [ebp - 0xc40], eax
mov dword [ebp - 0xc34], ebx
mov ecx, dword [ebp - 0xc34]
cmp ecx, 0x10
jge 0x1009b25d
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 0xc40]
movzx eax, byte [ecx + eax]
push eax
push 0x1054dd3c
push esi
call fcn.1009a04c
add esp, 0xc
mov dword [ebp - 4], 0xfffffffe
jmp 0x1009b255
inc dword [ebp - 0xc34]
jmp 0x1009b202
mov edx, dword [ebp - 0xc38]
mov edx, dword [edx + 0xc4]
mov ecx, esi
call fcn.1009ad36
mov ecx, esi
call fcn.1009a420
lea eax, [ebp - 0x120]
push eax
push str._r_n__end_of__s___r_n
push esi
call fcn.1009a04c
add esp, 0xc
cmp dword [0x1077e3a0], 0
jle 0x1009b2b8
push ebx
lea eax, [ebp - 0xc3c]
push eax
mov edi, 0x10786e58
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [0x1077e3a0], ebx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x1009b2c8
mov eax, 0x80004005
call fcn.10458dc8
ret