Function at 0x30031a61
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x5f0]
sub esp, 0x670
mov eax, dword [section..cdata]
mov dword [ebp + 0x5ec], eax
push ebx
xor ebx, ebx
xor eax, eax
push esi
push edi
mov edx, 0x81
mov word [ebp - 0x68], bx
mov ecx, edx
lea edi, [ebp - 0x66]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov ecx, 0x91
lea edi, [ebp + 0x1a0]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x80], ebx
lea edi, [ebp - 0x7c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov word [ebp + 0x3e4], bx
mov ecx, edx
lea edi, [ebp + 0x3e6]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov edi, dword [ebp + 0x600]
mov eax, dword [edi + 0x21c]
mov dword [ebp - 0x70], ebx
mov dword [ebp - 0x74], ebx
movzx eax, word [eax]
cmp eax, dword [edi + 4]
mov dword [ebp - 0x6c], ebx
jb 0x30031afd
call fcn.30022b36
test eax, eax
je 0x30031aef
push 0x300053f0
call fcn.30022bd0
cmp dword [edi + 4], ebx
je 0x30031d52
jmp 0x30031d4b
mov eax, dword [edi]
test al, 2
je 0x30031b2e
and eax, 0x10000000
push eax
call fcn.300332dc
test eax, eax
jne 0x30031b2e
call fcn.30022b36
test eax, eax
je 0x30031d52
push 0x300053bc
call fcn.30022bd0
jmp 0x30031d52
xor esi, esi
inc esi
push esi
lea eax, [ebp - 0x74]
push eax
push edi
call fcn.30030ada
test eax, eax
jne 0x30031b54
call fcn.30022b36
test eax, eax
je 0x30031d52
push 0x30005388
jmp 0x30031b24
push ebx
lea eax, [ebp - 0x7c]
push eax
push edi
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0x80], 0xc
call fcn.30030ada
test eax, eax
jne 0x30031b81
call fcn.30022b36
test eax, eax
je 0x30031d52
push 0x30005354
jmp 0x30031b24
cmp dword [0x300a1700], ebx
mov ebx, dword [ebp + 0x5f8]
jne 0x30031bc5
call fcn.30027b21
test eax, eax
je 0x30031bc5
cmp dword [0x3009b840], 2
jne 0x30031bc2
mov eax, dword [ebp + 0x5fc]
mov eax, dword [eax + 0x113c]
test eax, eax
je 0x30031bbb
cmp word [eax], 0
je 0x30031bbb
mov eax, esi
jmp 0x30031bbd
xor eax, eax
mov dword [ebx + 0x28], eax
jmp 0x30031bc5
mov dword [ebx + 0x28], esi
mov eax, dword [ebp + 0x5fc]
mov dword [ebx + 0x14], esi
mov ecx, dword [eax + 0x1140]
mov dword [ebx + 0x30], ecx
push dword [eax + 0x113c]
push 0
push 0
push ebx
call fcn.3002a6f8
test eax, eax
jne 0x30031c02
call fcn.30022b36
test eax, eax
je 0x30031d52
push 0x30005318
jmp 0x30031b24
push dword [ebp - 0x74]
push edi
call fcn.30030b9f
test eax, eax
je 0x30031d52
lea ecx, [ebp - 0x80]
push ecx
push 0x100002
mov esi, 0x104
push esi
lea ecx, [ebp - 0x68]
push ecx
push 0x30003e84
lea eax, [edi + 0xc]
push eax
lea eax, [ebp - 0x70]
push eax
call fcn.30022154
test eax, eax
jne 0x30031c53
call fcn.30022b36
test eax, eax
je 0x30031d52
push 0x300052e0
jmp 0x30031b24
push 0
lea eax, [ebp + 0x600]
push eax
push dword [ebx + 0x1c]
push dword [ebx + 0x20]
push dword [ebp - 0x70]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x30031c86
call fcn.30022b36
test eax, eax
je 0x30031d52
push 0x300052b4
jmp 0x30031b24
push esi
lea eax, [ebp + 0x1a0]
push eax
lea eax, [ebp - 0x68]
push eax
call fcn.30030014
push edi
call fcn.3002ef72
test eax, eax
je 0x30031d52
lea eax, [ebp - 0x80]
push eax
push ebx
push dword [ebp + 0x5fc]
lea eax, [ebp + 0x1a0]
push eax
call fcn.3002f52d
test eax, eax
jne 0x30031cd7
call fcn.30022b36
test eax, eax
je 0x30031d52
push 0x30005278
jmp 0x30031b24
push esi
lea eax, [ebp + 0x3e4]
push eax
lea eax, [edi + 0xc]
push eax
call fcn.3004f088
push esi
lea eax, [ebp + 0x3e4]
push eax
push 0x30002eb8
call fcn.3004f0ca
push esi
lea eax, [ebp + 0x3e4]
push eax
push 0x30005498
call fcn.3004f0ca
lea eax, [ebp - 0x80]
push eax
push 0x100002
lea eax, [ebp + 0x3e4]
push eax
call fcn.30030c5c
test eax, eax
jne 0x30031d38
call fcn.30022b36
test eax, eax
je 0x30031d52
push 0x30005244
jmp 0x30031b24
call fcn.30022b36
test eax, eax
je 0x30031d4b
push 0x30005220
call fcn.30022bd0
mov dword [ebp - 0x6c], 1
push dword [edi + 0x214]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor esi, esi
cmp dword [ebp - 0x70], esi
je 0x30031d6e
push dword [ebp - 0x70]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x6c], esi
je 0x30031d8f
test byte [edi + 3], 0x10
jne 0x30031d82
call fcn.3002f14c
test eax, eax
je 0x30031d8f
mov eax, dword [edi]
or eax, 0x30000
push eax
call fcn.300319d2
push dword [ebp - 0x7c]
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp - 0x6c], esi
pop edi
pop esi
pop ebx
jne 0x30031db5
lea eax, [ebp - 0x68]
push eax
call fcn.300220d1
lea eax, [ebp + 0x1a0]
push eax
call fcn.300220d1
mov ecx, dword [ebp + 0x5ec]
mov eax, dword [ebp - 0x6c]
call fcn.30062195
add ebp, 0x5f0
leave
ret 0xc