Function at 0x1010695
Capabilities:
Check if file exists
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
xor ebx, ebx
test byte [ebp + 0xc], 0x10
push esi
push edi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x34], ebx
je 0x10106e0
test byte [ebp + 0xc], 0x40
push 3
pop eax
je 0x10106da
xor eax, eax
push eax
call fcn.010117e2
xor esi, esi
inc esi
test byte [ebp + 0xc], 1
je 0x10106f0
and dword [ebp + 0xc], 0xfffffff7
mov dword [ebp - 0x24], esi
lea eax, [ebp - 0x4c]
push eax
push dword [ebp + 8]
call fcn.0100fea5
test eax, eax
jne 0x101070d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x1010cd9
lea eax, [ebp - 0x2c]
push eax
push esi
push 4
push 0x102234c
call fcn.01012229
test eax, eax
je 0x1010700
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x2c]
call fcn.0101252a
test eax, eax
je 0x1010700
push 0x1002df8
lea eax, [ebp - 0x4c]
push eax
mov dword [ebp - 0x28], ebx
call fcn.01011e26
test eax, eax
je 0x101074a
mov dword [ebp - 0x28], esi
push 0x1002dd4
lea eax, [ebp - 0x4c]
push eax
mov dword [ebp + 8], ebx
call fcn.01011e26
test eax, eax
je 0x1010762
mov dword [ebp + 8], esi
push 0x1003a98
lea eax, [ebp - 0x4c]
push eax
call fcn.01012091
mov edi, eax
mov dword [ebp - 0x1c], edi
cmp edi, ebx
je 0x1010700
push 0x1003a60
lea eax, [ebp - 0x4c]
push eax
call fcn.01012091
mov esi, eax
mov dword [ebp - 0x14], esi
cmp esi, ebx
je 0x1010700
test byte [ebp + 0xc], 0x20
je 0x10107b1
push 0x1003a00
push 3
mov dword [ebp - 0x10], 1
call fcn.01011862
pop ecx
pop ecx
jmp 0x1010828
cmp dword [ebp - 0x28], ebx
je 0x10107fe
push 1
push edi
call fcn.0101294c
test eax, eax
jne 0x10107df
mov eax, 0xc1
push eax
push edi
mov esi, eax
push 0x1003980
push 4
call fcn.01011862
add esp, 0x10
jmp 0x1010cd9
push 0x1003958
lea eax, [ebp - 0x4c]
push eax
call fcn.01012091
mov esi, eax
mov dword [ebp - 8], esi
cmp esi, ebx
je 0x1010700
push 1
jmp 0x101080a
push ebx
push edi
call fcn.0101294c
test eax, eax
je 0x10107c2
push ebx
push esi
call fcn.0101294c
test eax, eax
jne 0x101081d
mov dword [ebp - 0x10], 1
jmp 0x1010828
push ebx
push esi
push edi
call fcn.0100fdf4
mov dword [ebp - 0x10], eax
push 0x1003934
lea eax, [ebp - 0x4c]
push eax
call fcn.01012091
mov dword [ebp - 4], eax
cmp eax, ebx
je 0x1010700
push 0x1003910
lea eax, [ebp - 0x4c]
push eax
call fcn.01012091
mov edi, eax
mov dword [ebp - 0x18], edi
cmp edi, ebx
je 0x1010700
push edi
push dword [ebp - 4]
push 0x10038c8
push 2
call fcn.01011862
add esp, 0x10
push ebx
push dword [ebp - 0x24]
push dword [ebp + 8]
push dword [ebp + 8]
push dword [ebp - 0x10]
push edi
push dword [ebp - 4]
call fcn.0101013b
test eax, eax
jne 0x10108aa
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push edi
push dword [ebp - 4]
push 0x1003850
push 4
call fcn.01011862
add esp, 0x14
jmp 0x1010cd9
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [ebp - 0x28], ebx
jne 0x10109f6
push 0x1003820
lea eax, [ebp - 0x4c]
push eax
call fcn.01012091
mov dword [ebp - 0xc], eax
push 0x10037d8
lea eax, [ebp - 0x4c]
push eax
call fcn.01012091
mov edi, eax
cmp dword [ebp - 0xc], ebx
je 0x1010946
cmp edi, ebx
je 0x1010946
push edi
call fcn.0100fb01
push 2
push edi
mov ebx, eax
call fcn.01011a13
push 1
push edi
push dword [ebp - 0x1c]
mov dword [ebp - 0x40], eax
call fcn.0100fdf4
test ebx, ebx
je 0x101090f
cmp dword [ebp - 0x40], 1
jne 0x1010954
test eax, eax
je 0x1010954
push dword [ebp - 0xc]
call fcn.01013866
test eax, eax
jne 0x101092f
call esi
push eax
push 0x1003750
push 3
call fcn.01011862
add esp, 0xc
jmp 0x1010954
push edi
push dword [ebp - 0x1c]
call fcn.0100fa7f
test eax, eax
jne 0x1010954
call esi
push eax
push 0x10036b8
jmp 0x1010923
push 0x1003650
push 3
call fcn.01011862
pop ecx
pop ecx
cmp dword [ebp - 0xc], 0
je 0x101096c
push dword [ebp - 0xc]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test edi, edi
je 0x1010980
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push dword [ebp - 4]
xor ebx, ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test eax, eax
je 0x101099a
mov dword [ebp - 4], ebx
push 0x1003614
lea eax, [ebp - 0x4c]
push eax
call fcn.01012091
test byte [ebp + 0xc], 0x80
push 0
pop ecx
setne cl
push ebx
push 6
mov dword [ebp - 0xc], eax
inc ecx
mov edi, ecx
push edi
push ebx
push ebx
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x40], eax
cmp eax, 0xffffffff
jne 0x1010ad5
call esi
cmp eax, 0x50
jne 0x10109e6
cmp edi, 2
jne 0x1010b91
call esi
push eax
push dword [ebp - 0xc]
push 0x10035a0
jmp 0x1010b87
cmp dword [ebp - 0x24], ebx
jne 0x1010980
mov edi, 0x1002f40
cmp dword [ebp + 8], ebx
je 0x1010a3f
cmp dword [ebp - 8], ebx
jne 0x1010a23
push 0x1003958
lea eax, [ebp - 0x4c]
push eax
call fcn.01012091
mov dword [ebp - 8], eax
cmp eax, ebx
je 0x1010700
push edi
push ebx
push dword [ebp - 8]
call fcn.0101277b
test eax, eax
jne 0x1010a3f
call esi
cmp eax, 2
je 0x1010a3f
call esi
jmp 0x1010706
cmp dword [ebp - 0x10], ebx
je 0x1010a53
push dword [ebp - 8]
push dword [ebp - 0x1c]
call fcn.0100fa7f
test eax, eax
je 0x1010a38
push dword [ebp - 8]
call fcn.01013090
test eax, eax
jne 0x1010a7a
call esi
mov esi, eax
push esi
push dword [ebp - 8]
call fcn.01011603
push esi
push dword [ebp - 8]
push 0x1003530
jmp 0x10107d0
push 7
push dword [ebp - 8]
call fcn.0100fc4b
test eax, eax
je 0x1010a38
cmp dword [ebp + 8], ebx
je 0x1010aaa
push edi
push 1
push dword [ebp - 8]
call fcn.0101277b
test eax, eax
je 0x1010a38
push edi
push ebx
push dword [ebp - 0x14]
call fcn.0101277b
test eax, eax
je 0x1010a38
push dword [ebp - 0x14]
call fcn.01013179
test eax, eax
jne 0x1010980
call esi
mov esi, eax
push esi
push dword [ebp - 0x14]
call fcn.01011603
push esi
push dword [ebp - 0x14]
push 0x10034c8
jmp 0x10107d0
mov edi, 0x10000
push edi
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
test ebx, ebx
jne 0x1010b04
push dword [ebp - 0xc]
push 0x1003440
push 3
call fcn.01011862
add esp, 0xc
jmp 0x1010b67
push edi
push 0
push ebx
call sub.msvcrt.dll_memset
add esp, 0xc
push 0
lea eax, [ebp - 0x3c]
push eax
push edi
push ebx
push dword [ebp - 0x40]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1010b3c
call esi
push eax
push dword [ebp - 0xc]
push 0x10035a0
push 3
call fcn.01011862
add esp, 0x10
jmp 0x1010b57
cmp dword [ebp - 0x3c], edi
je 0x1010b57
push edi
push dword [ebp - 0x3c]
push dword [ebp - 0xc]
push 0x10033a8
push 3
call fcn.01011862
add esp, 0x14
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push dword [ebp - 0x40]
call dword [sym.imp.ntdll.dll_NtClose]
push dword [ebp - 0xc]
call fcn.01013090
test eax, eax
jne 0x1010b91
call esi
push eax
push dword [ebp - 0xc]
push 0x1003328
push 3
call fcn.01011862
add esp, 0x10
xor edi, edi
mov ebx, 0x1003048
cmp dword [ebp - 0x28], edi
je 0x1010c2a
cmp dword [ebp - 0x24], edi
jne 0x1010c13
push 0x10032fc
lea eax, [ebp - 0x4c]
push eax
call fcn.01012091
mov dword [ebp - 0x30], eax
push 0x10032c8
lea eax, [ebp - 0x4c]
push eax
call fcn.01012091
push 6
push dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
call fcn.0100fc4b
test eax, eax
jne 0x1010be1
call esi
cmp eax, 2
jne 0x1010a38
push 6
push dword [ebp - 0x34]
call fcn.0100fc4b
test eax, eax
jne 0x1010bfa
call esi
cmp eax, 2
jne 0x1010a38
push 6
push dword [ebp - 0xc]
call fcn.0100fc4b
test eax, eax
jne 0x1010c13
call esi
cmp eax, 2
jne 0x1010a38
cmp dword [ebp + 8], edi
je 0x1010c2a
push ebx
push edi
push dword [ebp - 0x18]
call fcn.0101277b
test eax, eax
je 0x1010a38
test byte [ebp + 0xc], 8
je 0x1010ca5
push 0x10032a4
lea eax, [ebp - 0x4c]
push eax
call fcn.01012091
mov dword [ebp - 4], eax
cmp eax, edi
je 0x1010a38
push 0x1003270
lea eax, [ebp - 0x4c]
push eax
call fcn.01012091
mov edi, eax
mov dword [ebp - 0x38], edi
test edi, edi
je 0x1010a38
push edi
push dword [ebp - 4]
push 0x1003228
push 2
call fcn.01011862
add esp, 0x10
push 0
push dword [ebp - 0x24]
push dword [ebp + 8]
push dword [ebp + 8]
push dword [ebp - 0x10]
push edi
push dword [ebp - 4]
call fcn.0101013b
test eax, eax
jne 0x1010ca5
call esi
mov esi, eax
push esi
push edi
push dword [ebp - 4]
push 0x10031b8
jmp 0x101089b
cmp dword [ebp - 0x28], 0
je 0x1010cd6
push 6
push dword [ebp - 0x18]
call fcn.0100fc4b
test eax, eax
je 0x1010a38
cmp dword [ebp + 8], 0
je 0x1010cd6
push ebx
push 1
push dword [ebp - 0x18]
call fcn.0101277b
test eax, eax
je 0x1010a38
mov esi, dword [ebp - 0x44]
call fcn.0101183c
xor edi, edi
cmp dword [ebp - 0x20], edi
je 0x1010cee
push edi
push dword [ebp - 0x20]
call fcn.0101252a
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
cmp dword [ebp - 4], edi
je 0x1010d0b
push dword [ebp - 4]
push 0
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_HeapFree]
push eax
call edi
jmp 0x1010d11
mov edi, dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [ebp - 0x38], 0
je 0x1010d21
push dword [ebp - 0x38]
push 0
call ebx
push eax
call edi
cmp dword [ebp - 0x18], 0
je 0x1010d31
push dword [ebp - 0x18]
push 0
call ebx
push eax
call edi
cmp dword [ebp - 0x1c], 0
je 0x1010d41
push dword [ebp - 0x1c]
push 0
call ebx
push eax
call edi
cmp dword [ebp - 0x14], 0
je 0x1010d51
push dword [ebp - 0x14]
push 0
call ebx
push eax
call edi
cmp dword [ebp - 8], 0
je 0x1010d61
push dword [ebp - 8]
push 0
call ebx
push eax
call edi
cmp dword [ebp - 0x30], 0
je 0x1010d71
push dword [ebp - 0x30]
push 0
call ebx
push eax
call edi
cmp dword [ebp - 0x34], 0
je 0x1010d81
push dword [ebp - 0x34]
push 0
call ebx
push eax
call edi
cmp dword [ebp - 0xc], 0
je 0x1010d91
push dword [ebp - 0xc]
push 0
call ebx
push eax
call edi
cmp dword [ebp - 0x20], 0
je 0x1010da9
push dword [ebp - 0x20]
push 0
call ebx
push eax
call edi
test eax, eax
je 0x1010da9
and dword [ebp - 0x20], 0
cmp dword [ebp - 0x2c], 0
je 0x1010dc1
push dword [ebp - 0x2c]
push 0
call ebx
push eax
call edi
test eax, eax
je 0x1010dc1
and dword [ebp - 0x2c], 0
test esi, esi
je 0x1010dd0
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x1010dd3
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 8