Function at 0x30031d79
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x5f0]
sub esp, 0x670
mov eax, dword [section..cdata]
mov dword [ebp + 0x5ec], eax
push ebx
xor ebx, ebx
xor eax, eax
push esi
push edi
mov edx, 0x81
mov word [ebp - 0x68], bx
mov ecx, edx
lea edi, [ebp - 0x66]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov ecx, 0x91
lea edi, [ebp + 0x1a0]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x80], ebx
lea edi, [ebp - 0x7c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov word [ebp + 0x3e4], bx
mov ecx, edx
lea edi, [ebp + 0x3e6]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov edi, dword [ebp + 0x600]
mov eax, dword [edi + 0x21c]
mov dword [ebp - 0x70], ebx
mov dword [ebp - 0x74], ebx
movzx eax, word [eax]
cmp eax, dword [edi + 4]
mov dword [ebp - 0x6c], ebx
jb 0x30031e15
call fcn.30022c75
test eax, eax
je 0x30031e07
push 0x300053f0
call fcn.30022d0f
cmp dword [edi + 4], ebx
je 0x3003206a
jmp 0x30032063
mov eax, dword [edi]
test al, 2
je 0x30031e46
and eax, 0x10000000
push eax
call fcn.300335f4
test eax, eax
jne 0x30031e46
call fcn.30022c75
test eax, eax
je 0x3003206a
push 0x300053bc
call fcn.30022d0f
jmp 0x3003206a
xor esi, esi
inc esi
push esi
lea eax, [ebp - 0x74]
push eax
push edi
call fcn.30030df2
test eax, eax
jne 0x30031e6c
call fcn.30022c75
test eax, eax
je 0x3003206a
push 0x30005388
jmp 0x30031e3c
push ebx
lea eax, [ebp - 0x7c]
push eax
push edi
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0x80], 0xc
call fcn.30030df2
test eax, eax
jne 0x30031e99
call fcn.30022c75
test eax, eax
je 0x3003206a
push 0x30005354
jmp 0x30031e3c
cmp dword [0x300a25e8], ebx
mov ebx, dword [ebp + 0x5f8]
jne 0x30031edd
call fcn.30027d4d
test eax, eax
je 0x30031edd
cmp dword [0x3009c728], 2
jne 0x30031eda
mov eax, dword [ebp + 0x5fc]
mov eax, dword [eax + 0x113c]
test eax, eax
je 0x30031ed3
cmp word [eax], 0
je 0x30031ed3
mov eax, esi
jmp 0x30031ed5
xor eax, eax
mov dword [ebx + 0x28], eax
jmp 0x30031edd
mov dword [ebx + 0x28], esi
mov eax, dword [ebp + 0x5fc]
mov dword [ebx + 0x14], esi
mov ecx, dword [eax + 0x1140]
mov dword [ebx + 0x30], ecx
push dword [eax + 0x113c]
push 0
push 0
push ebx
call fcn.3002a9c5
test eax, eax
jne 0x30031f1a
call fcn.30022c75
test eax, eax
je 0x3003206a
push 0x30005318
jmp 0x30031e3c
push dword [ebp - 0x74]
push edi
call fcn.30030eb7
test eax, eax
je 0x3003206a
lea ecx, [ebp - 0x80]
push ecx
push 0x100002
mov esi, 0x104
push esi
lea ecx, [ebp - 0x68]
push ecx
push 0x30003e7c
lea eax, [edi + 0xc]
push eax
lea eax, [ebp - 0x70]
push eax
call fcn.3002227c
test eax, eax
jne 0x30031f6b
call fcn.30022c75
test eax, eax
je 0x3003206a
push 0x300052e0
jmp 0x30031e3c
push 0
lea eax, [ebp + 0x600]
push eax
push dword [ebx + 0x1c]
push dword [ebx + 0x20]
push dword [ebp - 0x70]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x30031f9e
call fcn.30022c75
test eax, eax
je 0x3003206a
push 0x300052b4
jmp 0x30031e3c
push esi
lea eax, [ebp + 0x1a0]
push eax
lea eax, [ebp - 0x68]
push eax
call fcn.3003032c
push edi
call fcn.3002f274
test eax, eax
je 0x3003206a
lea eax, [ebp - 0x80]
push eax
push ebx
push dword [ebp + 0x5fc]
lea eax, [ebp + 0x1a0]
push eax
call fcn.3002f845
test eax, eax
jne 0x30031fef
call fcn.30022c75
test eax, eax
je 0x3003206a
push 0x30005278
jmp 0x30031e3c
push esi
lea eax, [ebp + 0x3e4]
push eax
lea eax, [edi + 0xc]
push eax
call fcn.3004fe88
push esi
lea eax, [ebp + 0x3e4]
push eax
push 0x30002eb8
call fcn.3004feca
push esi
lea eax, [ebp + 0x3e4]
push eax
push 0x30005498
call fcn.3004feca
lea eax, [ebp - 0x80]
push eax
push 0x100002
lea eax, [ebp + 0x3e4]
push eax
call fcn.30030f74
test eax, eax
jne 0x30032050
call fcn.30022c75
test eax, eax
je 0x3003206a
push 0x30005244
jmp 0x30031e3c
call fcn.30022c75
test eax, eax
je 0x30032063
push 0x30005220
call fcn.30022d0f
mov dword [ebp - 0x6c], 1
push dword [edi + 0x214]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor esi, esi
cmp dword [ebp - 0x70], esi
je 0x30032086
push dword [ebp - 0x70]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x6c], esi
je 0x300320a7
test byte [edi + 3], 0x10
jne 0x3003209a
call fcn.3002f44e
test eax, eax
je 0x300320a7
mov eax, dword [edi]
or eax, 0x30000
push eax
call fcn.30031cea
push dword [ebp - 0x7c]
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp - 0x6c], esi
pop edi
pop esi
pop ebx
jne 0x300320cd
lea eax, [ebp - 0x68]
push eax
call fcn.300221f9
lea eax, [ebp + 0x1a0]
push eax
call fcn.300221f9
mov ecx, dword [ebp + 0x5ec]
mov eax, dword [ebp - 0x6c]
call fcn.30063125
add ebp, 0x5f0
leave
ret 0xc