Function at 0x100612b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100e6ee0
mov eax, dword fs:[0]
push eax
sub esp, 0x50
push ebx
push esi
push edi
mov eax, dword [0x10144930]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x18], ecx
xor esi, esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], esi
cmp dword [ebp + 8], esi
je 0x10061563
mov edi, dword [ebp + 0xc]
cmp edi, esi
je 0x10061563
cmp dword [edi], esi
je 0x10061563
cmp dword [ecx + 0x2808], esi
jne 0x10061324
lea eax, [esi + 6]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ecx]
mov edx, dword [eax + 0x24]
call edx
test eax, eax
jne 0x10061344
mov dword [ebp - 0x20], 0xaa
push 0x1012ac78
lea eax, [ebp - 0x20]
push eax
call fcn.100c80ad
mov ebx, dword [edi]
xor eax, eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], eax
push esi
push esi
push 1
push esi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [ebp - 0x4c], eax
cmp eax, esi
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
jne 0x10061385
push str.CreateEvent
call esi
mov ecx, eax
mov edx, 0x10152dd8
call fcn.1003f2f0
add esp, 4
cmp ebx, 0x1000
jle 0x100613f4
mov edi, dword [ebp + 8]
mov dword [ebp - 0x28], edi
xor esi, esi
mov dword [ebp - 0x24], esi
mov eax, ebx
sub eax, esi
je 0x100613e2
cmp eax, 0x1000
mov dword [ebp - 0x14], 0x1000
jge 0x100613af
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx]
lea eax, [ebp - 0x14]
push eax
push edi
mov edx, dword [edx + 8]
call edx
test eax, eax
jne 0x100613d1
mov eax, dword [ebp - 0x14]
add esi, eax
mov dword [ebp - 0x24], esi
add edi, eax
mov dword [ebp - 0x28], edi
jmp 0x10061398
mov dword [ebp - 0x2c], eax
push 0x1012ac78
lea eax, [ebp - 0x2c]
push eax
call fcn.100c80ad
test esi, esi
je 0x1006153b
mov ecx, dword [ebp + 0xc]
mov dword [ecx], esi
jmp 0x1006153b
lea edx, [ebp - 0x5c]
push edx
push edi
push ebx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + 0x2808]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x10061522
call esi
mov esi, eax
cmp esi, 0x26
je 0x1006150d
cmp esi, 0x3e5
je 0x10061450
push 0x10120f68
mov ecx, esi
mov edx, 0x10152dd8
call fcn.1003f2f0
add esp, 4
mov dword [ebp - 0x30], esi
push 0x1012ac78
lea eax, [ebp - 0x30]
push eax
call fcn.100c80ad
push 0x64
mov ecx, dword [ebp - 0x4c]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edi, 0x64
mov dword [ebp - 0x38], edi
mov ebx, dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
lea ebx, [ebx]
push 0
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 0x5c]
push eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + 0x2804]
push edx
call ebx
test eax, eax
jne 0x10061504
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, 0x26
je 0x100614ef
cmp esi, 0x3e4
je 0x100614c4
push 0x10120ec0
mov ecx, esi
mov edx, 0x10152dd8
call fcn.1003f2f0
add esp, 4
mov dword [ebp - 0x34], esi
push 0x1012ac78
lea eax, [ebp - 0x34]
push eax
call fcn.100c80ad
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
add edi, 0x64
mov dword [ebp - 0x38], edi
cmp edi, 0x2710
jbe 0x10061470
mov dword [ebp - 0x3c], 0x102
push 0x1012ac78
lea ecx, [ebp - 0x3c]
push ecx
call fcn.100c80ad
mov dword [ebp - 0x40], 0
push 0x1012ac78
lea edx, [ebp - 0x40]
push edx
call fcn.100c80ad
mov dword [ebp - 0x1c], 0
jmp 0x1006153b
mov dword [ebp - 0x44], 0
push 0x1012ac78
lea eax, [ebp - 0x44]
push eax
call fcn.100c80ad
call esi
mov dword [ebp - 0x1c], eax
push str.Write_Data
mov ecx, eax
mov edx, 0x10152dd8
call fcn.1003f2f0
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx]
mov eax, dword [edx + 0x28]
call eax
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, 0x57
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8