Function at 0x1000d71b
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x284
mov eax, dword [0x100c2070]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0x14]
lea eax, [ebp - 0x264]
push esi
push edi
push 0x240
push 0
push eax
mov dword [ebp - 0x278], ecx
mov dword [ebp - 0x284], ebx
call fcn.1006fd90
add esp, 0xc
mov byte [ebp - 0x24], 0
xor eax, eax
and dword [ebp - 0x27c], 0
lea edi, [ebp - 0x23]
push 7
pop ecx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov word [ebp - 0x274], ax
lea edi, [ebp - 0x272]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
test ebx, ebx
je 0x1000d936
mov edx, ebx
lea esi, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x1000d78f
sub edx, esi
cmp edx, 0x240
jae 0x1000d936
lea eax, [ebp - 0x274]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
push 7
mov ebx, dword [ebp + 0x10]
lea edi, [ebp - 0x24]
pop ecx
mov eax, 0x20202020
lea esi, [ebp - 7]
rep stosd dword es:[edi], eax
xor ecx, ecx
stosw word es:[edi], ax
mov edx, ebx
lea edi, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x1000d7cd
sub edx, edi
lea eax, [edx + 1]
cmp eax, 0x1e
jbe 0x1000d7e3
push 0x1e
pop edx
jmp 0x1000d7f2
mov edx, ebx
lea edi, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x1000d7e8
sub edx, edi
inc edx
cmp ecx, edx
jae 0x1000d80f
mov edx, ebx
lea edi, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x1000d7fb
sub edx, edi
sub edx, ecx
inc ecx
mov al, byte [edx + ebx]
mov byte [esi], al
dec esi
jmp 0x1000d7c8
cmp ecx, 0x1d
jae 0x1000d81c
lea eax, [ebp - 7]
sub eax, ecx
mov byte [eax], 0x7c
mov ebx, dword [ebp + 0xc]
lea edi, [ebp - 7]
inc ecx
sub edi, ecx
mov edx, ebx
lea esi, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x1000d82a
sub edx, esi
lea eax, [edx + 1]
cmp eax, 0x1e
jbe 0x1000d840
push 0x1e
pop edx
jmp 0x1000d84f
mov edx, ebx
lea esi, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x1000d845
sub edx, esi
inc edx
cmp ecx, edx
jae 0x1000d888
mov esi, ebx
lea edx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x1000d858
sub esi, edx
mov edx, dword [ebp + 0x10]
lea eax, [edx + 1]
mov dword [ebp - 0x280], eax
mov al, byte [edx]
inc edx
test al, al
jne 0x1000d86d
sub edx, dword [ebp - 0x280]
sub edx, ecx
add edx, esi
inc ecx
mov al, byte [edx + ebx + 1]
mov byte [edi], al
dec edi
jmp 0x1000d825
push dword [ebp - 0x284]
lea eax, [ebp - 0x24]
mov ebx, 0x240
push eax
push dword [ebp + 8]
movzx eax, word [ebp - 0x268]
push eax
movzx eax, word [ebp - 0x26a]
push eax
movzx eax, word [ebp - 0x26c]
push eax
movzx eax, word [ebp - 0x26e]
push eax
movzx eax, word [ebp - 0x272]
push eax
movzx eax, word [ebp - 0x274]
push eax
push str.__4d__2d__2d__2d:_2d:_2d___4d___s_____s_r_n
push 0xffffffffffffffff
lea eax, [ebp - 0x264]
push ebx
push eax
call fcn.1000dca8
lea ecx, [ebp - 0x264]
add esp, 0x34
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1000d8ea
mov edi, dword [ebp - 0x278]
sub ecx, edx
cmp ecx, ebx
jae 0x1000d93c
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
lea eax, [ebp - 0x27c]
push 0
push eax
push ecx
lea eax, [ebp - 0x264]
push eax
push dword [edi + 0x108]
call esi
push 0
lea eax, [ebp - 0x27c]
push eax
push 2
push 0x100a5580
push dword [edi + 0x108]
call esi
jmp 0x1000d93c
mov edi, dword [ebp - 0x278]
lea eax, [edi + 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1006c6c9
mov esp, ebp
pop ebp
ret 0x10