Function at 0xde89e2
Capabilities:
Write file on windows

Disassembly:
push 0
lea ecx, [ebp - 0x38]
call fcn.00de8cbf
mov dword [ebp - 4], 1
test esi, esi
jl 0xde1a47
push dword [ebp - 0x34]
mov ecx, edi
call fcn.00de174b
mov esi, eax
test esi, esi
jl 0xde1a47
push dword [ebp + 0xc]
mov ecx, edi
call fcn.00de1b46
mov esi, eax
push dword [ebp - 0x34]
mov dword [ebp - 0x38], 0xde1660
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
or dword [ebp - 4], 0xffffffff
xor ebx, ebx
inc ebx
test esi, esi
jl 0xde1b1f
xor eax, eax
cmp dword [edi + 0x3c], 2
je 0xdef6cc
test esi, esi
jl 0xde1b1f
push dword [edi + eax*4 + 0x34]
mov ecx, edi
push dword [0xdfb46c]
call fcn.00de16c1
mov dword [ebp - 0x2c], eax
test eax, eax
je 0xde97fd
push ebx
push eax
mov ecx, edi
call fcn.00de1570
mov esi, eax
test esi, esi
jl 0xde1b02
push ebx
push dword [0xdfb490]
mov ecx, edi
call fcn.00de1570
mov esi, eax
test esi, esi
jl 0xde1b02
push ebx
push dword [0xdfb444]
mov ecx, edi
call fcn.00de1570
mov esi, eax
test esi, esi
jl 0xde1b02
push ebx
push dword [ebp - 0x2c]
mov ecx, edi
call fcn.00de1570
mov esi, eax
test esi, esi
jl 0xde1b02
push ebx
push dword [0xdfb498]
mov ecx, edi
call fcn.00de1570
mov esi, eax
test esi, esi
jl 0xde1b02
push ebx
push dword [0xdfb444]
mov ecx, edi
call fcn.00de1570
mov esi, eax
push dword [ebp - 0x2c]
call fcn.00de13c0
pop ecx
test esi, esi
jl 0xde1b1f
push ebx
push dword [0xdfb444]
mov ecx, edi
call fcn.00de1570
mov esi, eax
xor eax, eax
cmp esi, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x34], eax
jl 0xde982f
cmp dword [ebp + 0x10], 0xffffffff
je 0xde920d
mov dword [ebp - 0x20], eax
jmp 0xde1c83
test esi, esi
jl 0xde1c2c
push 1
push dword [0xdfb444]
mov ecx, edi
call fcn.00de1570
mov esi, eax
cmp dword [ebp + 0xc], 0
je 0xde1c4b
test esi, esi
jl 0xde1c4b
push 0xbb8
push 0xa
push 0x64
push 0x3e8
push 3
call sub.wbemcomn.dll_long_int___stdcall_Throttle_unsigned_long_int__unsigned_long_int__unsigned_long_int__unsigned_long_int__unsigned_long_int_
lea ecx, [ebp - 0x2c]
call fcn.00de13f8
inc dword [ebp - 0x1c]
mov ebx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x20]
imul eax, eax, 0x18
cmp ebx, dword [eax + edi + 0x10]
je 0xde9204
test esi, esi
jl 0xde9204
mov eax, dword [ebx + 0x10]
add eax, 8
mov eax, dword [eax + 8]
and dword [ebp - 0x14], 0
mov dword [ebp - 0x30], eax
jmp 0xde1cae
mov eax, dword [ebp - 0x20]
cmp eax, dword [edi + 0x30]
jae 0xde920d
test esi, esi
jl 0xde982f
imul eax, eax, 0x18
add eax, edi
cmp dword [eax + 0x14], 0
jne 0xde1ef7
inc dword [ebp - 0x20]
xor ebx, ebx
inc ebx
jmp 0xde1c83
mov eax, dword [ebp - 0x14]
cmp eax, dword [edi + 0x3c]
jae 0xde1c17
test esi, esi
jl 0xde1c2c
cmp eax, dword [ebp - 0x30]
jae 0xde1c17
mov eax, dword [ebx + 0x10]
push dword [ebp - 0x1c]
mov eax, dword [eax + 4]
push eax
mov ecx, edi
call fcn.00de14ef
mov esi, eax
test esi, esi
je 0xde9807
mov eax, dword [ebp - 0x14]
push dword [edi + eax*4 + 0x34]
mov ecx, edi
push esi
call fcn.00de16c1
push esi
mov dword [ebp - 0x24], eax
call fcn.00de13c0
cmp dword [ebp - 0x24], 0
pop ecx
je 0xde9807
push 1
push dword [ebp - 0x24]
mov ecx, edi
call fcn.00de1570
mov esi, eax
test esi, esi
jl 0xde1e03
push 1
push dword [0xdfb44c]
mov ecx, edi
call fcn.00de1570
mov esi, eax
test esi, esi
jl 0xde1e03
push 1
push dword [0xdfb448]
mov ecx, edi
call fcn.00de1570
mov esi, eax
test esi, esi
jl 0xde1e03
mov eax, dword [ebx + 0x10]
mov ecx, dword [ebp - 0x14]
add eax, 8
mov eax, dword [eax + 4]
shl ecx, 2
add eax, ecx
mov eax, dword [eax]
mov eax, dword [eax + 4]
push 1
push eax
mov ecx, edi
call fcn.00de1570
mov esi, eax
test esi, esi
jl 0xde1e03
push 1
push dword [0xdfb444]
mov ecx, edi
call fcn.00de1570
mov esi, eax
test esi, esi
jl 0xde1e03
push 1
push dword [ebp - 0x24]
mov ecx, edi
call fcn.00de1570
mov esi, eax
test esi, esi
jl 0xde1e03
push 1
push dword [0xdfb450]
mov ecx, edi
call fcn.00de1570
mov esi, eax
test esi, esi
jl 0xde1e03
push 1
push dword [0xdfb448]
mov ecx, edi
call fcn.00de1570
mov esi, eax
test esi, esi
jl 0xde1e03
mov eax, dword [ebx + 0x10]
mov ecx, dword [ebp - 0x14]
add eax, 8
mov eax, dword [eax + 4]
shl ecx, 2
add eax, ecx
mov eax, dword [eax]
mov eax, dword [eax + 8]
push 1
push eax
mov ecx, edi
call fcn.00de1570
mov esi, eax
test esi, esi
jl 0xde1e03
push 1
push dword [0xdfb444]
mov ecx, edi
call fcn.00de1570
mov esi, eax
push dword [ebp - 0x24]
call fcn.00de13c0
pop ecx
inc dword [ebp - 0x14]
jmp 0xde1cae
mov eax, dword [eax + 0x10]
mov ebx, dword [eax]
mov dword [ebp - 4], 5
mov dword [ebp - 0x2c], ebx
jmp 0xde1c59
push 0x2c
mov eax, 0xdf6d28
call fcn.00de1350
mov edi, ecx
mov dword [ebp - 0x28], edi
mov eax, dword [ebp + 8]
xor ecx, ecx
mov esi, 0x8000ffff
cmp eax, ecx
je 0xde97d4
cmp word [eax], cx
je 0xde97d4
cmp dword [ebp + 0x10], ecx
jne 0xde8a1c
cmp dword [edi + 0x30], ecx
je 0xde97d4
push dword [ebp + 8]
and dword [ebp - 4], 0
mov dword [ebp - 0x18], ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ebx, eax
add ebx, 0xa
xor ecx, ecx
push 2
pop edx
mov eax, ebx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00de13e0
pop ecx
mov dword [ebp - 0x18], eax
test eax, eax
je 0xdef687
push dword [ebp + 8]
push ebx
push eax
call fcn.00de21cb
mov esi, eax
test esi, esi
jl 0xde1a57
push 0xde8ca8
push ebx
push dword [ebp - 0x18]
call fcn.00de2436
mov esi, eax
test esi, esi
jl 0xde1a57
push dword [ebp - 0x18]
mov ecx, edi
call fcn.00de7f3e
mov esi, eax
test esi, esi
jl 0xde1a57
and dword [ebp - 0x24], 0
mov ebx, 0xde8ca4
push ebx
mov esi, 0x80004005
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push 0
lea ecx, [ebp - 0x24]
push ecx
mov dword [ebp - 0x2c], eax
push dword [ebp - 0x2c]
mov eax, dword [edi + 0x44]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0xde1a57
mov eax, dword [ebp - 0x2c]
cmp eax, dword [ebp - 0x24]
jne 0xde1a57
xor esi, esi
mov dword [ebp - 0x38], 0xde1660
mov dword [ebp - 0x34], esi
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 1
call fcn.00de8742
push esi
lea ecx, [ebp - 0x38]
call fcn.00de83a7
push 0xde7ec8
lea ecx, [ebp - 0x38]
call fcn.00de83a7
push esi
lea ecx, [ebp - 0x38]
call fcn.00de83a7
push 0xde7eac
lea ecx, [ebp - 0x38]
call fcn.00de83a7
push dword [ebp + 8]
lea ecx, [ebp - 0x38]
call fcn.00de83a7
push esi
lea ecx, [ebp - 0x38]
call fcn.00de83a7
push 0xde7e98
lea ecx, [ebp - 0x38]
call fcn.00de83a7
push esi
lea ecx, [ebp - 0x38]
call fcn.00de83a7
push 0xde8c18
lea ecx, [ebp - 0x38]
call fcn.00de83a7
push esi
lea ecx, [ebp - 0x38]
call fcn.00de83a7
lea ecx, [ebp - 0x38]
call fcn.00de86ef
push esi
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 2
call fcn.00de8cbf
push dword [0xdfb4a4]
lea ecx, [ebp - 0x38]
call fcn.00de8cbf
push dword [0xdfb49c]
lea ecx, [ebp - 0x38]
call fcn.00de8cbf
push dword [ebp + 8]
lea ecx, [ebp - 0x38]
call fcn.00de8cbf
push esi
lea ecx, [ebp - 0x38]
call fcn.00de8cbf
push dword [0xdfb4a0]
lea ecx, [ebp - 0x38]
call fcn.00de8cbf
push dword [ebp + 8]
lea ecx, [ebp - 0x38]
call fcn.00de8cbf
push 0xde88c4
lea ecx, [ebp - 0x38]
call fcn.00de8cbf
push esi
lea ecx, [ebp - 0x38]
call fcn.00de8cbf
push esi
lea ecx, [ebp - 0x38]
call fcn.00de8cbf
push dword [0xdfb4ac]
lea ecx, [ebp - 0x38]
call fcn.00de8cbf
xor ebx, ebx
cmp ebx, dword [edi + 0x3c]
jae 0xde1a16
push dword [edi + ebx*4 + 0x34]
mov ecx, edi
call fcn.00de88ef
mov dword [ebp - 0x2c], eax
test eax, eax
je 0xde97f3
push eax
lea ecx, [ebp - 0x38]
call fcn.00de8cbf
push dword [ebp - 0x2c]
call fcn.00de13c0
pop ecx
inc ebx
jmp 0xde8be4
cmp dword [ebp + 0xc], 0
je 0xde8e21
test esi, esi
jl 0xde8e21
push 0xbb8
push 0xa
push 0x64
push 0x3e8
push 3
call sub.wbemcomn.dll_long_int___stdcall_Throttle_unsigned_long_int__unsigned_long_int__unsigned_long_int__unsigned_long_int__unsigned_long_int_
lea ecx, [ebp - 0x20]
call fcn.00de13f8
inc dword [ebp - 0x1c]
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x20]
imul eax, eax, 0x18
cmp ecx, dword [eax + edi + 0x10]
je 0xde97ea
test esi, esi
jl 0xde97ea
and dword [ebp + 0x10], 0
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0x10]
mov ecx, dword [ebp + 0x10]
cmp ecx, dword [eax + 0x1c]
jae 0xde8e02
test esi, esi
jl 0xde8e02
mov eax, dword [eax + 0x18]
shl ecx, 2
mov eax, dword [ecx + eax]
cmp dword [eax + 0x10], 0
je 0xde902c
mov eax, dword [eax + 0x14]
and dword [ebp - 0x14], 0
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [edi + 0x3c]
jae 0xde9017
test esi, esi
jl 0xde902c
cmp eax, dword [ebp - 0x34]
jae 0xde9017
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0x10]
mov ecx, dword [ebp + 0x10]
push dword [ebp - 0x1c]
add eax, 0x14
mov eax, dword [eax + 4]
shl ecx, 2
add eax, ecx
mov eax, dword [eax]
mov eax, dword [eax + 4]
push eax
mov ecx, edi
call fcn.00de14ef
mov esi, eax
test esi, esi
je 0xde9825
mov eax, dword [ebp - 0x14]
push dword [edi + eax*4 + 0x34]
mov ecx, edi
push esi
call fcn.00de16c1
push esi
mov dword [ebp - 0x2c], eax
call fcn.00de13c0
cmp dword [ebp - 0x2c], 0
pop ecx
je 0xde9825
push 1
push dword [ebp - 0x2c]
mov ecx, edi
call fcn.00de1570
mov esi, eax
test esi, esi
jl 0xde9006
push 1
push dword [0xdfb44c]
mov ecx, edi
call fcn.00de1570
mov esi, eax
test esi, esi
jl 0xde9006
push 1
push dword [0xdfb448]
mov ecx, edi
call fcn.00de1570
mov esi, eax
test esi, esi
jl 0xde9006
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0x10]
mov ecx, dword [ebp + 0x10]
mov ebx, dword [ebp - 0x14]
add eax, 0x14
mov eax, dword [eax + 4]
shl ecx, 2
add eax, ecx
mov eax, dword [eax]
add eax, 0xc
mov eax, dword [eax + 4]
shl ebx, 2
add eax, ebx
mov eax, dword [eax]
mov eax, dword [eax + 4]
push 1
push eax
mov ecx, edi
call fcn.00de1570
mov esi, eax
test esi, esi
jl 0xde9006
push 1
push dword [0xdfb444]
mov ecx, edi
call fcn.00de1570
mov esi, eax
test esi, esi
jl 0xde9006
push 1
push dword [ebp - 0x2c]
mov ecx, edi
call fcn.00de1570
mov esi, eax
test esi, esi
jl 0xde9006
push 1
push dword [0xdfb450]
mov ecx, edi
call fcn.00de1570
mov esi, eax
test esi, esi
jl 0xde9006
push 1
push dword [0xdfb448]
mov ecx, edi
call fcn.00de1570
mov esi, eax
test esi, esi
jl 0xde9006
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0x10]
mov ecx, dword [ebp + 0x10]
add eax, 0x14
mov eax, dword [eax + 4]
shl ecx, 2
add eax, ecx
mov eax, dword [eax]
add eax, 0xc
mov eax, dword [eax + 4]
add eax, ebx
mov eax, dword [eax]
mov eax, dword [eax + 8]
push 1
push eax
mov ecx, edi
call fcn.00de1570
mov esi, eax
test esi, esi
jl 0xde9006
push 1
push dword [0xdfb444]
mov ecx, edi
call fcn.00de1570
mov esi, eax
push dword [ebp - 0x2c]
call fcn.00de13c0
pop ecx
inc dword [ebp - 0x14]
jmp 0xde8e7a
test esi, esi
jl 0xde902c
push 1
push dword [0xdfb444]
mov ecx, edi
call fcn.00de1570
mov esi, eax
inc dword [ebp + 0x10]
jmp 0xde8e4b
mov eax, dword [ebp - 0x24]
cmp eax, dword [edi + 0x30]
jae 0xde9724
test esi, esi
jl 0xde982f
imul eax, eax, 0x18
lea ebx, [eax + edi]
cmp dword [ebx + 0x14], 0
jne 0xde9390
inc dword [ebp - 0x24]
xor ebx, ebx
inc ebx
jmp 0xde9034
or dword [ebp - 4], 0xffffffff
jmp 0xde1ca6
test esi, esi
jl 0xde982f
xor eax, eax
cmp dword [edi + 0x3c], 2
je 0xdef830
test esi, esi
jl 0xde982f
lea eax, [edi + eax*4 + 0x34]
push dword [eax]
mov ecx, edi
push dword [0xdfb4b0]
mov dword [ebp - 0x30], eax
call fcn.00de16c1
mov dword [ebp - 0x2c], eax
test eax, eax
je 0xde9811
push ebx
push eax
mov ecx, edi
call fcn.00de1570
mov esi, eax
test esi, esi
jl 0xde92a2
push ebx
push dword [0xdfb4b8]
mov ecx, edi
call fcn.00de1570
mov esi, eax
test esi, esi
jl 0xde92a2
push ebx
push dword [0xdfb444]
mov ecx, edi
call fcn.00de1570
mov esi, eax
test esi, esi
jl 0xde92a2
push ebx
push dword [ebp - 0x2c]
mov ecx, edi
call fcn.00de1570
mov esi, eax
test esi, esi
jl 0xde92a2
push ebx
push dword [0xdfb4c0]
mov ecx, edi
call fcn.00de1570
mov esi, eax
push dword [ebp - 0x2c]
call fcn.00de13c0
pop ecx
test esi, esi
jl 0xde982f
push ebx
push dword [0xdfb444]
mov ecx, edi
call fcn.00de1570
mov esi, eax
test esi, esi
jl 0xde982f
mov eax, dword [ebp - 0x30]
push dword [eax]
mov ecx, edi
push dword [0xdfb4b4]
call fcn.00de16c1
mov dword [ebp - 0x2c], eax
test eax, eax
je 0xde981b
push ebx
push dword [0xdfb444]
mov ecx, edi
call fcn.00de1570
mov esi, eax
test esi, esi
jl 0xde9356
push ebx
push dword [ebp - 0x2c]
mov ecx, edi
call fcn.00de1570
mov esi, eax
test esi, esi
jl 0xde9356
push ebx
push dword [0xdfb4bc]
mov ecx, edi
call fcn.00de1570
mov esi, eax
test esi, esi
jl 0xde9356
push ebx
push dword [0xdfb444]
mov ecx, edi
call fcn.00de1570
mov esi, eax
test esi, esi
jl 0xde9356
push ebx
push dword [ebp - 0x2c]
mov ecx, edi
call fcn.00de1570
mov esi, eax
test esi, esi
jl 0xde9356
push ebx
push dword [0xdfb4c4]
mov ecx, edi
call fcn.00de1570
mov esi, eax
push dword [ebp - 0x2c]
call fcn.00de13c0
pop ecx
test esi, esi
jl 0xde982f
cmp dword [ebp + 0x10], 0xffffffff
je 0xde9724
push ebx
push dword [0xdfb444]
mov ecx, edi
call fcn.00de1570
and dword [ebp - 0x24], 0
mov esi, eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x1c], eax
jmp 0xde9034
push 1
push dword [0xdfb444]
mov ecx, edi
mov dword [ebp - 4], 7
call fcn.00de1570
mov ebx, dword [ebx + 0x10]
mov esi, eax
mov eax, dword [ebx]
mov dword [ebp - 0x20], eax
jmp 0xde8e2c
test esi, esi
jl 0xde982f
push ebx
mov ecx, edi
call fcn.00de2667
mov esi, eax
test esi, esi
jl 0xde982f
push dword [ebp + 8]
and dword [ebp + 0x10], 0
mov dword [ebp - 4], 9
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ebx, eax
add ebx, 6
xor ecx, ecx
push 2
pop edx
mov eax, ebx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00de13e0
pop ecx
mov dword [ebp + 0x10], eax
test eax, eax
je 0xdefae5
push dword [ebp + 8]
push ebx
push dword [ebp + 0x10]
call fcn.00de21cb
mov esi, eax
test esi, esi
jl 0xde97ae
push 0xde97e0
push ebx
push dword [ebp + 0x10]
call fcn.00de2436
mov esi, eax
test esi, esi
jl 0xde97ae
push dword [ebp + 0x10]
mov ecx, edi
push dword [ebp - 0x18]
call fcn.00de24ed
mov esi, eax
or dword [ebp - 4], 0xffffffff
cmp dword [ebp + 0x10], 0
je 0xde97c1
push dword [ebp + 0x10]
call fcn.00de13c0
pop ecx
test esi, esi
jl 0xde982f
cmp dword [ebp - 0x18], 0
je 0xde97d4
push dword [ebp - 0x18]
call fcn.00de13c0
pop ecx
mov eax, esi
call fcn.00de1390
ret 0xc
or dword [ebp - 4], 0xffffffff
jmp 0xde9058
mov esi, 0x8007000e
jmp 0xde8c15
mov esi, 0x8007000e
jmp 0xde1b0b
mov esi, 0x8007000e
jmp 0xde1e0c
mov esi, 0x8007000e
jmp 0xde92ab
mov esi, 0x8007000e
jmp 0xde935f
mov esi, 0x8007000e
jmp 0xde900f
mov ecx, edi
call fcn.00de26bf
jmp 0xdefb0b