Function at 0x1008c6d8
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x74]
sub esp, 0x94
push ebx
push esi
mov esi, ecx
push edi
xor edi, edi
cmp esi, edi
mov dword [ebp + 0x60], esi
mov dword [ebp + 0x70], edi
mov eax, esi
je 0x1008c700
mov eax, dword [eax + 0x4c]
inc dword [ebp + 0x70]
cmp eax, edi
jne 0x1008c6f6
mov eax, dword [0x101d80a8]
cmp eax, edi
mov ebx, 0x101d80a8
je 0x1008c71d
mov ecx, dword [esi]
cmp eax, ecx
je 0x1008c71d
add ebx, 0x24
mov eax, dword [ebx]
cmp eax, edi
jne 0x1008c710
cmp dword [ebx], edi
jne 0x1008c72b
mov eax, 0x80004005
jmp 0x1008c8ef
push dword [esi]
call fcn.1008533c
mov dword [ebp + 0x6c], eax
mov eax, dword [eax + 8]
shr eax, 3
push edi
mov dword [ebp + 0x64], eax
lea eax, [ebp + 0x68]
push eax
push 4
lea eax, [ebp + 0x5c]
push eax
push dword [ebp + 0x7c]
mov dword [ebp + 0x5c], 0x20534444
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0x1f
pop ecx
xor eax, eax
lea edi, [ebp - 0x20]
rep stosd dword es:[edi], eax
mov eax, dword [esi + 0x10]
push 0x7c
pop edx
mov dword [ebp - 0x18], eax
mov eax, dword [esi + 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebx + 8]
test al, 3
push 8
lea esi, [ebx + 4]
pop ecx
lea edi, [ebp + 0x28]
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], 0x1007
rep movsd dword es:[edi], dword [esi]
mov dword [ebp + 0x48], 0x1000
je 0x1008c79c
mov dword [ebp + 0x48], 0x1002
test al, 0x20
je 0x1008c7a4
or byte [ebp + 0x49], 1
mov esi, dword [ebp + 0x60]
xor edi, edi
cmp dword [esi + 0x4c], edi
je 0x1008c7c2
mov eax, dword [ebp + 0x70]
or dword [ebp + 0x48], 0x400008
mov dword [ebp - 0x1c], 0x21007
mov dword [ebp - 8], eax
cmp dword [esi + 0x50], edi
je 0x1008c7cf
or dword [ebp + 0x48], 8
or byte [ebp + 0x4d], 0xfe
mov eax, dword [esi + 0x14]
cmp eax, 1
jbe 0x1008c7e2
or byte [ebp - 0x1a], 0x80
or byte [ebp + 0x4e], 0x20
mov dword [ebp - 0xc], eax
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
lea eax, [ebp + 0x68]
push eax
push edx
lea eax, [ebp - 0x20]
push eax
push dword [ebp + 0x7c]
call ebx
mov eax, dword [ebp + 0x6c]
cmp dword [eax + 4], 1
jne 0x1008c812
push edi
lea eax, [ebp + 0x68]
push eax
push 0x400
push dword [esi + 8]
push dword [ebp + 0x7c]
call ebx
mov dword [ebp + 0x6c], esi
mov esi, dword [ebp + 0x6c]
jmp 0x1008c8d4
cmp dword [esi + 0x14], edi
mov dword [ebp + 0x70], edi
jbe 0x1008c8cf
mov eax, dword [esi + 0x10]
xor edi, edi
test eax, eax
jbe 0x1008c8c0
mov eax, dword [ebp + 0x60]
mov eax, dword [eax]
mov ecx, 0x34545844
cmp eax, ecx
jg 0x1008c92b
je 0x1008c872
cmp eax, 0x31545844
je 0x1008c8f9
cmp eax, 0x32545844
je 0x1008c872
cmp eax, 0x32595559
je 0x1008c978
cmp eax, 0x33545844
jne 0x1008c94b
mov eax, dword [esi + 0x1c]
mov ecx, dword [esi + 0x28]
add ecx, dword [ebp + 0x70]
add eax, edi
imul ecx, dword [esi + 0x34]
shr eax, 2
imul eax, dword [esi + 0x30]
add eax, ecx
mov ecx, dword [esi + 0x18]
shr ecx, 2
shl ecx, 4
add eax, ecx
mov ecx, dword [esi + 0xc]
add ecx, 3
shr ecx, 2
shl ecx, 4
add eax, dword [esi + 4]
add edi, 3
push 0
lea edx, [ebp + 0x68]
push edx
push ecx
push eax
push dword [ebp + 0x7c]
call ebx
mov eax, dword [esi + 0x10]
inc edi
cmp edi, eax
jb 0x1008c836
inc dword [ebp + 0x70]
mov ecx, dword [ebp + 0x70]
cmp ecx, dword [esi + 0x14]
jb 0x1008c82c
mov esi, dword [esi + 0x4c]
xor edi, edi
cmp esi, edi
jne 0x1008c81d
mov eax, dword [ebp + 0x6c]
mov eax, dword [eax + 0x50]
cmp eax, edi
mov dword [ebp + 0x6c], eax
jne 0x1008c815
xor eax, eax
pop edi
pop esi
pop ebx
add ebp, 0x74
leave
ret 4
mov eax, dword [esi + 0x1c]
mov ecx, dword [esi + 0x28]
add ecx, dword [ebp + 0x70]
add eax, edi
imul ecx, dword [esi + 0x34]
shr eax, 2
imul eax, dword [esi + 0x30]
add eax, ecx
mov ecx, dword [esi + 0x18]
shr ecx, 2
lea eax, [eax + ecx*8]
mov ecx, dword [esi + 0xc]
add ecx, 3
shr ecx, 2
shl ecx, 3
jmp 0x1008c8a1
cmp eax, 0x35545844
je 0x1008c872
cmp eax, 0x42475247
je 0x1008c978
cmp eax, 0x47424752
je 0x1008c978
cmp eax, 0x59565955
je 0x1008c978
mov eax, dword [esi + 0x28]
add eax, dword [ebp + 0x70]
mov ecx, dword [esi + 0x1c]
imul eax, dword [esi + 0x34]
add ecx, edi
imul ecx, dword [esi + 0x30]
add eax, ecx
mov ecx, dword [esi + 0x18]
imul ecx, dword [ebp + 0x64]
add eax, ecx
mov ecx, dword [esi + 0xc]
add eax, dword [esi + 4]
imul ecx, dword [ebp + 0x64]
jmp 0x1008c8a7
mov eax, dword [esi + 0x28]
add eax, dword [ebp + 0x70]
mov ecx, dword [esi + 0x1c]
imul eax, dword [esi + 0x34]
add ecx, edi
imul ecx, dword [esi + 0x30]
add eax, ecx
mov ecx, dword [esi + 0x18]
imul ecx, dword [ebp + 0x64]
add eax, ecx
add eax, dword [esi + 4]
mov ecx, dword [esi + 0xc]
inc ecx
shr ecx, 1
shl ecx, 2
jmp 0x1008c8a7