Function at 0x10010b20
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x58
push ebx
mov ebx, dword [esp + 0x84]
push ebp
push esi
mov eax, dword [ebx + 0x91e]
push edi
test eax, eax
mov dword [esp + 0x10], 0
je 0x10010e5f
mov esi, dword [esp + 0x70]
mov edi, dword [esp + 0x80]
test esi, esi
mov eax, 0xfffe
jg 0x10010b84
jl 0x10010b60
cmp dword [esp + 0x6c], eax
ja 0x10010b84
mov ecx, dword [esp + 0x78]
test ecx, ecx
jg 0x10010b84
jl 0x10010b70
cmp dword [esp + 0x74], eax
ja 0x10010b84
test edi, edi
jl 0x10010e5f
jg 0x10010b84
cmp dword [esp + 0x7c], eax
jbe 0x10010e5f
mov eax, dword [ebx + 0xa2]
mov dword [esp + 0x10], 1
cmp eax, 0xffffffff
push ebx
jne 0x10010cfc
mov ebp, dword [esp + 0x90]
push 0
push 0x4c
push ebp
push 0
call fcn.1000bdd0
add esp, 0x14
test eax, eax
je 0x10010bcd
mov eax, dword [ebx + 0x9a]
pop edi
neg eax
sbb eax, eax
pop esi
and al, 0xf6
pop ebp
add eax, 0x13
pop ebx
add esp, 0x58
ret
mov ecx, dword [esp + 0x74]
mov edx, dword [esp + 0x78]
mov eax, 0x2d
mov dword [esp + 0x58], ecx
mov ecx, dword [ebp]
mov word [esp + 0x3c], ax
mov word [esp + 0x3e], ax
mov eax, dword [esp + 0x6c]
push 1
mov dword [esp + 0x54], eax
mov eax, dword [esp + 0x80]
push 0
push 0
push ecx
mov dword [esp + 0x40], 0x6064b50
mov dword [esp + 0x44], 0x2c
mov dword [esp + 0x48], 0
mov dword [esp + 0x64], esi
mov dword [esp + 0x6c], edx
mov dword [esp + 0x70], eax
mov dword [esp + 0x74], edi
mov dword [esp + 0x2c], 0x7064b50
call fcn.1000ddf0
add esp, 0x10
mov dword [esp + 0x24], eax
test byte [ebx + 0x4ee1], 0x80
mov dword [esp + 0x28], edx
je 0x10010c77
mov eax, dword [ebx + 0x4ee2]
mov ecx, dword [ebx + 0x4ee6]
mov edx, dword [ebx + 0x4ef2]
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], ecx
mov dword [esp + 0x48], edx
mov dword [esp + 0x4c], 0
mov dword [esp + 0x20], ecx
inc eax
jmp 0x10010c91
mov ecx, dword [esp + 0x6c]
xor eax, eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], ecx
mov dword [esp + 0x4c], esi
mov dword [esp + 0x20], eax
push 0x4d
mov dword [esp + 0x30], eax
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
mov ebp, eax
add esp, 4
test ebp, ebp
je 0x10011136
mov eax, dword [esp + 0x8c]
mov ecx, 0xe
lea esi, [esp + 0x30]
mov edi, ebp
rep movsd dword es:[edi], dword [esi]
lea edi, [ebp + 0x38]
mov ecx, 5
lea esi, [esp + 0x1c]
lea edx, [esp + 0x90]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [eax]
push 0
push edx
push 0x4c
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x10010f91
cmp dword [esp + 0x90], 0x4c
jne 0x10010f91
jmp 0x10010e56
call fcn.1000c660
add esp, 4
test edx, edx
jg 0x10010e5f
jl 0x10010d17
cmp eax, 0x4c
jae 0x10010e5f
mov ebp, dword [esp + 0x8c]
push ebx
push ebp
call fcn.1000c760
add esp, 8
test eax, eax
jne 0x1001113b
mov edx, dword [esp + 0x6c]
mov dword [esp + 0x38], eax
mov ecx, dword [esp + 0x78]
mov eax, 0x2d
mov word [esp + 0x3c], ax
mov word [esp + 0x3e], ax
mov eax, dword [esp + 0x74]
push 1
mov dword [esp + 0x5c], eax
mov eax, dword [ebp]
mov dword [esp + 0x54], edx
mov edx, dword [esp + 0x80]
push 0
push 0
push eax
mov dword [esp + 0x40], 0x6064b50
mov dword [esp + 0x44], 0x2c
mov dword [esp + 0x64], esi
mov dword [esp + 0x6c], ecx
mov dword [esp + 0x70], edx
mov dword [esp + 0x74], edi
mov dword [esp + 0x2c], 0x7064b50
call fcn.1000ddf0
add esp, 0x10
mov dword [esp + 0x24], eax
test byte [ebx + 0x4ee1], 0x80
mov dword [esp + 0x28], edx
je 0x10010dd6
mov eax, dword [ebx + 0x4ee2]
mov ecx, dword [ebx + 0x4ee6]
mov edx, dword [ebx + 0x4ef2]
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], ecx
mov dword [esp + 0x48], edx
mov dword [esp + 0x4c], 0
mov dword [esp + 0x20], ecx
inc eax
jmp 0x10010df0
mov ecx, dword [esp + 0x6c]
xor eax, eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], ecx
mov dword [esp + 0x4c], esi
mov dword [esp + 0x20], eax
push 0x4d
mov dword [esp + 0x30], eax
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
mov ebp, eax
add esp, 4
test ebp, ebp
je 0x10011136
mov eax, dword [esp + 0x8c]
mov ecx, 0xe
lea esi, [esp + 0x30]
mov edi, ebp
rep movsd dword es:[edi], dword [esi]
lea edi, [ebp + 0x38]
mov ecx, 5
lea esi, [esp + 0x1c]
lea edx, [esp + 0x90]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [eax]
push 0
push edx
push 0x4c
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x10010f91
cmp dword [esp + 0x90], 0x4c
jne 0x10010f91
push ebp
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
add esp, 4
mov edx, dword [esp + 0x84]
mov ecx, dword [ebx + 0xa2]
xor esi, esi
cmp ecx, 0xffffffff
lea ebp, [edx + 0x16]
mov eax, esi
mov edi, ebp
push ebx
mov dword [esp + 0x18], edi
jne 0x10010fdf
push eax
mov eax, dword [esp + 0x94]
push edi
push eax
push esi
call fcn.1000bdd0
add esp, 0x14
test eax, eax
je 0x10010eb1
mov eax, dword [ebx + 0x9a]
pop edi
neg eax
sbb eax, eax
pop esi
and al, 0xf6
pop ebp
add eax, 0x13
pop ebx
add esp, 0x58
ret
lea ecx, [edi + 1]
push ecx
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
mov ebp, eax
add esp, 4
test ebp, ebp
je 0x10011136
mov dword [ebp], 0x6054b50
test byte [ebx + 0x4ee1], 0x80
je 0x10010fa7
mov eax, dword [esp + 0x10]
test eax, eax
je 0x10010f01
lea eax, [ebp + 4]
or edx, 0xffffffff
or ecx, 0xffffffff
mov dword [eax], edx
mov word [eax + 4], dx
lea edx, [ebp + 0xa]
mov dword [ebp + 0xa], ecx
mov dword [edx + 4], ecx
mov word [edx + 8], cx
jmp 0x10010f39
mov cx, word [ebx + 0x4ee2]
mov word [ebp + 4], cx
mov dx, word [ebx + 0x4ee6]
mov word [ebp + 6], dx
mov ax, word [ebx + 0x4ef2]
mov ecx, dword [esp + 0x74]
mov edx, dword [esp + 0x7c]
mov word [ebp + 8], ax
mov ax, word [esp + 0x6c]
mov word [ebp + 0xa], ax
mov dword [ebp + 0xc], ecx
mov dword [ebp + 0x10], edx
mov ecx, dword [esp + 0x84]
test ecx, ecx
mov word [ebp + 0x14], cx
je 0x10010f64
mov esi, dword [esp + 0x88]
mov eax, ecx
lea edi, [ebp + 0x16]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [esp + 0x14]
mov edx, dword [esp + 0x8c]
lea ecx, [esp + 0x90]
push 0
push ecx
mov eax, dword [edx]
push edi
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x10010f91
cmp dword [esp + 0x90], edi
je 0x100110eb
push ebp
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
add esp, 4
mov eax, 0xa
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x58
ret
mov eax, dword [esp + 0x10]
lea ecx, [ebp + 4]
test eax, eax
mov dword [ecx], 0
je 0x10010fd5
lea edx, [ebp + 8]
or ecx, 0xffffffff
mov word [edx], 0xffff
lea edx, [ebp + 0xa]
mov dword [ebp + 0xa], ecx
mov dword [edx + 4], ecx
mov word [edx + 8], cx
jmp 0x10010f39
mov ax, word [esp + 0x6c]
jmp 0x10010f1e
call fcn.1000c660
add esp, 4
cmp edx, esi
jg 0x1001100a
jl 0x10010ff1
cmp eax, ebp
jae 0x1001100a
mov ecx, dword [esp + 0x8c]
push ebx
push ecx
call fcn.1000c760
add esp, 8
test eax, eax
jne 0x1001113b
lea edx, [edi + 1]
push edx
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
mov ebp, eax
add esp, 4
test ebp, ebp
je 0x10011136
mov dword [ebp], 0x6054b50
test byte [ebx + 0x4ee1], 0x80
je 0x100110fe
mov eax, dword [esp + 0x10]
test eax, eax
je 0x1001105a
lea ecx, [ebp + 4]
or eax, 0xffffffff
or edx, 0xffffffff
mov dword [ecx], eax
mov word [ecx + 4], ax
lea eax, [ebp + 0xa]
mov dword [ebp + 0xa], edx
mov dword [eax + 4], edx
mov word [eax + 8], dx
jmp 0x10011092
mov dx, word [ebx + 0x4ee2]
mov word [ebp + 4], dx
mov ax, word [ebx + 0x4ee6]
mov word [ebp + 6], ax
mov cx, word [ebx + 0x4ef2]
mov edx, dword [esp + 0x74]
mov eax, dword [esp + 0x7c]
mov word [ebp + 8], cx
mov cx, word [esp + 0x6c]
mov word [ebp + 0xa], cx
mov dword [ebp + 0xc], edx
mov dword [ebp + 0x10], eax
mov ecx, dword [esp + 0x84]
test ecx, ecx
mov word [ebp + 0x14], cx
je 0x100110bd
mov esi, dword [esp + 0x88]
mov edx, ecx
lea edi, [ebp + 0x16]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [esp + 0x14]
mov ecx, dword [ebx + 0xa2]
lea eax, [esp + 0x90]
push 0
push eax
push edi
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x10010f91
cmp dword [esp + 0x90], edi
jne 0x10010f91
push ebp
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x58
ret
mov eax, dword [esp + 0x10]
lea edx, [ebp + 4]
test eax, eax
mov dword [edx], 0
je 0x1001112c
lea eax, [ebp + 8]
or edx, 0xffffffff
mov word [eax], 0xffff
lea eax, [ebp + 0xa]
mov dword [ebp + 0xa], edx
mov dword [eax + 4], edx
mov word [eax + 8], dx
jmp 0x10011092
mov cx, word [esp + 0x6c]
jmp 0x10011077
mov eax, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x58
ret