Function at 0x101a10a
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1c78
call fcn.0101ef70
mov eax, dword [0x1042bc4]
xor eax, dword [ebp + 4]
mov dword [ebp - 4], eax
xor eax, eax
cmp dword [0x10237f0], eax
mov dword [ebp - 8], eax
je 0x101a7fe
push ebx
push esi
mov esi, dword [ebp + 0x14]
cmp esi, eax
push edi
mov edi, dword [ebp + 8]
jne 0x101a145
mov dword [ebp - 0x2c], eax
jmp 0x101a1b1
mov ebx, dword [esi + 0x24]
cmp ebx, 7
mov dword [ebp - 0x2c], ebx
jg 0x101a7fb
mov eax, dword [esi + 4]
push dword [eax + 4]
call dword [sym.imp.WS2_32.dll_ntohl]
and eax, 0xf0000000
cmp eax, 0xe0000000
jne 0x101a19c
cmp edi, 7
je 0x101a19c
cmp ebx, 2
jne 0x101a181
push esi
push dword [esi + 4]
call fcn.0101ba74
jmp 0x101a189
push dword [esi + 4]
call fcn.0101a9bf
test eax, eax
je 0x101a7fb
add eax, 0x44
cmp dword [eax], eax
je 0x101a7fb
lea eax, [ebx + ebx*4]
shl eax, 4
lea eax, [eax + 0x10208b0]
cmp dword [eax], 0
je 0x101a7fb
mov dword [ebp + 8], eax
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
lea eax, [edi - 1]
cmp eax, 9
ja case.default.0x101a1ca
jmp dword [eax*4 + 0x101a80d]
lea eax, [ebp - 0x70]
push eax
push dword [ebp + 0x10]
call fcn.0101b6d0
mov ebx, 0x1002c68
jmp 0x101a1f5
lea eax, [ebp - 0x70]
push eax
push dword [ebp + 0x10]
call fcn.0101b6d0
mov ebx, 0x1002c60
lea eax, [ebp - 0x4c]
push eax
push dword [ebp + 0xc]
call fcn.0101b6d0
jmp 0x101a31b
lea eax, [ebp - 0x70]
push eax
push dword [ebp + 0x10]
call fcn.0101b6d0
lea eax, [ebp - 0x4c]
push eax
push dword [ebp + 0xc]
mov ebx, 0x1002c68
call fcn.0101b6d0
lea edi, [ebp - 0x4c]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x101a227
mov esi, 0x1002c50
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
jmp 0x101a2cb
lea eax, [ebp - 0x70]
push eax
push dword [ebp + 0x10]
call fcn.0101b6d0
lea eax, [ebp - 0x4c]
push eax
push dword [ebp + 0xc]
mov ebx, 0x1002c68
call fcn.0101b6d0
lea edi, [ebp - 0x4c]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x101a25d
mov esi, 0x1002c44
jmp 0x101a2c7
lea eax, [ebp - 0x70]
push eax
push dword [ebp + 0x10]
call fcn.0101b6d0
lea eax, [ebp - 0x4c]
push eax
push dword [ebp + 0xc]
mov ebx, 0x1002c60
call fcn.0101b6d0
lea edi, [ebp - 0x4c]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x101a28d
jmp 0x101a265
lea eax, [ebp - 0x70]
push eax
push dword [ebp + 0x10]
call fcn.0101b6d0
lea eax, [ebp - 0x4c]
push eax
push dword [ebp + 0xc]
mov ebx, 0x1002c60
call fcn.0101b6d0
lea edi, [ebp - 0x4c]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x101a2b8
mov esi, 0x1002c30
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
jmp 0x101a31b
mov esi, 0x1002c24
lea edi, [ebp - 0x70]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
jmp 0x101a312
mov esi, 0x1002c14
lea edi, [ebp - 0x70]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
jmp 0x101a2fd
mov esi, 0x1002c04
jmp 0x101a2e0
push 6
pop ecx
mov esi, 0x1002bec
lea edi, [ebp - 0x70]
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp + 0x18]
mov dword [ebp - 8], eax
jmp 0x101a312
mov esi, 0x1002bdc
lea edi, [ebp - 0x70]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
and byte [ebp - 0x4c], 0
mov ebx, 0x10016d0
cmp dword [ebp + 0x18], 0
je 0x101a364
push dword [ebp - 8]
lea eax, [ebp - 0x70]
push eax
movzx eax, word [ebp - 0xa]
push eax
movzx eax, word [ebp - 0xc]
push eax
movzx eax, word [ebp - 0xe]
push eax
movzx eax, word [ebp - 0x10]
mov ebx, dword [sym.imp.msvcrt.dll_sprintf]
push eax
movzx eax, word [ebp - 0x12]
push eax
movzx eax, word [ebp - 0x16]
push eax
movzx eax, word [ebp - 0x18]
push eax
lea eax, [ebp - 0x1c78]
push 0x1002bb0
push eax
call ebx
add esp, 0x2c
jmp 0x101a3b1
mov eax, dword [ebp - 0x2c]
push dword [eax*4 + 0x10208dc]
lea eax, [ebp - 0x4c]
push eax
push ebx
lea eax, [ebp - 0x70]
push eax
movzx eax, word [ebp - 0xa]
push eax
movzx eax, word [ebp - 0xc]
push eax
movzx eax, word [ebp - 0xe]
push eax
movzx eax, word [ebp - 0x10]
mov ebx, dword [sym.imp.msvcrt.dll_sprintf]
push eax
movzx eax, word [ebp - 0x12]
push eax
movzx eax, word [ebp - 0x16]
push eax
movzx eax, word [ebp - 0x18]
push eax
lea eax, [ebp - 0x1c78]
push 0x1002b80
push eax
call ebx
add esp, 0x34
lea eax, [ebp - 0x1c78]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x101a3ba
sub eax, edx
cmp dword [ebp + 8], 0
mov dword [ebp + 0x10], eax
je 0x101a79a
mov eax, dword [ebp + 8]
mov eax, dword [eax]
test eax, eax
je 0x101a79a
and byte [ebp - 0xc74], 0
dec eax
cmp eax, 0xe
ja case.0x101a3ee.2
jmp dword [eax*4 + 0x101a835]
mov esi, dword [ebp + 0x14]
lea eax, [ebp - 0x28]
push eax
mov eax, dword [esi + 4]
push dword [eax + 4]
call fcn.0101b6d0
mov eax, dword [esi + 4]
movzx ecx, byte [eax + 8]
movzx eax, word [eax + 0xa]
push ecx
push eax
call dword [sym.imp.WS2_32.dll_ntohs]
movzx eax, ax
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0xc74]
push 0x1002b74
push eax
call ebx
add esp, 0x14
jmp 0x101a74c
mov esi, dword [ebp + 0x14]
lea eax, [ebp - 0x28]
push eax
mov eax, dword [esi + 0xc]
push dword [eax + 4]
call fcn.0101b6d0
mov eax, dword [esi + 0xc]
push dword [eax + 8]
call dword [sym.imp.WS2_32.dll_ntohl]
push eax
lea eax, [ebp - 0x28]
push eax
push 0x1002b68
jmp 0x101a5e5
mov eax, dword [ebp + 0x14]
mov eax, dword [eax + 0x10]
push dword [eax + 4]
jmp 0x101a646
mov esi, dword [ebp + 0x14]
lea eax, [ebp - 0x28]
push eax
mov eax, dword [esi + 0x14]
push dword [eax + 4]
call fcn.0101b6d0
mov eax, dword [esi + 0x14]
movzx ecx, word [eax + 0xa]
push ecx
movzx ecx, byte [eax + 9]
movzx eax, byte [eax + 8]
push ecx
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0xc74]
push 0x1002b58
push eax
call ebx
add esp, 0x18
jmp 0x101a74c
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax + 0x1c]
test ecx, ecx
je 0x101a54b
movzx eax, word [ecx]
sub eax, 4
shr eax, 2
cmp eax, 0x19
jl 0x101a4d0
push 0x19
pop eax
add ecx, 4
test eax, eax
mov dword [ebp + 0xc], ecx
je 0x101a537
mov dword [ebp + 0x18], eax
lea eax, [ebp - 0x28]
push eax
mov eax, dword [ebp + 0xc]
push dword [eax]
call fcn.0101b6d0
lea eax, [ebp - 0x28]
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x101a4f0
lea edi, [ebp - 0xc74]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x101a500
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0xc74]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x101a51f
add dword [ebp + 0xc], 4
dec dword [ebp + 0x18]
mov esi, 0x1002b54
movsw word es:[edi], word [esi]
jne 0x101a4dd
lea edi, [ebp - 0xc74]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x101a53e
jmp 0x101a70a
push 0x1002b48
jmp 0x101a741
mov eax, dword [ebp + 0x14]
mov eax, dword [eax + 0x20]
mov eax, dword [eax + 4]
sub eax, 0xa
je 0x101a580
sub eax, 7
je 0x101a579
dec eax
je 0x101a572
mov eax, 0x10016d8
jmp 0x101a585
mov eax, 0x1001fc4
jmp 0x101a585
mov eax, 0x1001fcc
jmp 0x101a585
mov eax, 0x1001fc8
push eax
push 0x1002898
jmp 0x101a64b
lea eax, [ebp - 0xc74]
push eax
push dword [ebp + 0x14]
call fcn.0101969a
jmp 0x101a74c
push 0x1002b38
jmp 0x101a741
mov eax, dword [ebp + 0x14]
mov esi, dword [eax + 0x60]
test esi, esi
je 0x101a625
mov al, byte [esi + 3]
cmp al, 1
jne 0x101a5f6
lea eax, [ebp - 0x28]
push eax
push dword [esi + 4]
call fcn.0101b6d0
xor eax, eax
mov ax, word [esi + 0xa]
push eax
call dword [sym.imp.WS2_32.dll_ntohs]
movzx eax, ax
push eax
lea eax, [ebp - 0x28]
push eax
push 0x1002938
lea eax, [ebp - 0xc74]
push eax
call ebx
add esp, 0x10
jmp 0x101a74c
cmp al, 4
jne 0x101a61b
lea eax, [ebp - 0x28]
push eax
push dword [esi + 4]
call fcn.0101b6d0
push dword [esi + 8]
call dword [sym.imp.WS2_32.dll_ntohl]
push eax
lea eax, [ebp - 0x28]
push eax
push 0x100292c
jmp 0x101a5e5
push 0x1002b18
jmp 0x101a741
push 0x1002afc
jmp 0x101a741
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax + 0x64]
test ecx, ecx
je 0x101a6bf
cmp byte [ecx + 8], 6
jne 0x101a65c
push dword [ecx + 0x10]
push 0x10028d8
lea eax, [ebp - 0xc74]
push eax
call ebx
add esp, 0xc
jmp 0x101a74c
fld dword [ecx + 0x18]
push dword [ecx + 0x20]
fcomp dword [0x1024f8c]
push dword [ecx + 0x1c]
fnstsw ax
test ah, 0x44
lea eax, [ebp - 0xc74]
jp 0x101a698
fld dword [ecx + 0x14]
sub esp, 0x10
fstp qword [esp + 8]
fld dword [ecx + 0x10]
fstp qword [esp]
push 0x1002ae0
push eax
call ebx
add esp, 0x20
jmp 0x101a74c
fld dword [ecx + 0x18]
sub esp, 0x18
fstp qword [esp + 0x10]
fld dword [ecx + 0x14]
fstp qword [esp + 8]
fld dword [ecx + 0x10]
fstp qword [esp]
push 0x10028dc
push eax
call ebx
add esp, 0x28
jmp 0x101a74c
push 0x1002ac8
jmp 0x101a741
mov eax, dword [ebp + 0x14]
mov eax, dword [eax + 0x68]
test eax, eax
je 0x101a74c
lea ecx, [ebp - 0xc74]
push ecx
add eax, 4
push eax
call fcn.01019925
jmp 0x101a74c
mov eax, dword [ebp + 0x14]
mov eax, dword [eax + 0x18]
test eax, eax
je 0x101a713
lea ecx, [ebp - 0xc74]
push ecx
push dword [eax + 4]
call fcn.0101b6d0
lea edi, [ebp - 0xc74]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x101a702
mov esi, 0x10029c0
movsw word es:[edi], word [esi]
jmp 0x101a74c
push 0x1002ab4
jmp 0x101a741
push 0x200
lea eax, [ebp - 0xc74]
push eax
mov eax, dword [ebp + 0x14]
push dword [eax + 0x2c]
call fcn.01019a4e
test eax, eax
jne 0x101a74c
push 0x1002a94
jmp 0x101a741
push 0x1002a84
lea eax, [ebp - 0xc74]
push eax
call ebx
pop ecx
pop ecx
lea eax, [ebp - 0xc74]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x101a755
mov ecx, dword [ebp + 0x10]
sub eax, edx
lea edx, [eax + ecx]
cmp edx, 0x1000
jg 0x101a79a
mov edi, dword [ebp + 0x10]
lea ecx, [eax + 1]
mov eax, ecx
shr ecx, 2
lea edi, [ebp + edi - 0x1c78]
lea esi, [ebp - 0xc74]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
add dword [ebp + 8], 4
rep movsb byte es:[edi], byte [esi]
mov dword [ebp + 0x10], edx
jne 0x101a3d0
mov eax, dword [0x1023014]
mov esi, dword [ebp + 0x10]
add eax, esi
cmp eax, dword [0x10226f8]
jbe 0x101a7b6
call fcn.010194c8
mov dword [0x1023018], eax
mov eax, dword [0x1023018]
mov byte [ebp + esi - 0x1c79], 0xd
mov byte [ebp + esi - 0x1c78], 0xa
and byte [ebp + esi - 0x1c77], 0
inc esi
cmp eax, 0xffffffff
je 0x101a7fb
push 0
lea ecx, [ebp - 0x50]
push ecx
push esi
lea ecx, [ebp - 0x1c78]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x101a7fb
mov eax, dword [ebp - 0x50]
add dword [0x1023014], eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, dword [ebp + 4]
call fcn.0101ed84
leave
ret 0x14