Function at 0x10003020
Capabilities:
Create directory
Resolve function by parsing pe exports
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x498
mov eax, dword [0x10015364]
xor eax, esp
mov dword [esp + 0x494], eax
push esi
push edi
push 0x100
lea eax, [esp + 0x9c]
mov dword [esp + 0x60], ecx
mov edi, edx
push 0
push eax
mov dword [esp + 0x64], edi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esp + 0x98]
push 0x100
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__getcwd]
push 0x5c
push edi
call dword [sym.imp.VCRUNTIME140.dll_strrchr]
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1000358e
sub esi, edi
lea eax, [esp + 0x298]
push esi
push edi
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
add esp, 0xc
cmp esi, 0x100
jae 0x100035a4
lea ecx, [esp + 0x298]
mov byte [esp + esi + 0x298], 0
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100030c0
sub ecx, edx
je 0x1000358e
mov dword [esp + 0x18], 0xd5337463
mov dword [esp + 0x1c], 0x21651b87
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], ecx
mov dword [esp + 0x18], 0x978a8d40
mov dword [esp + 0x1c], 0x5dcc1d6e
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x18], 0x7d4210f9
mov dword [esp + 0x1c], 0xcf1e1adf
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
mov dword [esp + 0x18], 0x7e1cea73
mov dword [esp + 0x1c], 0x5960adeb
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x18], 0x4e4619be
mov dword [esp + 0x1c], 0xd1418626
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], ecx
mov dword [esp + 0x18], 0x7f207fe0
mov dword [esp + 0x1c], 0x53656c3f
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x18], 0xa652333f
mov dword [esp + 0x1c], 0x4a167aca
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x18], 0xdacdd61c
mov dword [esp + 0x1c], 0x30b95933
mov dword [esp + 0x60], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x64], ecx
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x18], 0x261e6389
mov dword [esp + 0x1c], 0x9d435798
mov dword [esp + 0x68], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x6c], ecx
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x18], 0xb739916
mov dword [esp + 0x1c], 0x1d05ce99
mov dword [esp + 0x70], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x74], ecx
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x18], 0x3c2369d3
mov dword [esp + 0x1c], 0xd1418626
mov dword [esp + 0x78], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x7c], ecx
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x18], 0x7f207fe0
mov dword [esp + 0x80], eax
mov dword [esp + 0x1c], 0x53656c3f
mov eax, dword [esp + 0x18]
mov dword [esp + 0x84], ecx
mov ecx, dword [esp + 0x1c]
movaps xmm1, xmmword [esp + 0x20]
xorps xmm1, xmmword [esp + 0x60]
movaps xmmword [esp + 0x20], xmm1
movaps xmm1, xmmword [esp + 0x70]
xorps xmm1, xmmword [esp + 0x30]
movaps xmmword [esp + 0x30], xmm1
movaps xmm1, xmmword [esp + 0x40]
mov dword [esp + 0x88], eax
mov dword [esp + 0x8c], ecx
xorps xmm1, xmmword [esp + 0x80]
movaps xmmword [esp + 0x40], xmm1
lea edx, [esp + 0x20]
mov esi, edx
mov al, byte [edx]
inc edx
test al, al
jne 0x10003291
lea edi, [esp + 0x98]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x100032a2
mov ecx, edx
lea eax, [esp + 0x98]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push eax
lea ecx, [esp + 0x24]
call fcn.1000b2a0
lea ecx, [esp + 0x20]
call fcn.10001570
mov ecx, dword [esp + 0x34]
mov byte [esp + 0x17], al
cmp ecx, 0x10
jb 0x10003312
mov edx, dword [esp + 0x20]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10003304
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x10003304
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.1000f79c
mov al, byte [esp + 0x1f]
add esp, 8
test al, al
jne 0x10003326
push 0
lea eax, [esp + 0x9c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea edi, [esp + 0x98]
dec edi
nop
mov al, byte [edi + 1]
lea edi, [edi + 1]
test al, al
jne 0x10003330
mov ax, word [0x10012bec]
mov edx, 0x10015a68
mov word [edi], ax
mov esi, edx
nop word [eax + eax]
mov al, byte [edx]
inc edx
test al, al
jne 0x10003350
lea edi, [esp + 0x98]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x10003361
mov ecx, edx
lea eax, [esp + 0x98]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push eax
lea ecx, [esp + 0x24]
call fcn.1000b2a0
lea ecx, [esp + 0x20]
call fcn.10001570
mov ecx, dword [esp + 0x34]
mov byte [esp + 0x17], al
cmp ecx, 0x10
jb 0x100033d1
mov edx, dword [esp + 0x20]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x100033c3
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x100033c3
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.1000f79c
mov al, byte [esp + 0x1f]
add esp, 8
test al, al
jne 0x100033e5
push 0
lea eax, [esp + 0x9c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
xor ecx, ecx
nop word [eax + eax]
mov al, byte [esp + ecx + 0x98]
lea ecx, [ecx + 1]
mov byte [esp + ecx + 0x197], al
test al, al
jne 0x100033f0
lea eax, [esp + 0x298]
push 0x10012bec
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strtok]
add esp, 8
test eax, eax
je 0x100034f1
lea edi, [esp + 0x198]
dec edi
nop dword [eax + eax]
mov cl, byte [edi + 1]
lea edi, [edi + 1]
test cl, cl
jne 0x10003430
mov cx, word [0x10012bec]
mov esi, eax
mov word [edi], cx
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10003446
lea edi, [esp + 0x198]
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x10003457
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [esp + 0x198]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push eax
lea ecx, [esp + 0x24]
call fcn.1000b2a0
lea ecx, [esp + 0x20]
call fcn.10001570
mov ecx, dword [esp + 0x34]
mov byte [esp + 0x17], al
cmp ecx, 0x10
jb 0x100034c5
mov edx, dword [esp + 0x20]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x100034b7
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100032fe
push ecx
push edx
call fcn.1000f79c
mov al, byte [esp + 0x1f]
add esp, 8
test al, al
jne 0x100034d9
push 0
lea eax, [esp + 0x19c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push 0x10012bec
push 0
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strtok]
add esp, 8
test eax, eax
jne 0x10003423
xor ecx, ecx
mov al, byte [esp + ecx + 0x198]
lea ecx, [ecx + 1]
mov byte [esp + ecx + 0x397], al
test al, al
jne 0x100034f3
lea edi, [esp + 0x398]
dec edi
mov al, byte [edi + 1]
lea edi, [edi + 1]
test al, al
jne 0x10003510
mov ax, word [0x10012bec]
push dword [esp + 0x58]
mov word [edi], ax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameA]
mov edx, eax
mov esi, eax
mov al, byte [edx]
inc edx
test al, al
jne 0x10003531
lea edi, [esp + 0x398]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x10003542
mov ecx, edx
lea eax, [esp + 0x398]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
push 0x10012bf0
rep movsb byte es:[edi], byte [esi]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x1000358e
push esi
push dword [ebp + 8]
push 1
push dword [esp + 0x68]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 0x14
mov ecx, dword [esp + 0x49c]
pop edi
pop esi
xor ecx, esp
call fcn.1000f444
mov esp, ebp
pop ebp
ret 4
call fcn.1000f8ef
int3