Function at 0x3003a9bd
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xf0
mov eax, dword [0x30001bc0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
mov edi, ecx
cmp edi, 0xa
mov dword [ebp - 0xd8], eax
ja 0x3003acba
mov eax, dword [ebp + 0xc]
shl eax, 4
add eax, 0x1c
push eax
push 2
mov dword [ebp - 0xe0], eax
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
mov dword [ebp - 0xdc], eax
call fcn.30067a6d
xor esi, esi
cmp eax, esi
mov dword [ebp - 0xd4], eax
jne 0x3003acbd
or word [ebp - 0xce], 0xffff
mov eax, 0x7fbc
sub eax, dword [ebp + 0xc]
push edi
push 0xca
mov word [ebp - 0xd0], 2
mov dword [ebp - 0xcc], ebx
mov word [ebp - 0xc8], si
mov word [ebp - 0xc2], di
mov dword [ebp - 0xbc], esi
mov word [ebp - 0xc0], si
mov word [ebp - 0xbe], ax
call fcn.3003b993
mov ecx, dword [ebp - 0xe0]
mov dword [ebp - 0xe4], eax
push edi
add eax, ecx
push eax
call fcn.3003b993
mov dword [ebp - 0xe8], eax
push edi
add eax, 0x12
push eax
call fcn.3003b993
mov dword [ebp - 0xec], eax
push edi
add eax, 0x12
push eax
call fcn.3003b993
push dword [ebp - 0xdc]
mov dword [ebp - 0xf0], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push esi
push esi
push dword [ebp - 0xe0]
mov edi, eax
push dword [ebp - 0xe4]
mov ax, word [ebp + 0xc]
push 0xfffffffffffffffc
push 0xfffffffffffffffd
push dword [ebp - 0xdc]
mov word [edi + 0x10], ax
mov eax, dword [ebp - 0xf0]
mov word [edi + 0x12], si
mov dword [edi + 0x14], esi
mov dword [edi + 0x18], eax
call fcn.3003a175
push esi
push dword [ebp - 0xe0]
lea eax, [ebp - 0x9c]
push dword [ebp - 0xe4]
push 0xfffffffffffffffd
push eax
call fcn.3003a134
push esi
push 0x12
push dword [ebp - 0xe8]
lea eax, [ebp - 0xb8]
push 0xffffffffffffffff
push eax
call fcn.3003a134
push esi
push 0x12
push dword [ebp - 0xec]
lea eax, [ebp - 0xaa]
push 0xfffffffffffffffe
push eax
call fcn.3003a134
mov eax, dword [ebp - 0xf0]
add eax, ebx
push eax
push dword [ebp - 0xd8]
call fcn.30067e61
cmp eax, esi
mov dword [ebp - 0xd4], eax
jne 0x3003ab69
push esi
push esi
push ebx
push dword [ebp - 0xd8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x3003ab98
mov dword [ebp - 0xd4], 0x2713
push ebx
push dword [ebp - 0xd8]
call fcn.30067e61
push dword [ebp - 0xdc]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push dword [ebp - 0xdc]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebp - 0xd4]
jmp 0x3003acbd
push esi
lea eax, [ebp - 0xd4]
push eax
push 0xca
lea eax, [ebp - 0xd0]
push eax
push dword [ebp - 0xd8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x3003ab5f
mov eax, dword [ebp - 0xe4]
push esi
push esi
add eax, ebx
push eax
push dword [ebp - 0xd8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x3003ab5f
push esi
lea eax, [ebp - 0xd4]
push eax
push dword [ebp - 0xe0]
push edi
push dword [ebp - 0xd8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x3003ab5f
push esi
push esi
push 0x12
push dword [ebp - 0xe8]
mov word [edi + 0x10], si
push 0xfffffffffffffffc
push 0xffffffffffffffff
push dword [ebp - 0xdc]
call fcn.3003a175
mov eax, dword [ebp - 0xe8]
push esi
push esi
add eax, ebx
push eax
push dword [ebp - 0xd8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x3003ab5f
push esi
lea eax, [ebp - 0xd4]
push eax
push 0x12
push edi
push dword [ebp - 0xd8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x3003ab5f
push esi
push esi
push 0x12
push dword [ebp - 0xec]
push 0xfffffffffffffffc
push 0xfffffffffffffffe
push dword [ebp - 0xdc]
call fcn.3003a175
mov eax, dword [ebp - 0xec]
push esi
push esi
add eax, ebx
push eax
push dword [ebp - 0xd8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x3003ab5f
push esi
lea eax, [ebp - 0xd4]
push eax
push 0x12
push edi
push dword [ebp - 0xd8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x3003ab5f
mov dword [ebp - 0xd4], esi
jmp 0x3003ab75
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.30071b52
leave
ret 8