Function at 0x10002f03
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1002462b
mov eax, dword fs:[0]
push eax
sub esp, 0x288
mov eax, dword [0x10032014]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x290], ebx
mov esi, dword [ebp + 8]
mov dword [ebp - 0x294], esi
movzx eax, byte [esi]
add eax, 0xfffffffe
cmp eax, 0xd
ja case.0x10002a4e.6
jmp dword [eax*4 + 0x10002fcc]
push 0x2800
push 0x40
mov dword [ebx + 0x18], 0
mov dword [ebp - 0x28c], 0x2800
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
lea ecx, [esi + 1]
mov dword [ebp - 0x288], eax
push ecx
lea eax, [ebp - 0x128]
push str._s.
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x280]
push eax
lea eax, [ebp - 0x128]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
mov dword [ebp - 0x294], esi
cmp esi, 0xffffffff
jne 0x10002acf
push 1
lea eax, [ebp - 0x284]
mov byte [ebp - 0x284], 0x68
push eax
mov ecx, ebx
call fcn.10006760
jmp case.0x10002a4e.6
mov ebx, dword [ebp - 0x288]
mov edi, 1
mov byte [ebx], 0x68
nop dword [eax]
mov ecx, dword [ebp - 0x28c]
lea eax, [ecx - 0x208]
cmp edi, eax
jbe 0x10002b08
add ecx, 0x208
push 0x42
push ecx
push ebx
mov dword [ebp - 0x28c], ecx
call dword [sym.imp.KERNEL32.dll_LocalReAlloc]
mov ebx, eax
mov ecx, 0x1002e2e4
lea eax, [ebp - 0x254]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10002b33
test dl, dl
je 0x10002b2f
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10002b33
add eax, 2
add ecx, 2
test dl, dl
jne 0x10002b13
xor eax, eax
jmp 0x10002b38
sbb eax, eax
or eax, 1
test eax, eax
je 0x10002bdf
mov ecx, 0x1002e2e8
lea eax, [ebp - 0x254]
nop dword [eax + eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10002b70
test dl, dl
je 0x10002b6c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10002b70
add eax, 2
add ecx, 2
test dl, dl
jne 0x10002b50
xor eax, eax
jmp 0x10002b75
sbb eax, eax
or eax, 1
test eax, eax
je 0x10002bdf
mov al, byte [ebp - 0x280]
and al, 0x10
mov byte [edi + ebx], al
lea eax, [ebp - 0x254]
push eax
inc edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
lea ecx, [edi + ebx]
push esi
lea eax, [ebp - 0x254]
push eax
push ecx
call fcn.10014120
add edi, esi
add esp, 0xc
mov esi, dword [ebp - 0x294]
mov byte [edi + ebx], 0
mov eax, dword [ebp - 0x264]
mov dword [edi + ebx + 1], eax
mov eax, dword [ebp - 0x260]
mov dword [edi + ebx + 5], eax
mov eax, dword [ebp - 0x26c]
mov dword [edi + ebx + 9], eax
mov eax, dword [ebp - 0x268]
mov dword [edi + ebx + 0xd], eax
add edi, 0x11
lea eax, [ebp - 0x280]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x10002ae0
mov ecx, dword [ebp - 0x290]
push edi
push ebx
mov dword [ebp - 0x288], ebx
call fcn.10006760
mov eax, ebx
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp case.0x10002a4e.6
lea eax, [esi + 1]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 1
lea eax, [ebp - 0x284]
mov byte [ebp - 0x284], 0x6c
push eax
mov ecx, ebx
call fcn.10006760
jmp case.0x10002a4e.6
lea eax, [esi + 1]
push eax
call fcn.10003640
jmp 0x10002c27
inc esi
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push esi
cmp byte [eax + esi - 1], 0x5c
jne 0x10002c8b
mov ecx, ebx
call fcn.100038e0
cmp dword [ebx + 0x14], 0
jne 0x10002d10
push 1
lea eax, [ebp - 0x284]
mov byte [ebp - 0x284], 0x6b
push eax
mov ecx, ebx
call fcn.10006760
jmp case.0x10002a4e.6
lea ecx, [ebp - 0x140]
call fcn.10003d20
mov dword [ebp - 4], 0
lea eax, [ebp - 0x140]
mov esi, dword [ebx + 0x10]
push eax
mov edi, dword [esi + 4]
push edi
push esi
call fcn.10003ea0
mov edx, eax
mov ecx, 0x7fffffe
mov eax, dword [ebx + 0x14]
sub ecx, eax
cmp ecx, 1
jb 0x10002fba
inc eax
mov dword [ebp - 4], 0xffffffff
mov dword [ebx + 0x14], eax
mov dword [esi + 4], edx
mov dword [edi], edx
mov edx, dword [ebp - 0x12c]
cmp edx, 0x10
jb 0x10002d10
mov ecx, dword [ebp - 0x140]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10002d06
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10002fc4
push edx
push ecx
call fcn.1001246f
add esp, 8
mov eax, dword [ebx + 0x10]
mov eax, dword [eax]
add eax, 8
cmp dword [eax + 0x14], 0x10
jb 0x10002d20
mov eax, dword [eax]
push eax
mov ecx, ebx
call fcn.10003740
jmp case.0x10002a4e.6
cmp dword [esi + 5], 0xffffffff
lea edi, [esi + 1]
jne 0x10002d40
call fcn.10003830
jmp case.0x10002a4e.6
push 0
push 0x80
push 3
push 0
push 1
push connect
lea eax, [ebx + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x290], eax
cmp eax, 0xffffffff
je case.0x10002a4e.6
push 0
push edi
push dword [edi + 4]
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0x2000
push 0x40
mov dword [ebp - 0x28c], 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
lea eax, [ebp - 0x28c]
push 0
push eax
push 0x1ff7
mov byte [esi], 0x6a
lea eax, [esi + 9]
mov ecx, dword [edi]
mov dword [esi + 1], ecx
mov ecx, dword [edi + 4]
mov edi, dword [ebp - 0x290]
push eax
push edi
mov dword [esi + 5], ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x28c]
mov ecx, ebx
test eax, eax
je 0x10002de7
add eax, 9
push eax
push esi
call fcn.10006760
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp case.0x10002a4e.6
call fcn.10003830
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp case.0x10002a4e.6
lea eax, [esi + 1]
push eax
call fcn.10003010
push 1
lea eax, [ebp - 0x284]
mov byte [ebp - 0x284], 0x6f
push eax
mov ecx, ebx
call fcn.10006760
jmp case.0x10002a4e.6
inc esi
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
add eax, esi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileA]
push 1
lea eax, [ebp - 0x284]
mov byte [ebp - 0x284], 0x71
push eax
mov ecx, ebx
call fcn.10006760
jmp case.0x10002a4e.6
call fcn.10003ae0
jmp case.0x10002a4e.6
mov eax, dword [esi + 1]
mov dword [ebx + 0x18], eax
call fcn.10003b10
jmp case.0x10002a4e.6
push 0x104
lea edi, [ebx + 0x1c]
push 0
push edi
call fcn.100146a0
lea ecx, [esi + 9]
mov edx, edi
add esp, 0xc
sub edx, ecx
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [ecx + edx - 1], al
test al, al
jne 0x10002e80
mov eax, dword [esi + 5]
push edi
mov dword [ebx + 0x120], eax
mov dword [ebx + 0x124], 0
call fcn.10003010
lea eax, [ebp - 0x280]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x10002ef0
mov ecx, dword [ebx + 0x18]
cmp ecx, 4
je 0x10002ef0
cmp ecx, 2
je 0x10002ef0
cmp ecx, 6
je 0x10002ef0
push 1
lea eax, [ebp - 0x284]
mov byte [ebp - 0x284], 0x6d
push eax
mov ecx, ebx
call fcn.10006760
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp case.0x10002a4e.6
mov ecx, ebx
call fcn.10003b10
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp case.0x10002a4e.6
mov eax, dword [esi + 1]
mov edi, dword [esi + 5]
push 0
push 0x80
push 3
push 0
push 2
mov dword [ebp - 0x288], eax
lea eax, [ebx + 0x1c]
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
lea eax, [ebp - 0x288]
push 0
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [ebp - 0x290]
push eax
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff7
push eax
mov eax, dword [ebp - 0x294]
add eax, 9
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x288]
mov ecx, ebx
mov dword [ebp - 0x1b], eax
mov eax, dword [ebp - 0x290]
add eax, edi
mov byte [ebp - 0x1c], 0x70
mov dword [ebp - 0x17], eax
lea eax, [ebp - 0x1c]
push 9
push eax
call fcn.10006760
jmp case.0x10002a4e.6
push 5
jmp 0x10002f93
push 0
lea eax, [esi + 1]
push eax
call fcn.10003190
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10012425
mov esp, ebp
pop ebp
ret 8
push str.list_T__too_long
call fcn.1001358c
call fcn.10016624
nop dword [eax]
push ebp
sub al, byte [eax]
adc byte [esi + 0x2c], cl
add byte [eax], dl
add byte cs:[eax], dl
add ebp, dword [edi]
add byte [eax], dl
pushfd
das
add byte [eax], dl
sub eax, 0x4c10002d
add byte cs:[eax], dl
sbb eax, 0x4310002c
sub al, 0
adc byte [esi + 0x2e], dl
add byte [eax], dl
clc
sub eax, 773656576
add byte [eax], dl
lea ebp, [edi]
add byte [eax], dl
xchg ecx, eax
das
add byte [eax], dl
int3