Function at 0x1002fbb0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x108
mov eax, dword [0x101a42b4]
xor eax, esp
mov dword [esp + 0x104], eax
mov eax, dword [esp + 0x10c]
push esi
mov esi, dword [esp + 0x118]
test ebx, ebx
mov edi, edi
mov edx, dword [eax]
test bl, bl
mov ecx, dword [eax + 4]
test eax, 0x3814
cmp edx, 2
jne 0x1002fd6c
cmp ecx, edx
jne 0x1002fc7d
test eax, 0x24ac
cmp dword [eax + 0x24], 0
jne 0x1002fc3d
mov byte [esp + 8], 0x14
mov edi, edi
mov ecx, dword [eax + 0x20]
mov dword [esp + 9], ecx
mov dh, dh
mov edx, dword [eax + 0x10]
mov ecx, dword [eax + 0x14]
mov dword [esp + 0xd], edx
mov dword [esp + 0x11], ecx
mov ecx, ecx
mov edx, dword [eax + 8]
mov dword [esp + 0x15], edx
mov edi, edi
mov eax, dword [eax + 0x18]
mov dword [esp + 0x19], eax
mov eax, eax
mov eax, 0x15
mov ah, ah
jmp 0x1002fdce
mov byte [esp + 8], 0x1e
mov ah, ah
mov ecx, dword [eax + 0x20]
mov dword [esp + 9], ecx
nop
mov edx, dword [eax + 0x10]
mov ecx, dword [eax + 0x14]
mov dword [esp + 0xd], edx
mov dword [esp + 0x11], ecx
mov dl, dl
mov edx, dword [eax + 8]
mov dword [esp + 0x15], edx
mov ch, ch
mov eax, dword [eax + 0x18]
mov dword [esp + 0x19], eax
test eax, 0x6f5e
mov eax, 0x15
mov ecx, ecx
jmp 0x1002fdce
cmp ecx, 3
jne 0x1002fd1e
test bl, bl
mov cl, cl
cmp dword [eax + 0x24], 0
je 0x1002fcdd
mov byte [esp + 8], 4
test bl, bl
mov ecx, dword [eax + 0x18]
mov dword [esp + 9], ecx
test ecx, ecx
mov edx, dword [eax + 8]
mov ecx, dword [eax + 0xc]
mov dword [esp + 0xd], edx
mov dword [esp + 0x11], ecx
test ecx, ecx
mov edx, dword [eax + 0x10]
mov dword [esp + 0x15], edx
test ch, ch
mov ecx, dword [eax + 0x20]
mov dword [esp + 0x19], ecx
mov bl, bl
mov edx, dword [eax + 0x1c]
mov dword [esp + 0x1d], edx
mov edi, edi
mov dword [esp + 0x21], esi
push ebx
pop ebx
mov eax, 0x1d
mov esi, esi
jmp 0x1002fdce
mov byte [esp + 8], 5
test eax, 0x194a
mov ecx, dword [eax + 0x18]
mov dword [esp + 9], ecx
push ebx
pop ebx
mov edx, dword [eax + 8]
mov ecx, dword [eax + 0xc]
mov dword [esp + 0xd], edx
mov dword [esp + 0x11], ecx
mov cl, cl
mov edx, dword [eax + 0x10]
mov dword [esp + 0x15], edx
test edi, edi
mov eax, dword [eax + 0x20]
mov dword [esp + 0x19], eax
mov cl, cl
mov eax, 0x15
push edx
pop edx
jmp 0x1002fdce
cmp ecx, 4
jne 0x1002fe24
test cl, cl
mov byte [esp + 8], 7
test eax, eax
mov ecx, dword [eax + 0x18]
mov dword [esp + 9], ecx
test ah, ah
mov edx, dword [eax + 8]
mov ecx, dword [eax + 0xc]
mov dword [esp + 0xd], edx
mov dword [esp + 0x11], ecx
push eax
pop eax
mov edx, dword [eax + 0x10]
mov dword [esp + 0x15], edx
test dl, dl
mov ecx, dword [eax + 0x1c]
mov dword [esp + 0x19], ecx
nop
mov edx, dword [eax + 0x20]
mov dword [esp + 0x1d], edx
test dh, dh
mov eax, 0x19
mov ecx, ecx
jmp 0x1002fdce
cmp ecx, 1
jne 0x1002fd79
mov byte [esp + 8], cl
test ah, ah
jmp 0x1002fda5
cmp ecx, 0x14
jne 0x1002fd87
mov byte [esp + 8], 2
test esi, esi
jmp 0x1002fda5
cmp ecx, 0x1e
jne 0x1002fd95
mov byte [esp + 8], 3
test ch, ch
jmp 0x1002fda5
cmp ecx, 5
jne 0x1002fe24
mov byte [esp + 8], 6
test ah, ah
mov esi, dword [esp + 0x114]
lea ecx, [esi - 8]
push ecx
add eax, 8
push eax
lea edx, [esp + 0x11]
push edx
call fcn.100f61f0
add esp, 0xc
test eax, 0x5833
lea eax, [esi - 7]
test eax, 0x1d3a
mov ecx, dword [0x102a9300]
test ecx, ecx
je 0x1002fe24
cmp ecx, 0xffffffff
je 0x1002fe24
mov dword [esp + 4], 0
mov dh, dh
push 0
lea ecx, [esp + 8]
push ecx
push eax
mov eax, dword [0x102a9300]
lea edx, [esp + 0x14]
push edx
push eax
call dword [sym.imp.KERNEL32.DLL_WriteFile]
test esi, esi
cmp dword [esp + 4], 0
jne 0x1002fe24
mov eax, 1
pop esi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.100f43d6
add esp, 0x108
ret
mov ecx, dword [esp + 0x108]
pop esi
xor ecx, esp
xor eax, eax
call fcn.100f43d6
add esp, 0x108
ret