Function at 0x10002b70
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [esi + 0x24]
push ebp
mov ebp, dword [esp + 8]
push edi
mov edi, 1
cmp eax, 4
je 0x10002b87
cmp eax, edi
jne 0x10002bc7
mov eax, dword [esi + 0x20]
cmp eax, edi
jne 0x10002ba6
cmp dword [ebp + 0x14], 0
je 0x10002bc7
lea eax, [ebp + 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
cmp eax, dword [ebp + 0x68]
jge 0x10002bc7
push edi
jmp 0x10002bc0
test eax, eax
jne 0x10002bc7
cmp dword [ebp + 4], eax
je 0x10002bc7
lea ecx, [ebp + 0x64]
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
cmp eax, dword [ebp + 0x6c]
jge 0x10002bc7
push 0
mov ecx, ebp
call fcn.10002b00
mov eax, dword [esi + 0x24]
dec eax
cmp eax, 4
ja case.default.0x10002bd4
jmp dword [eax*4 + 0x10002d64]
test ebx, ebx
jne 0x10002c0c
mov edx, dword [ebp]
mov eax, dword [edx + 4]
push esi
mov ecx, ebp
call eax
test eax, eax
je 0x10002c0c
mov dword [esi + 0x24], 2
cmp dword [esi + 0x30], 0
mov dword [esi + 0x2c], edi
jne 0x10002c0c
mov eax, esi
call fcn.100036b0
mov edi, eax
neg edi
sbb edi, edi
inc edi
mov ecx, dword [esi + 0x30]
or ecx, edi
je 0x10002c1d
lea edx, [esi + 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
lea eax, [esi + 0x28]
push eax
jmp 0x10002d49
test ebx, ebx
jne 0x10002c0c
mov eax, dword [esi + 0x20]
sub eax, ebx
mov dword [esi + 0x24], 2
je 0x10002c50
sub eax, edi
jne 0x10002c0c
mov ecx, dword [esi + 0x1c]
push eax
push 0x100028a0
push ecx
call dword [sym.imp.KERNEL32.dll_BindIoCompletionCallback]
test eax, eax
je 0x10002c0c
mov edx, dword [ebp]
mov eax, dword [edx + 4]
push esi
mov ecx, ebp
call eax
test eax, eax
je 0x10002c0c
jmp 0x10002bf5
test ebx, ebx
je 0x10002c6d
cmp ebx, 0x80000005
jne 0x10002c0c
mov eax, dword [esp + 0x10]
push 0
push ebp
mov ecx, esi
call fcn.10003830
test eax, eax
js 0x10002c0c
jmp 0x10002bfe
test ebx, ebx
jne 0x10002cd8
mov eax, dword [esi + 0x30]
mov ecx, dword [esp + 0x10]
cmp ecx, eax
jae 0x10002cd8
add dword [esi + 0x2c], ecx
sub eax, ecx
mov dword [esi + 0x30], eax
test eax, eax
jle 0x10002cd8
lea edi, [esi + 0x28]
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov edx, dword [esi + 0x30]
mov eax, dword [esi + 0x2c]
push esi
lea ecx, [esi + 0x34]
push ecx
mov ecx, dword [esi + 0x1c]
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x10002cd8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0x10002cd8
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
lea edx, [esi + 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne case.default.0x10002bd4
push esi
call fcn.10009960
add esp, 4
pop edi
pop ebp
ret 8
test ebx, ebx
je 0x10002d00
cmp ebx, 0x80000005
jne 0x10002d34
mov eax, dword [esp + 0x10]
push edi
push ebp
mov ecx, esi
call fcn.10003830
test eax, eax
jne 0x10002d21
mov eax, esi
call fcn.100036b0
mov edi, eax
neg edi
sbb edi, edi
inc edi
jmp 0x10002d34
jle 0x10002d34
mov eax, dword [esi + 0x58]
xor edi, edi
cmp eax, 0xffffffff
je 0x10002d34
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [esi + 0x30]
or eax, edi
je 0x10002d45
lea ecx, [esi + 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
lea edx, [esi + 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne case.default.0x10002bd4
mov eax, esi
mov ecx, ebp
call fcn.10003b20
pop edi
pop ebp
ret 8