Function at 0x1002c4bb
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
xor eax, eax
push esi
push edi
cmp dword [ebp + 8], eax
je 0x1002c6af
cmp dword [ebp + 0xc], eax
je 0x1002c6af
push eax
push eax
push 2
push eax
xor ebx, ebx
inc ebx
push ebx
push 0x40000000
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
je 0x1002c6af
xor eax, eax
lea edi, [ebp - 0x28]
stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
lea edi, [ebp - 0x38]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x4c]
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetIconInfo]
push ebx
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x40]
lea esi, [ebp - 0x14]
call fcn.1002c42b
add esp, 0xc
push 0x20
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x3c]
lea esi, [ebp - 0x18]
call fcn.1002c42b
add esp, 0xc
push dword [ebp - 0x14]
call fcn.1004dde9
pop ecx
push dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
call fcn.1004dde9
pop ecx
push dword [ebp - 0x20]
mov esi, eax
call fcn.1004dde9
pop ecx
push dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
call fcn.1004dde9
xor edi, edi
pop ecx
mov dword [ebp - 8], eax
cmp dword [ebp - 0x14], edi
je 0x1002c659
cmp esi, edi
je 0x1002c659
cmp dword [ebp - 0xc], edi
je 0x1002c659
cmp eax, edi
je 0x1002c659
mov eax, dword [ebp - 0x14]
push ebx
push dword [ebp - 0xc]
push dword [ebp - 0x40]
call fcn.1002c47d
add esp, 0xc
push 0x20
push dword [ebp - 8]
mov eax, esi
push dword [ebp - 0x3c]
call fcn.1002c47d
add esp, 0xc
push edi
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, ebx
mov word [ebp - 0x26], ax
lea eax, [ebp - 0x10]
push eax
push 6
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 4]
mov word [ebp - 0x24], bx
call edi
mov ecx, dword [ebp - 0x1c]
mov ebx, eax
mov al, byte [esi + 4]
mov byte [ebp - 0x38], al
mov al, byte [esi + 8]
mov byte [ebp - 0x37], al
mov ax, word [esi + 0xe]
imul ax, word [esi + 0xc]
mov word [ebp - 0x36], ax
mov eax, dword [ebp - 0x18]
add eax, ecx
add eax, dword [ebp - 0x20]
push 0
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x10]
push eax
push 0x10
lea eax, [ebp - 0x38]
push eax
push dword [ebp - 4]
and ebx, 1
mov dword [ebp - 0x2c], 0x16
call edi
shl dword [esi + 8], 1
push 0
and ebx, eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x18]
push esi
push dword [ebp - 4]
call edi
push 0
and ebx, eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x1c]
push dword [ebp - 8]
push dword [ebp - 4]
call edi
push 0
and ebx, eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x20]
push dword [ebp - 0xc]
push dword [ebp - 4]
call edi
and ebx, eax
jmp 0x1002c65b
xor ebx, ebx
xor edi, edi
cmp esi, edi
je 0x1002c668
push esi
call fcn.1004dd0c
pop ecx
cmp dword [ebp - 0x14], edi
je 0x1002c676
push dword [ebp - 0x14]
call fcn.1004dd0c
pop ecx
cmp dword [ebp - 8], edi
je 0x1002c684
push dword [ebp - 8]
call fcn.1004dd0c
pop ecx
cmp dword [ebp - 0xc], edi
je 0x1002c692
push dword [ebp - 0xc]
call fcn.1004dd0c
pop ecx
push dword [ebp - 0x3c]
mov esi, dword [sym.imp.GDI32.dll_DeleteObject]
call esi
push dword [ebp - 0x40]
call esi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
jmp 0x1002c6b1
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret