Function at 0x304e882
Capabilities:
Write file on windows

Disassembly:
push 0x984
push 0x310b810
call fcn.03105bbc
mov edi, dword [ebp + 8]
mov dword [ebp - 0x994], edi
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x98c], ebx
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x980], eax
mov dword [ebp - 0x990], eax
xor esi, esi
mov dword [ebp - 0x970], esi
push 0x110
push esi
lea eax, [ebp - 0x96c]
push eax
call sub.msvcrt.dll_memset
mov dword [ebp - 0x85c], esi
push 0x3c
push esi
lea eax, [ebp - 0x858]
push eax
call sub.msvcrt.dll_memset
add esp, 0x18
or dword [ebp - 0x974], 0xffffffff
mov dword [ebp - 0x97c], esi
test edi, edi
jne 0x304e915
push dword [ebp - 0x980]
lea eax, [ebp - 0x980]
push eax
lea eax, [ebp - 0x974]
push eax
push 8
call ebx
mov eax, dword [ebp - 0x974]
jmp 0x304e931
push esi
push 0x80
push 2
push esi
push esi
push 0xc0000000
push edi
call dword [0x31125cc]
mov dword [ebp - 0x974], eax
test eax, eax
je 0x304e984
cmp eax, 0xffffffff
je 0x304e984
push esi
lea ecx, [ebp - 0x984]
push ecx
push 0x40
lea ecx, [ebp - 0x85c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x304e967
cmp dword [ebp - 0x984], 0x40
je 0x304e98e
push 0x1d
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [ebp - 0x994]
test edi, edi
je 0x304e984
push dword [ebp - 0x974]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call dword [0x31125d0]
xor eax, eax
call fcn.03105c04
ret 0xc
push 1
push esi
push esi
push dword [ebp - 0x974]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [ebp - 0x82c], eax
cmp eax, 0xffffffff
je 0x304e967
push dword [ebp - 0x990]
lea eax, [ebp - 0x980]
push eax
lea eax, [ebp - 0x97c]
push eax
push 6
call ebx
push esi
lea eax, [ebp - 0x984]
push eax
push 0x60
push dword [ebp - 0x97c]
push dword [ebp - 0x974]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x304e967
cmp dword [ebp - 0x984], 0x60
jne 0x304e95f
push 1
push esi
push esi
push dword [ebp - 0x974]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [ebp - 0x830], eax
cmp eax, 0xffffffff
je 0x304e967
push 0xfffffffffffffffe
pop edi
mov dword [ebp - 4], esi
push dword [ebp - 0x990]
lea eax, [ebp - 0x980]
push eax
lea eax, [ebp - 0x97c]
push eax
push 2
call dword [ebp - 0x98c]
mov ebx, eax
jmp 0x304ea41
mov dword [ebp - 0x988], ebx
mov dword [ebp - 4], edi
test ebx, ebx
je 0x304ea89
inc dword [ebp - 0x840]
push esi
lea eax, [ebp - 0x984]
push eax
push 0x1c
push dword [ebp - 0x97c]
push dword [ebp - 0x974]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x304e967
cmp dword [ebp - 0x984], 0x1c
jne 0x304e95f
test ebx, ebx
jne 0x304ea10
push 1
push esi
push esi
push dword [ebp - 0x974]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [ebp - 0x83c], eax
cmp eax, 0xffffffff
je 0x304e967
mov dword [ebp - 4], 1
push dword [ebp - 0x990]
lea eax, [ebp - 0x980]
push eax
lea eax, [ebp - 0x97c]
push eax
push 3
call dword [ebp - 0x98c]
mov ebx, eax
jmp 0x304eadd
mov dword [ebp - 0x988], ebx
mov dword [ebp - 4], edi
test ebx, ebx
je 0x304eb40
mov eax, dword [ebp - 0x980]
mov dword [ebp - 0x978], eax
push esi
lea ecx, [ebp - 0x984]
push ecx
push eax
push dword [ebp - 0x97c]
push dword [ebp - 0x974]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x304e967
lea edx, [ebp - 0x984]
mov ecx, dword [ebp - 0x978]
call fcn.0304e6c0
test eax, eax
je 0x304e967
inc dword [ebp - 0x848]
test ebx, ebx
jne 0x304eaa8
push 1
push esi
push esi
push dword [ebp - 0x974]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [ebp - 0x828], eax
cmp eax, 0xffffffff
je 0x304e967
mov dword [ebp - 4], 2
push dword [ebp - 0x990]
lea eax, [ebp - 0x980]
push eax
lea eax, [ebp - 0x97c]
push eax
push 7
call dword [ebp - 0x98c]
mov ebx, eax
jmp 0x304eb94
mov dword [ebp - 0x988], ebx
mov dword [ebp - 4], edi
test ebx, ebx
je 0x304ebd6
push esi
lea eax, [ebp - 0x978]
push eax
push 0x30
push dword [ebp - 0x97c]
push dword [ebp - 0x974]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x304e967
cmp dword [ebp - 0x978], 0x30
jne 0x304e95f
test ebx, ebx
jne 0x304eb5f
push 1
push esi
push esi
push dword [ebp - 0x974]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [ebp - 0x838], eax
cmp eax, 0xffffffff
je 0x304e967
mov dword [ebp - 4], 3
push dword [ebp - 0x990]
lea eax, [ebp - 0x980]
push eax
lea eax, [ebp - 0x97c]
push eax
push 4
call dword [ebp - 0x98c]
mov ebx, eax
jmp 0x304ec2a
mov dword [ebp - 0x988], ebx
mov dword [ebp - 4], edi
test ebx, ebx
je 0x304ec8e
mov eax, dword [ebp - 0x97c]
mov ecx, dword [eax + 8]
add ecx, 0xc
mov dword [ebp - 0x984], ecx
push esi
lea edx, [ebp - 0x978]
push edx
push ecx
push eax
push dword [ebp - 0x974]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x304e967
lea edx, [ebp - 0x978]
mov ecx, dword [ebp - 0x984]
call fcn.0304e6c0
test eax, eax
je 0x304e967
inc dword [ebp - 0x844]
test ebx, ebx
jne 0x304ebf5
push 1
push esi
push esi
push dword [ebp - 0x974]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [ebp - 0x834], eax
cmp eax, 0xffffffff
je 0x304e967
mov dword [ebp - 4], 4
push dword [ebp - 0x990]
lea eax, [ebp - 0x980]
push eax
lea eax, [ebp - 0x97c]
push eax
push 5
call dword [ebp - 0x98c]
mov ebx, eax
jmp 0x304ece2
mov dword [ebp - 0x988], ebx
mov dword [ebp - 4], edi
test ebx, ebx
je 0x304ed3f
mov eax, dword [ebp - 0x980]
mov dword [ebp - 0x984], eax
push esi
lea ecx, [ebp - 0x978]
push ecx
push eax
push dword [ebp - 0x97c]
push dword [ebp - 0x974]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x304e967
lea edx, [ebp - 0x978]
mov ecx, dword [ebp - 0x984]
call fcn.0304e6c0
test eax, eax
je 0x304e967
test ebx, ebx
jne 0x304ecad
push 1
push esi
push esi
push dword [ebp - 0x974]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [ebp - 0x824], eax
cmp eax, 0xffffffff
je 0x304e967
mov dword [ebp - 0x970], 0x114
lea eax, [ebp - 0x970]
push eax
call dword [0x3112604]
test eax, eax
je 0x304e967
xor eax, eax
mov word [ebp - 0x81c], ax
push 0x7fe
push esi
lea eax, [ebp - 0x81a]
push eax
call sub.msvcrt.dll_memset
lea ebx, [ebp - 0x81c]
push 0x301a8c0
mov edi, 0x3ff
push edi
mov eax, ebx
push eax
call fcn.0307d796
add esp, 0x18
mov ecx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0x304edb9
sub ecx, edx
sar ecx, 1
inc ecx
cmp ecx, edi
ja 0x304edda
lea ebx, [ebp - 0x81c]
lea ebx, [ebx + ecx*2]
sub edi, ecx
jmp 0x304eddc
mov edi, esi
push 0x301a8e0
push 0x301a8e8
push edi
push ebx
call fcn.0307d708
add esp, 0x10
mov ecx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0x304edf5
sub ecx, edx
sar ecx, 1
inc ecx
cmp ecx, edi
ja 0x304ee10
lea ebx, [ebx + ecx*2]
sub edi, ecx
jmp 0x304ee12
mov edi, esi
push 0x301a8f0
push edi
push ebx
call fcn.0307d796
add esp, 0xc
mov ecx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0x304ee26
sub ecx, edx
sar ecx, 1
inc ecx
cmp ecx, edi
ja 0x304ee41
lea ebx, [ebx + ecx*2]
sub edi, ecx
jmp 0x304ee43
mov edi, esi
push 0x2580
push 0x301a908
push edi
push ebx
call fcn.0307d708
add esp, 0x10
mov ecx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0x304ee5c
sub ecx, edx
sar ecx, 1
inc ecx
cmp ecx, edi
ja 0x304ee77
lea ebx, [ebx + ecx*2]
sub edi, ecx
jmp 0x304ee79
mov edi, esi
push 0x301a910
push edi
push ebx
call fcn.0307d796
add esp, 0xc
mov ecx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0x304ee8d
sub ecx, edx
sar ecx, 1
inc ecx
cmp ecx, edi
ja 0x304eea8
lea ebx, [ebx + ecx*2]
sub edi, ecx
jmp 0x304eeaa
mov edi, esi
cmp word [ebp - 0x95c], 0
je 0x304eecc
lea eax, [ebp - 0x95c]
push eax
push 0x301a8e8
push edi
push ebx
call fcn.0307d708
add esp, 0x10
jmp 0x304eedb
push 0x301a92c
push edi
push ebx
call fcn.0307d796
add esp, 0xc
mov ecx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0x304eee0
sub ecx, edx
sar ecx, 1
inc ecx
cmp ecx, edi
ja 0x304eefb
lea ebx, [ebx + ecx*2]
sub edi, ecx
jmp 0x304eefd
mov edi, esi
push 0x301a938
push edi
push ebx
call fcn.0307d796
add esp, 0xc
mov ecx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0x304ef11
sub ecx, edx
sar ecx, 1
inc ecx
cmp ecx, edi
ja 0x304ef2c
lea ebx, [ebx + ecx*2]
sub edi, ecx
jmp 0x304ef2e
mov edi, esi
call fcn.0304e6d8
mov dword [ebp - 0x978], eax
test eax, eax
je 0x304ef56
push eax
push edi
push ebx
call fcn.0307d796
push dword [ebp - 0x978]
call dword [sym.imp.msvcrt.dll_free]
add esp, 0x10
jmp 0x304ef65
push 0x301a92c
push edi
push ebx
call fcn.0307d796
add esp, 0xc
mov ecx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0x304ef6a
sub ecx, edx
sar ecx, 1
inc ecx
cmp ecx, edi
ja 0x304ef81
lea ebx, [ebx + ecx*2]
xor eax, eax
mov word [ebx], ax
lea eax, [ebp - 0x81c]
sub ebx, eax
add ebx, 2
mov dword [ebp - 0x980], ebx
push esi
lea eax, [ebp - 0x978]
push eax
push ebx
lea eax, [ebp - 0x81c]
push eax
push dword [ebp - 0x974]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x304e967
cmp dword [ebp - 0x978], ebx
jne 0x304e95f
mov dword [ebp - 0x85c], 0x52455355
mov eax, dword [ebp - 0x96c]
mov dword [ebp - 0x854], eax
mov ecx, dword [ebp - 0x964]
shl ecx, 0x10
movzx eax, word [ebp - 0x968]
or ecx, eax
mov dword [ebp - 0x850], ecx
mov dword [ebp - 0x84c], 0x14c
mov dword [ebp - 0x858], 0x504d5544
push esi
push esi
push esi
push dword [ebp - 0x974]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x304e967
push esi
lea eax, [ebp - 0x978]
push eax
push 0x40
lea eax, [ebp - 0x85c]
push eax
push dword [ebp - 0x974]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x304e967
cmp dword [ebp - 0x978], 0x40
jne 0x304e95f
cmp dword [ebp - 0x994], 0
je 0x304f068
push dword [ebp - 0x974]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
inc eax
jmp 0x304e986