Function at 0x100077d0
Capabilities:
Write file on windows

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001ed9b
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x698
mov eax, dword [0x1002900c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebx + 0xc]
mov esi, 4
mov ecx, dword [ebx + 8]
cmp eax, 5
push 0x208
cmovb esi, eax
mov dword [ebp - 0x6a0], ecx
mov ecx, dword [ebx + 0x10]
lea eax, [ebp - 0x250]
push 0
push eax
mov dword [ebp - 0x6a4], ecx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebx + 0x1c]
push eax
push ecx
push dword [ebx + 0x18]
push ecx
lea ecx, [ebp - 0x250]
call fcn.1001d260
lea ecx, [ebp - 0x250]
add esp, 0x10
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10007867
sub ecx, edx
sar ecx, 1
cmp ecx, 2
jb 0x100078ac
cmp word [ebp + ecx*2 - 0x252], 0xa
jne 0x100078ac
sub ecx, 2
add ecx, ecx
cmp word [ebp + ecx - 0x250], 0xd
jne 0x100078ac
cmp ecx, 0x208
jae 0x10007cef
xor eax, eax
mov word [ebp + ecx - 0x250], ax
push 0x400
lea eax, [ebp - 0x650]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x680]
xor edi, edi
push 0x10002850
push 0x10011e00
push 2
push 0x18
push eax
call fcn.1001dd45
lea eax, [ebp - 0x690]
mov dword [ebp - 4], edi
xorps xmm0, xmm0
push eax
movups xmmword [ebp - 0x690], xmm0
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
push 0x30
lea eax, [ebp - 0x44]
push edi
push eax
call sub.VCRUNTIME140.dll_memset
movzx eax, word [ebp - 0x68a]
add esp, 0xc
push eax
movzx eax, word [ebp - 0x68e]
push eax
movzx eax, word [ebp - 0x690]
push eax
lea eax, [ebp - 0x44]
push str._4d__02d__02d
push eax
call fcn.100168c0
lea ecx, [ebp - 0x44]
add esp, 0x14
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10007936
sub ecx, edx
lea eax, [ebp - 0x44]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x680]
call fcn.10003d40
movzx eax, word [ebp - 0x682]
push eax
movzx eax, word [ebp - 0x684]
push eax
movzx eax, word [ebp - 0x686]
push eax
movzx eax, word [ebp - 0x688]
push eax
lea eax, [ebp - 0x44]
push str._02d:_02d:_02d:_03d
push eax
call fcn.100168c0
lea ecx, [ebp - 0x44]
add esp, 0x18
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10007990
sub ecx, edx
lea eax, [ebp - 0x44]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x668]
call fcn.10003d40
cmp esi, 4
ja case.default.0x100079b8
jmp dword [esi*4 + 0x10007cf4]
mov dword [ebp - 0x688], str.INFO
mov dword [ebp - 0x684], str.DEBUG
mov dword [ebp - 0x694], str.FATAL
mov dword [ebp - 0x690], str.ERROR
mov dword [ebp - 0x68c], str.WARN
mov edx, dword [ebp + esi*4 - 0x694]
mov ecx, edx
mov dword [ebp - 0x698], 0
mov dword [ebp - 0x688], 0
mov dword [ebp - 0x684], 7
lea esi, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10007a20
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x698]
call fcn.10003d40
cmp dword [ebp - 0x684], 8
lea eax, [ebp - 0x698]
lea edi, [ebp - 0x668]
cmovae eax, dword [ebp - 0x698]
lea esi, [ebp - 0x680]
cmp dword [ebp - 0x654], 8
mov dword [ebp - 0x69c], eax
lea eax, [ebp - 0x250]
cmovae edi, dword [ebp - 0x668]
cmp dword [ebp - 0x66c], 8
push eax
push dword [ebx + 0x14]
cmovae esi, dword [ebp - 0x680]
push dword [ebp - 0x6a4]
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push eax
push dword [ebp - 0x69c]
lea eax, [ebp - 0x650]
push edi
push esi
push str._s__s__s__s___d___s_r_n
push 0x200
push eax
call fcn.1001d240
add esp, 0x24
mov ecx, dword [ebp - 0x684]
mov edi, eax
cmp ecx, 8
jb case.default.0x100079b8
mov edx, dword [ebp - 0x698]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x10007c50
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x10007c50
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
mov dword [ebp - 0x688], str.INFO
mov dword [ebp - 0x684], str.DEBUG
mov dword [ebp - 0x694], str.FATAL
mov dword [ebp - 0x690], str.ERROR
mov dword [ebp - 0x68c], str.WARN
mov edx, dword [ebp + esi*4 - 0x694]
mov ecx, edx
mov dword [ebp - 0x698], 0
mov dword [ebp - 0x688], 0
mov dword [ebp - 0x684], 7
lea esi, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10007b60
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x698]
call fcn.10003d40
cmp dword [ebp - 0x684], 8
lea edx, [ebp - 0x698]
lea ecx, [ebp - 0x668]
cmovae edx, dword [ebp - 0x698]
lea esi, [ebp - 0x250]
cmp dword [ebp - 0x654], 8
lea eax, [ebp - 0x680]
push esi
cmovae ecx, dword [ebp - 0x668]
cmp dword [ebp - 0x66c], 8
push edx
cmovae eax, dword [ebp - 0x680]
push ecx
push eax
push str._s__s__s___s_r_n
lea eax, [ebp - 0x650]
push 0x200
push eax
call fcn.1001d240
add esp, 0x1c
jmp 0x10007ab6
mov dword [ebp - 0x688], str.INFO
mov dword [ebp - 0x684], str.DEBUG
mov dword [ebp - 0x694], str.FATAL
mov dword [ebp - 0x690], str.ERROR
mov dword [ebp - 0x68c], str.WARN
mov edx, dword [ebp + esi*4 - 0x694]
mov ecx, edx
mov dword [ebp - 0x698], 0
mov dword [ebp - 0x688], 0
mov dword [ebp - 0x684], 7
lea esi, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10007c40
jmp 0x10007b6b
push ecx
push edx
call fcn.1001d4af
add esp, 8
mov esi, dword [ebp - 0x6a0]
mov esi, dword [esi + 0x48]
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x10007cb5
push 2
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [ebp - 0x69c]
mov dword [ebp - 0x69c], 0
push eax
lea eax, [edi + edi]
push eax
lea eax, [ebp - 0x650]
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov esi, dword [ebp - 0x6a0]
mov eax, dword [esi + 0x48]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov ecx, esi
call fcn.10007d10
push 0x10002850
push 2
push 0x18
lea eax, [ebp - 0x680]
mov dword [ebp - 4], 0xffffffff
push eax
call fcn.1001da33
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1001d4a1
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.1001dc6a
mov edi, 0xbf100079
jns 268467451
adc ah, bh
jp 0x10007cff
adc al, ah
jnp 0x10007d03
adc byte [edi - 0x33efff87], bh
int3