Function at 0x30030ec5
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x5f0]
sub esp, 0x670
mov eax, dword [0x300930a4]
mov dword [ebp + 0x5ec], eax
push ebx
xor ebx, ebx
xor eax, eax
push esi
push edi
mov edx, 0x81
mov word [ebp - 0x68], bx
mov ecx, edx
lea edi, [ebp - 0x66]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov ecx, 0x91
lea edi, [ebp + 0x1a0]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x80], ebx
lea edi, [ebp - 0x7c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov word [ebp + 0x3e4], bx
mov ecx, edx
lea edi, [ebp + 0x3e6]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov edi, dword [ebp + 0x600]
mov eax, dword [edi + 0x21c]
mov dword [ebp - 0x70], ebx
mov dword [ebp - 0x74], ebx
movzx eax, word [eax]
cmp eax, dword [edi + 4]
mov dword [ebp - 0x6c], ebx
jb 0x30030f61
call fcn.30022690
test eax, eax
je 0x30030f53
push 0x30005398
call fcn.3002272a
cmp dword [edi + 4], ebx
je 0x300311b6
jmp 0x300311af
mov eax, dword [edi]
test al, 2
je 0x30030f92
and eax, 0x10000000
push eax
call fcn.30032740
test eax, eax
jne 0x30030f92
call fcn.30022690
test eax, eax
je 0x300311b6
push 0x30005364
call fcn.3002272a
jmp 0x300311b6
xor esi, esi
inc esi
push esi
lea eax, [ebp - 0x74]
push eax
push edi
call fcn.3002ff3e
test eax, eax
jne 0x30030fb8
call fcn.30022690
test eax, eax
je 0x300311b6
push 0x30005330
jmp 0x30030f88
push ebx
lea eax, [ebp - 0x7c]
push eax
push edi
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0x80], 0xc
call fcn.3002ff3e
test eax, eax
jne 0x30030fe5
call fcn.30022690
test eax, eax
je 0x300311b6
push 0x300052fc
jmp 0x30030f88
cmp dword [0x3009e708], ebx
mov ebx, dword [ebp + 0x5f8]
jne 0x30031029
call fcn.300275d8
test eax, eax
je 0x30031029
cmp dword [0x30098848], 2
jne 0x30031026
mov eax, dword [ebp + 0x5fc]
mov eax, dword [eax + 0x113c]
test eax, eax
je 0x3003101f
cmp word [eax], 0
je 0x3003101f
mov eax, esi
jmp 0x30031021
xor eax, eax
mov dword [ebx + 0x28], eax
jmp 0x30031029
mov dword [ebx + 0x28], esi
mov eax, dword [ebp + 0x5fc]
mov dword [ebx + 0x14], esi
mov ecx, dword [eax + 0x1140]
mov dword [ebx + 0x30], ecx
push dword [eax + 0x113c]
push 0
push 0
push ebx
call fcn.3002a172
test eax, eax
jne 0x30031066
call fcn.30022690
test eax, eax
je 0x300311b6
push 0x300052c0
jmp 0x30030f88
push dword [ebp - 0x74]
push edi
call fcn.30030003
test eax, eax
je 0x300311b6
lea ecx, [ebp - 0x80]
push ecx
push 0x100002
mov esi, 0x104
push esi
lea ecx, [ebp - 0x68]
push ecx
push 0x30003e6c
lea eax, [edi + 0xc]
push eax
lea eax, [ebp - 0x70]
push eax
call fcn.30021cb7
test eax, eax
jne 0x300310b7
call fcn.30022690
test eax, eax
je 0x300311b6
push 0x30005288
jmp 0x30030f88
push 0
lea eax, [ebp + 0x600]
push eax
push dword [ebx + 0x1c]
push dword [ebx + 0x20]
push dword [ebp - 0x70]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x300310ea
call fcn.30022690
test eax, eax
je 0x300311b6
push 0x3000525c
jmp 0x30030f88
push esi
lea eax, [ebp + 0x1a0]
push eax
lea eax, [ebp - 0x68]
push eax
call fcn.3002f478
push edi
call fcn.3002e3d6
test eax, eax
je 0x300311b6
lea eax, [ebp - 0x80]
push eax
push ebx
push dword [ebp + 0x5fc]
lea eax, [ebp + 0x1a0]
push eax
call fcn.3002e991
test eax, eax
jne 0x3003113b
call fcn.30022690
test eax, eax
je 0x300311b6
push 0x30005220
jmp 0x30030f88
push esi
lea eax, [ebp + 0x3e4]
push eax
lea eax, [edi + 0xc]
push eax
call fcn.3004cae8
push esi
lea eax, [ebp + 0x3e4]
push eax
push 0x30002e98
call fcn.3004cb2a
push esi
lea eax, [ebp + 0x3e4]
push eax
push 0x30005440
call fcn.3004cb2a
lea eax, [ebp - 0x80]
push eax
push 0x100002
lea eax, [ebp + 0x3e4]
push eax
call fcn.300300c0
test eax, eax
jne 0x3003119c
call fcn.30022690
test eax, eax
je 0x300311b6
push 0x300051ec
jmp 0x30030f88
call fcn.30022690
test eax, eax
je 0x300311af
push 0x300051c8
call fcn.3002272a
mov dword [ebp - 0x6c], 1
push dword [edi + 0x214]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor esi, esi
cmp dword [ebp - 0x70], esi
je 0x300311d2
push dword [ebp - 0x70]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x6c], esi
je 0x300311f3
test byte [edi + 3], 0x10
jne 0x300311e6
call fcn.3002e5b0
test eax, eax
je 0x300311f3
mov eax, dword [edi]
or eax, 0x30000
push eax
call fcn.30030e36
push dword [ebp - 0x7c]
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp - 0x6c], esi
pop edi
pop esi
pop ebx
jne 0x30031219
lea eax, [ebp - 0x68]
push eax
call fcn.30021c34
lea eax, [ebp + 0x1a0]
push eax
call fcn.30021c34
mov ecx, dword [ebp + 0x5ec]
mov eax, dword [ebp - 0x6c]
call fcn.3005f839
add ebp, 0x5f0
leave
ret 0xc