Function at 0x1001dd10
Capabilities:
Resolve function by parsing pe exports
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x29c
mov eax, dword [0x10086084]
xor eax, esp
mov dword [esp + 0x298], eax
push ebx
mov ebx, dword [ebp + 8]
xor eax, eax
push esi
mov esi, dword [ebp + 0xc]
xor ecx, ecx
push edi
lea edi, [esp + 0x54]
mov dword [esp + 0x3c], esi
stosd dword es:[edi], eax
push 0x230
push ecx
mov dword [esp + 0x48], ecx
stosd dword es:[edi], eax
mov dword [esp + 0x40], ecx
mov dword [esp + 0x14], ecx
stosd dword es:[edi], eax
lea eax, [esp + 0x78]
push eax
call sub.msvcrt.dll_memset
xor eax, eax
lea edi, [esp + 0x6c]
stosd dword es:[edi], eax
xor ecx, ecx
add esp, 0xc
mov dword [esp + 0x20], ecx
mov dword [esp + 0x30], ecx
mov dword [esp + 0x48], ecx
stosd dword es:[edi], eax
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x34], ecx
mov dword [esp + 0x1c], ecx
stosd dword es:[edi], eax
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x44], ecx
stosd dword es:[edi], eax
or eax, 0xffffffff
mov dword [esp + 0x10], ecx
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], ecx
test ebx, ebx
je 0x1001e302
cmp dword [ebx], 0xfeedf002
jne 0x1001e302
test esi, esi
je 0x1001e302
mov edi, dword [ebp + 0x10]
test edi, 0xffff70cd
jne 0x1001e302
mov dword [esp + 0x14], ecx
push ecx
lea ecx, [esp + 0x18]
call fcn.1004be98
mov esi, eax
test esi, esi
jns 0x1001ddf3
push esi
push 0x1f6
mov ecx, 0x10009f2c
call fcn.1003a254
jmp 0x1001ddfe
mov eax, dword [esp + 0x14]
mov eax, dword [eax + 0x1c]
mov dword [esp + 0x30], eax
mov ecx, dword [esp + 0x14]
call fcn.1004b8ab
test esi, esi
jns 0x1001de16
push esi
push 0x43f
jmp 0x1001e30d
mov edx, edi
lea ecx, [esp + 0x30]
call fcn.1001daa9
test eax, eax
je 0x1001de2b
or edi, 0x8000000
and edi, 0xfffff3ff
mov esi, edi
and esi, 0x200
mov dword [esp + 0x14], esi
jne 0x1001de8f
mov ecx, ebx
call fcn.10030a97
mov ecx, ebx
mov dword [esp + 0x58], eax
call fcn.10030b0c
lea edx, [esp + 0x54]
mov dword [esp + 0x54], eax
mov ecx, 0x1001d2a0
call fcn.10047012
mov esi, eax
test esi, esi
jns 0x1001de74
push esi
push 0x458
jmp 0x1001e30d
cmp dword [esp + 0x5c], 0
je 0x1001de8b
mov esi, 0xc1420127
push esi
push 0x45c
jmp 0x1001e30d
mov esi, dword [esp + 0x14]
push 0x230
lea eax, [esp + 0x74]
mov ecx, ebx
push eax
call fcn.10030a0e
push eax
call sym.WIMGAPI.DLL_WIMGetAttributes
test eax, eax
jne 0x1001dee5
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, 0x80070000
test eax, eax
jle 0x1001dec0
movzx eax, ax
or eax, edi
test eax, eax
jns 0x1001ded5
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x1001deda
movzx esi, si
or esi, edi
jmp 0x1001deda
mov esi, 0x80004005
push esi
push 0x46a
jmp 0x1001e30d
mov ecx, ebx
call fcn.10030a0e
mov ecx, eax
call fcn.10030ba6
test eax, 0x20000000
jne 0x1001df0a
mov esi, 0xc1420128
push esi
push 0x46f
jmp 0x1001e30d
xor eax, eax
inc eax
cmp ax, word [esp + 0x292]
jae 0x1001df27
mov esi, 0xc1420130
push esi
push 0x474
jmp 0x1001e30d
mov ecx, dword [esp + 0x3c]
xor eax, eax
push eax
xor edx, edx
call fcn.1003670e
mov dword [esp + 0x20], eax
test eax, eax
jne 0x1001df78
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, 0x80070000
test eax, eax
jle 0x1001df53
movzx eax, ax
or eax, edi
test eax, eax
jns 0x1001df68
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x1001df6d
movzx esi, si
or esi, edi
jmp 0x1001df6d
mov esi, 0x80004005
push esi
push 0x47c
jmp 0x1001e30d
mov ecx, eax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [esp + 0x40]
jne 0x1001df7d
sub ecx, edx
sar ecx, 1
cmp ecx, 0x104
jb 0x1001dfa6
mov esi, 0x800700ce
push esi
push 0x483
jmp 0x1001e30d
mov edx, dword [esp + 0x20]
lea eax, [esp + 0xc]
push eax
push esi
mov ecx, ebx
call fcn.10049176
mov esi, eax
test esi, esi
jns 0x1001dfc8
push esi
push 0x48e
jmp 0x1001e30d
mov ecx, dword [esp + 0xc]
lea edx, [esp + 0x60]
call fcn.10049bc1
mov esi, eax
test esi, esi
jns 0x1001dfe6
push esi
push 0x496
jmp 0x1001e30d
mov ecx, dword [esp + 0xc]
lea edx, [esp + 0x34]
call fcn.10049967
mov esi, eax
test esi, esi
jns 0x1001e004
push esi
push 0x499
jmp 0x1001e30d
mov ecx, dword [esp + 0xc]
lea edx, [esp + 0x48]
call fcn.10049a9b
mov esi, eax
test esi, esi
jns 0x1001e022
push esi
push 0x49c
jmp 0x1001e30d
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x64]
push eax
call dword [sym.imp.RPCRT4.dll_UuidToStringW]
mov esi, eax
test esi, esi
je 0x1001e04e
jle 0x1001e043
movzx esi, si
or esi, 0x80070000
push esi
push 0x49f
jmp 0x1001e30d
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0x28]
xor edx, edx
push eax
inc edx
call fcn.1003a198
mov esi, eax
test esi, esi
jns 0x1001e070
push esi
push 0x4a2
jmp 0x1001e30d
push dword [esp + 0x34]
lea eax, [esp + 0x4c]
push eax
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x68]
push dword [eax + 0x10]
mov edx, dword [eax + 8]
push dword [eax + 0xc]
call fcn.100470e6
mov esi, eax
test esi, esi
jns 0x1001e0a0
push esi
push 0x4aa
jmp 0x1001e30d
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
xor eax, eax
xor edx, edx
push eax
call fcn.10049bf8
mov esi, eax
cmp esi, 0x8007007a
je 0x1001e0cc
test esi, esi
jns 0x1001e0cc
push esi
push 0x4b4
jmp 0x1001e30d
push dword [esp + 0x10]
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [esp + 0x1c], eax
test eax, eax
jne 0x1001e0f7
mov esi, 0x8007000e
push esi
push 0x4b8
jmp 0x1001e30d
lea ecx, [esp + 0x10]
mov edx, eax
push ecx
push dword [esp + 0x14]
mov ecx, dword [esp + 0x14]
call fcn.10049bf8
mov esi, eax
test esi, esi
jns 0x1001e11c
push esi
push 0x4be
jmp 0x1001e30d
mov ecx, dword [esp + 0x1c]
mov eax, edi
and eax, 0x8000000
push 0x1000478c
or dword [ecx + 0xc], eax
mov eax, dword [esp + 0x10]
push dword [eax + 8]
lea eax, [esp + 0x34]
push 0x10004830
push eax
call fcn.1007ff3f
mov esi, eax
add esp, 0x10
test esi, esi
jns 0x1001e159
push esi
push 0x4cf
jmp 0x1001e30d
xor eax, eax
push eax
push eax
push 1
push eax
push eax
push 0x40000000
push dword [esp + 0x44]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [esp + 0x24], esi
cmp esi, 0xffffffff
jne 0x1001e1d1
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x50
jne 0x1001e196
mov esi, 0xc1420113
push esi
push 0x4dc
jmp 0x1001e30d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, 0x80070000
test eax, eax
jle 0x1001e1ac
movzx eax, ax
or eax, edi
test eax, eax
jns 0x1001e1c1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x1001e1c6
movzx esi, si
or esi, edi
jmp 0x1001e1c6
mov esi, 0x80004005
push esi
push 0x4de
jmp 0x1001e30d
xor eax, eax
push eax
lea eax, [esp + 0x48]
push eax
push dword [esp + 0x18]
push dword [esp + 0x28]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1001e227
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, 0x80070000
test eax, eax
jle 0x1001e202
movzx eax, ax
or eax, edi
test eax, eax
jns 0x1001e217
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x1001e21c
movzx esi, si
or esi, edi
jmp 0x1001e21c
mov esi, 0x80004005
push esi
push 0x4e8
jmp 0x1001e30d
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and edi, 0xfffffdff
mov dword [esp + 0x38], 1
mov edx, edi
or eax, 0xffffffff
mov edi, dword [esp + 0xc]
mov ecx, edi
mov dword [esp + 0x24], eax
call fcn.1001db78
mov esi, eax
test esi, esi
jns 0x1001e26b
push esi
push 0x4f7
mov ecx, 0x10004b28
call fcn.1003a254
jmp 0x1001e31b
push 2
pop edx
lea ecx, [esp + 0x60]
call fcn.10047716
mov esi, eax
test esi, esi
jns 0x1001e285
push esi
push 0x4ff
jmp 0x1001e25c
mov edx, dword [esp + 0x20]
mov ecx, ebx
call fcn.10030b36
test eax, eax
jne 0x1001e2cc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, 0x80070000
test eax, eax
jle 0x1001e2aa
movzx eax, ax
or eax, edi
test eax, eax
jns 0x1001e2bf
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x1001e2c4
movzx esi, si
or esi, edi
jmp 0x1001e2c4
mov esi, 0x80004005
push esi
push 0x507
jmp 0x1001e30d
lea edx, [esp + 0x60]
mov ecx, ebx
call fcn.1001dbf3
mov esi, eax
test esi, esi
jns 0x1001e2e8
push esi
push 0x50b
jmp 0x1001e25c
lea ecx, [esp + 0x60]
call fcn.1004c7c8
mov esi, eax
test esi, esi
jns 0x1001e31b
push esi
push 0x511
jmp 0x1001e25c
mov esi, 0x80070057
push esi
push 0x436
mov ecx, 0x10004b28
call fcn.1003a254
mov edi, dword [esp + 0xc]
mov eax, dword [esp + 0x24]
cmp eax, 0xffffffff
je 0x1001e32b
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x28], 0
je 0x1001e33c
push dword [esp + 0x28]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x18], 0
je 0x1001e34e
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.RPCRT4.dll_RpcStringFreeW]
test esi, esi
jns 0x1001e397
cmp dword [esp + 0x38], 0
je 0x1001e37a
test edi, edi
je 0x1001e37a
xor edx, edx
mov ecx, edi
call fcn.1001d11f
test eax, eax
jns 0x1001e37a
push eax
push 0x52c
mov ecx, 0x10004b28
call fcn.1003a254
lea ecx, [esp + 0x60]
call fcn.10047a79
test eax, eax
jns 0x1001e397
push eax
push 0x530
mov ecx, 0x10004b28
call fcn.1003a254
mov eax, dword [esp + 0x2c]
xor ebx, ebx
test eax, eax
je 0x1001e3b0
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x1001e3c7
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 0x20]
test eax, eax
je 0x1001e3de
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, edi
call fcn.100497c0
mov ecx, esi
call fcn.1001cc8e
mov ecx, dword [esp + 0x2a4]
not esi
shr esi, 0x1f
pop edi
mov eax, esi
pop esi
pop ebx
xor ecx, esp
call fcn.10083b20
mov esp, ebp
pop ebp
ret 0xc