Function at 0x10009df0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100fb1d8
mov eax, dword fs:[0]
push eax
sub esp, 0x94
mov eax, dword [0x1013f030]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov edi, edx
mov dword [ebp - 0x64], eax
lea eax, [edi + 0x2c]
push eax
mov dword [ebp - 0x60], edi
mov dword [ebp - 0x84], esi
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x58], vtable.ProtocolFilters::AutoLock.0
mov dword [ebp - 0x54], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x80], vtable.ProtocolFilters::IOB.0
mov dword [ebp - 0x7c], ebx
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0x74], ebx
mov dword [ebp - 0x70], 0x6400000
mov dword [ebp - 0x6c], 1
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 1
call fcn.10009840
mov ecx, esi
mov byte [ebp - 4], 2
cmp dword [ecx + 0x14], ebx
je 0x1000a1fa
mov esi, dword [ebp - 0x64]
cmp dword [esi + 8], ebx
je 0x1000a1fa
mov edx, dword [ebp - 0x50]
cmp dword [edx + 8], ebx
je 0x1000a1fa
call fcn.1000a250
mov eax, dword [edi + 0x28]
push 2
push ebx
push eax
call fcn.1003170c
mov ecx, dword [edi + 0x28]
add esp, 0xc
push ecx
call fcn.1003192e
mov ecx, dword [esi + 8]
mov esi, dword [esi + 4]
add esp, 4
mov dword [ebp - 0x88], eax
mov dword [ebp - 0x68], ecx
test esi, esi
je 0x10009fa0
test ecx, ecx
je 0x10009fa0
lea eax, [ecx + 1]
cmp eax, 0x6400000
ja 0x10009fa0
test eax, eax
jbe 0x10009f25
lea edi, [ebx + 0xa]
cmp eax, edi
jb 0x10009f07
add edi, edi
cmp edi, eax
jbe 0x10009ef7
cmp edi, 0x6400000
jb 0x10009f07
mov edi, eax
push edi
call fcn.10030d6c
add esp, 4
test eax, eax
je 0x10009fa0
mov ecx, dword [ebp - 0x68]
mov ebx, eax
mov dword [ebp - 0x74], edi
mov dword [ebp - 0x7c], ebx
jmp 0x10009f28
mov edi, dword [ebp - 0x74]
push ecx
push esi
push ebx
call fcn.10037db0
mov ecx, dword [ebp - 0x68]
mov eax, dword [ebp - 0x50]
mov byte [ebx + ecx], 0
mov edx, dword [eax + 4]
mov esi, dword [eax + 8]
add esp, 0xc
mov dword [ebp - 0x78], ecx
mov dword [ebp - 0x8c], edx
test edx, edx
je 0x1000a063
test esi, esi
je 0x1000a063
lea eax, [esi + ecx]
mov dword [ebp - 0x5c], eax
inc eax
cmp eax, 0x6400000
ja 0x1000a063
cmp eax, edi
jbe 0x10009fda
test edi, edi
jne 0x10009f7b
mov edi, 0xa
cmp edi, eax
ja 0x10009f86
nop
add edi, edi
cmp edi, eax
jbe 0x10009f80
cmp edi, 0x6400000
jb 0x10009f90
mov edi, eax
push edi
test ebx, ebx
je 0x10009fb9
push ebx
call fcn.10032818
add esp, 8
jmp 0x10009fc1
lea ecx, [ebp - 0x4c]
call fcn.100093d0
lea ecx, [ebp - 0x80]
mov byte [ebp - 4], 0
call fcn.10013810
jmp 0x1000a21e
call fcn.10030d6c
add esp, 4
test eax, eax
je 0x1000a063
mov ecx, dword [ebp - 0x68]
mov edx, dword [ebp - 0x8c]
mov ebx, eax
mov dword [ebp - 0x74], edi
mov dword [ebp - 0x7c], ebx
push esi
push edx
lea eax, [ebx + ecx]
push eax
call fcn.10037db0
mov edi, dword [ebp - 0x5c]
mov eax, edi
add esp, 0xc
and eax, 0xf
mov dword [ebp - 0x78], edi
mov byte [edi + ebx], 0
je 0x1000a0b1
mov esi, 0x10
sub esi, eax
mov eax, 0
mov dword [ebp - 0x5c], esi
mov byte [ebp - 0x20], 0
mov dword [ebp - 0x1f], eax
mov dword [ebp - 0x1b], eax
mov dword [ebp - 0x17], eax
mov word [ebp - 0x13], ax
mov byte [ebp - 0x11], al
je 0x1000a063
lea eax, [edi + esi + 1]
cmp eax, 0x6400000
ja 0x1000a063
mov ecx, dword [ebp - 0x74]
cmp eax, ecx
jbe 0x1000a097
mov esi, ecx
test ecx, ecx
jne 0x1000a03f
mov esi, 0xa
cmp esi, eax
ja 0x1000a049
add esi, esi
cmp esi, eax
jbe 0x1000a043
cmp esi, 0x6400000
jb 0x1000a053
mov esi, eax
push esi
test ebx, ebx
je 0x1000a080
push ebx
call fcn.10032818
add esp, 8
jmp 0x1000a088
lea ecx, [ebp - 0x4c]
call fcn.100093d0
lea ecx, [ebp - 0x80]
mov byte [ebp - 4], 0
call fcn.10013810
mov ecx, dword [ebp - 0x54]
push ecx
jmp 0x1000a222
call fcn.10030d6c
add esp, 4
test eax, eax
je 0x1000a063
mov ebx, eax
mov dword [ebp - 0x74], esi
mov esi, dword [ebp - 0x5c]
mov dword [ebp - 0x7c], ebx
push esi
lea edx, [ebp - 0x20]
push edx
lea eax, [edi + ebx]
push eax
call fcn.10037db0
add esp, 0xc
add edi, esi
mov dword [ebp - 0x78], edi
mov byte [edi + ebx], 0
push 1
push edi
call fcn.1000b9e0
mov edx, dword [ebp - 0x84]
mov eax, dword [edx + 0x14]
mov ecx, dword [ebp - 0x64]
mov ecx, dword [ecx + 8]
mov edx, dword [ebp - 0x50]
mov word [ebp - 0x98], cx
mov ecx, dword [edx + 8]
mov word [ebp - 0x9a], ax
mov word [ebp - 0x96], cx
mov ecx, dword [ebp - 0x60]
mov edx, dword [ecx + 0x28]
lea eax, [edi + eax + 0x10]
push edx
mov word [ebp - 0x9c], ax
xor eax, eax
push 0x10
mov dword [ebp - 0x94], eax
mov dword [ebp - 0x90], eax
lea eax, [ebp - 0x9c]
push 1
push eax
call fcn.10031afe
add esp, 0x18
cmp eax, 0x10
jne 0x1000a063
mov edx, dword [ebp - 0x48]
cmp dword [ebp - 0x34], eax
jae 0x1000a12a
lea edx, [ebp - 0x48]
mov esi, dword [ebp - 0x38]
mov eax, dword [ebp - 0x60]
call fcn.1000b280
test al, al
je 0x10009fa0
mov edx, ebx
mov ebx, dword [ebp - 0x60]
mov esi, edi
mov eax, ebx
call fcn.1000b280
test al, al
jne 0x1000a16c
lea ecx, [ebp - 0x4c]
call fcn.100093d0
lea ecx, [ebp - 0x80]
mov byte [ebp - 4], 0
call fcn.10013810
mov eax, dword [ebp - 0x54]
push eax
jmp 0x1000a222
mov ecx, dword [ebp - 0x88]
xor esi, esi
push esi
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], esi
call fcn.10032148
add esp, 4
push 0x30
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], edx
call fcn.10031dbc
add esp, 4
cmp eax, esi
je 0x1000a1a1
call fcn.10009510
mov esi, eax
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x18], esi
call fcn.10013840
mov eax, dword [ebp - 0x50]
add esi, 0x18
call fcn.10013840
push ebx
lea ecx, [ebp - 0x4c]
call fcn.1000f380
mov edi, eax
mov ecx, 8
lea esi, [ebp - 0x30]
rep movsd dword es:[edi], dword [esi]
mov edx, dword [ebx + 0x28]
push edx
call fcn.10032323
add esp, 4
lea ecx, [ebp - 0x4c]
call fcn.100093d0
lea ecx, [ebp - 0x80]
mov byte [ebp - 4], 0
call fcn.10013810
mov eax, dword [ebp - 0x54]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, 1
jmp 0x1000a22a
cmp dword [ebp - 0x34], 0x10
jb 0x1000a20c
mov ecx, dword [ebp - 0x48]
push ecx
call fcn.10031f94
add esp, 4
mov dword [ebp - 0x34], 0xf
mov dword [ebp - 0x38], 0
mov byte [ebp - 0x48], 0
mov edx, dword [ebp - 0x54]
push edx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10030c80
mov esp, ebp
pop ebp
ret 8