Function at 0x2e01a31a
Capabilities:
Write file on windows

Disassembly:
push 0x558
mov eax, 0x2e101a54
call fcn.2e01c44f
mov eax, dword [ebp + 8]
mov dword [ebp - 0x534], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x530], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x538], eax
xor eax, eax
mov ebx, 0x208
push ebx
mov word [ebp - 0x52c], ax
xor esi, esi
lea eax, [ebp - 0x52a]
push esi
push eax
mov dword [ebp - 0x53c], ecx
call fcn.2e01b598
add esp, 0xc
lea eax, [ebp - 0x52c]
push eax
mov edi, 0x105
push edi
call fcn.2e019fdc
dec eax
mov dword [ebp - 0x540], eax
cmp eax, 0x104
ja 0x2e01a3cd
xor eax, eax
push ebx
mov word [ebp - 0x21c], ax
lea eax, [ebp - 0x21a]
push esi
push eax
call fcn.2e01b598
add esp, 0xc
push esi
push 0x2e001ed8
push 0x2e001e90
push edi
lea eax, [ebp - 0x21c]
push eax
call fcn.2e019c43
test al, al
je 0x2e01a3cd
lea eax, [ebp - 0x21c]
push eax
call fcn.2e01a05f
mov ecx, dword [ebp - 0x53c]
or edi, 0xffffffff
call fcn.2e01a2fe
test al, al
je 0x2e01a612
cmp dword [ebp - 0x534], esi
jne 0x2e01a3f8
cmp dword [ebp + 0xc], esi
jne 0x2e01a400
push 0xfffffffffffffffb
pop eax
jmp 0x2e01a614
cmp dword [ebp + 0xc], esi
je 0x2e01a400
mov dword [ebp + 0xc], esi
lea ecx, [ebp - 0x564]
call fcn.2e01ae12
push dword [ebp - 0x530]
mov dword [ebp - 4], esi
push dword [ebp - 0x530]
call dword [sym.imp.KERNEL32.dll_GlobalSize]
push eax
push esi
push dword [ebp - 0x538]
lea ecx, [ebp - 0x564]
call fcn.2e01ae35
test al, al
je 0x2e01a5e0
cmp dword [ebp + 0xc], esi
jne 0x2e01a5d5
push dword [ebp - 0x534]
lea eax, [ebp - 0x320]
push 0x104
push eax
call fcn.2e01ada6
test eax, eax
je 0x2e01a5d5
push esi
push 0x8000000
push 2
push esi
push esi
push 0x40000000
lea eax, [ebp - 0x320]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x538], eax
cmp eax, edi
je 0x2e01a5d5
mov edi, 0x1000
push edi
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 0x530], eax
cmp eax, esi
je 0x2e01a4f9
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ebx, eax
cmp ebx, esi
je 0x2e01a4ed
jmp 0x2e01a4ca
push esi
lea ecx, [ebp - 0x534]
push ecx
push eax
push ebx
push dword [ebp - 0x538]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
push ebx
lea ecx, [ebp - 0x564]
call fcn.2e01af95
mov dword [ebp - 0x534], eax
cmp eax, esi
ja 0x2e01a4b4
push dword [ebp - 0x530]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push dword [ebp - 0x530]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push dword [ebp - 0x538]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
push esi
push esi
push esi
push 1
push 1
push esi
push esi
push 0xcf0000
push esi
push 0x2e001e80
push esi
call dword [sym.imp.USER32.dll_CreateWindowExW]
push esi
push eax
mov dword [ebp - 0x530], eax
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [ebp - 0x530]
mov ebx, dword [sym.imp.USER32.dll_IsWindow]
call ebx
test eax, eax
je 0x2e01a5d3
lea eax, [ebp - 0x320]
push eax
push 0x104
lea eax, [ebp - 0x21c]
push eax
call fcn.2e019e68
test eax, eax
je 0x2e01a5d3
mov edi, dword [ebp - 0x53c]
mov eax, dword [edi + 8]
push dword [ebp - 0x530]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x18]
test eax, eax
jl 0x2e01a5d3
mov eax, dword [edi + 4]
mov ecx, dword [eax]
push 2
lea edx, [ebp - 0x21c]
push edx
push eax
call dword [ecx + 0x44]
test eax, eax
jl 0x2e01a5d3
mov eax, dword [edi + 4]
mov ecx, dword [eax]
add edi, 0x10
push edi
push eax
call dword [ecx + 0x20]
test eax, eax
jl 0x2e01a5d3
mov eax, dword [edi]
mov ecx, dword [eax]
push esi
push esi
push 4
lea edx, [ebp - 0x21c]
push edx
push eax
call dword [ecx + 0xb0]
test eax, eax
jl 0x2e01a5d3
push dword [ebp - 0x530]
call ebx
test eax, eax
je 0x2e01a5d3
push dword [ebp - 0x530]
call dword [sym.imp.USER32.dll_DestroyWindow]
xor edi, edi
lea ecx, [ebp - 0x564]
call fcn.2e01b018
mov ecx, dword [ebp - 0x53c]
call fcn.2e019f85
cmp dword [ebp - 0x540], 0x104
ja 0x2e01a603
lea eax, [ebp - 0x52c]
push eax
call fcn.2e01a05f
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x564]
call fcn.2e01b062
mov eax, edi
call fcn.2e01c4d2
ret 0x14