Function at 0x1002efd0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x650
mov eax, dword [0x1005454c]
xor eax, esp
push ebx
mov dword [esp + 0x650], eax
mov eax, dword [esp + 0x658]
xor ebx, ebx
cmp eax, ebx
push esi
mov esi, dword [esp + 0x664]
jne 0x1002f004
mov eax, 0x10000
jmp 0x1002f2c2
cmp dword [eax], 1
je 0x1002f013
mov eax, 0x80000
jmp 0x1002f2c2
push ebp
push edi
mov edi, dword [eax + 4]
mov eax, dword [edi + 4]
or ebp, 0xffffffff
cmp eax, ebp
je 0x1002f02d
mov eax, dword [edi]
push eax
call fcn.1002c830
add esp, 4
mov eax, dword [edi]
mov dword [edi + 4], ebp
mov ebp, dword [esp + 0x668]
cmp ebp, dword [eax + 4]
jl 0x1002f048
mov eax, 0x10000
jmp 0x1002f2c0
cmp ebp, dword [eax + 0x10]
jge 0x1002f056
push eax
call fcn.1002c570
add esp, 4
mov ecx, dword [edi]
cmp dword [ecx + 0x10], ebp
jge 0x1002f074
lea ecx, [ecx]
mov edx, dword [edi]
push edx
call fcn.1002c5c0
mov eax, dword [edi]
mov ecx, dword [eax + 0x10]
add esp, 4
cmp ecx, ebp
jl 0x1002f060
lea ecx, [esp + 0x1c]
push ecx
push ebp
mov ecx, edi
call fcn.1002c9b0
test byte [esp + 0x228], 0x10
je 0x1002f0ce
mov ax, word [esi]
cmp ax, 0x2f
je 0x1002f0a6
cmp ax, 0x5c
je 0x1002f0a6
cmp ax, bx
je 0x1002f0b7
cmp word [esi + 2], 0x3a
jne 0x1002f0b7
push esi
push ebx
call fcn.1002cf00
add esp, 8
xor eax, eax
jmp 0x1002f2c0
push esi
add edi, 0x244
push edi
call fcn.1002cf00
add esp, 8
xor eax, eax
jmp 0x1002f2c0
xor eax, eax
mov ax, word [esi]
cmp ax, bx
mov ebp, esi
mov ecx, esi
je 0x1002f0fb
lea esp, [esp]
cmp ax, 0x2f
je 0x1002f0ec
cmp ax, 0x5c
jne 0x1002f0ef
lea ebp, [ecx + 2]
mov ax, word [ecx + 2]
add ecx, 2
cmp ax, bx
jne 0x1002f0e0
lea edx, [esp + 0x24c]
push esi
push edx
call fcn.100376f6
add esp, 8
cmp ebp, esi
jne 0x1002f17d
mov word [esp + 0x24c], bx
push ebp
lea ecx, [esp + 0x250]
push ecx
lea esi, [edi + 0x244]
push esi
lea edx, [esp + 0x460]
push str._s_s_s
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [esp + 0x260]
push eax
push esi
call fcn.1002cf00
add esp, 0x1c
mov ecx, dword [esp + 0x228]
push ebx
push ecx
push 2
push ebx
push ebx
push 0x40000000
lea edx, [esp + 0x46c]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x1002f1e9
mov eax, 0x200
jmp 0x1002f2c0
mov eax, ebp
sub eax, esi
sar eax, 1
mov word [esp + eax*2 + 0x24c], bx
mov ax, word [esp + 0x24c]
cmp ax, 0x2f
je 0x1002f1b7
cmp ax, 0x5c
je 0x1002f1b7
cmp ax, bx
je 0x1002f118
cmp word [esp + 0x24e], 0x3a
jne 0x1002f118
push ebp
lea ecx, [esp + 0x250]
push ecx
lea edx, [esp + 0x45c]
push str._s_s
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [esp + 0x25c]
push eax
push ebx
call fcn.1002cf00
add esp, 0x18
jmp 0x1002f14c
mov eax, dword [edi + 0x23c]
mov ecx, dword [edi]
push eax
push ecx
call fcn.1002e9a0
mov eax, dword [edi + 0x240]
add esp, 8
cmp eax, ebx
jne 0x1002f218
push 0x4000
call fcn.10035f28
add esp, 4
mov dword [edi + 0x240], eax
mov dword [esp + 0x14], ebx
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [edi + 0x240]
mov ecx, dword [edi]
lea edx, [esp + 0x13]
push edx
push 0x4000
push eax
push ecx
call fcn.1002eb30
mov esi, eax
add esp, 0x10
cmp esi, 0xffffff96
je 0x1002f277
test esi, esi
jl 0x1002f26d
jle 0x1002f261
mov eax, dword [edi + 0x240]
push 0
lea edx, [esp + 0x1c]
push edx
push esi
push eax
push ebp
call ebx
test eax, eax
je 0x1002f281
mov al, byte [esp + 0x13]
test al, al
jne 0x1002f28b
test esi, esi
jne 0x1002f222
mov dword [esp + 0x14], 0x5000000
jmp 0x1002f2aa
mov dword [esp + 0x14], 0x1000
jmp 0x1002f2aa
mov dword [esp + 0x14], 0x400
jmp 0x1002f2aa
lea ecx, [esp + 0x23c]
push ecx
lea edx, [esp + 0x230]
push edx
lea eax, [esp + 0x23c]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [edi]
push ecx
call fcn.1002c830
mov eax, dword [esp + 0x18]
add esp, 4
pop edi
pop ebp
mov ecx, dword [esp + 0x654]
pop esi
pop ebx
xor ecx, esp
mov dword [0x100555ac], eax
call fcn.1003609d
add esp, 0x650
ret