Function at 0x1003126
Capabilities:
Check if file exists
Get common file path
Get file attributes
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x100b020]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
xor eax, eax
xor edi, edi
push 0x206
mov word [ebp - 0x20c], ax
lea eax, reloc.NETAPI32.dll_DsGetDcNameW
push edi
push eax
mov ebx, ecx
mov dword [ebp - reloc.NETAPI32.dll_DsGetDcNameW], edi
mov dword [ebp - reloc.NETAPI32.dll_DsGetDcNameW], edi
call sub.msvcrt.dll_memset
add esp, 0xc
cmp dword [ebx + 0x14], edi
je 0x10033eb
push esi
lea eax, reloc.NETAPI32.dll_DsGetDcNameW
push eax
mov esi, 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x10031a6
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.01002565
mov dword [ebp - reloc.NETAPI32.dll_DsGetDcNameW], eax
test eax, eax
jl 0x10033ea
lea eax, reloc.NETAPI32.dll_DsGetDcNameW
cmp dword [ebx + 0x10], edi
je 0x10031b9
push dword [0x100b018]
jmp 0x10031bf
push dword [0x100b01c]
push esi
push eax
call fcn.01002844
cmp eax, edi
mov dword [ebp - reloc.NETAPI32.dll_DsGetDcNameW], eax
jl 0x10033ea
lea eax, reloc.NETAPI32.dll_DsGetDcNameW
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, reloc.NETAPI32.dll_DsGetDcNameW
setne cl
xor eax, eax
cmp ecx, edi
sete al
and dword [ebp - reloc.NETAPI32.dll_DsGetDcNameW], edi
add ebx, 0xc
mov dword [ebp - reloc.NETAPI32.dll_DsGetDcNameW], ecx
mov dword [ebp - reloc.NETAPI32.dll_DsGetDcNameW], ebx
mov esi, eax
mov eax, dword [ebx]
mov ecx, dword [ebp - reloc.NETAPI32.dll_DsGetDcNameW]
cmp ecx, dword [eax]
jge 0x100322f
push ecx
mov ecx, ebx
call fcn.010029e1
push dword [eax]
call dword [sym.imp.OLEAUT32.dll_VariantInit]
inc dword [ebp - reloc.NETAPI32.dll_DsGetDcNameW]
lea esi, [esi + eax + 2]
jmp 0x1003207
test esi, esi
jle 0x1003237
inc esi
inc esi
test esi, esi
je 0x1003268
xor ecx, ecx
push 2
pop edx
mov eax, esi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
mov edi, eax
neg eax
sbb eax, eax
and eax, 0x7ff8fff2
add eax, 0x8007000e
pop ecx
mov dword [ebp - reloc.NETAPI32.dll_DsGetDcNameW], eax
jmp 0x100326e
mov eax, dword [ebp - reloc.NETAPI32.dll_DsGetDcNameW]
test eax, eax
jl 0x10033ea
cmp esi, 4
jle 0x10033ea
test edi, edi
je 0x10033ea
xor ebx, ebx
cmp dword [ebp - reloc.NETAPI32.dll_DsGetDcNameW], ebx
jne 0x100329a
mov eax, 0xfeff
mov word [edi], ax
inc ebx
push 0xd
pop ecx
push 0xa
lea eax, [esi - 4]
mov word [edi + eax*2], cx
pop ecx
push 0xd
mov word [edi + esi*2 - 6], cx
pop ecx
mov word [edi + esi*2 - 4], cx
add esi, esi
and dword [ebp - reloc.NETAPI32.dll_DsGetDcNameW], 0
push 0xa
pop ecx
mov dword [ebp - reloc.NETAPI32.dll_DsGetDcNameW], eax
mov dword [ebp - reloc.NETAPI32.dll_DsGetDcNameW], esi
mov word [esi + edi - 2], cx
mov ecx, dword [ebp - reloc.NETAPI32.dll_DsGetDcNameW]
mov ecx, dword [ecx]
mov edx, dword [ebp - reloc.NETAPI32.dll_DsGetDcNameW]
cmp edx, dword [ecx]
jge 0x1003384
cmp ebx, eax
jge 0x1003384
mov ecx, dword [ebp - reloc.NETAPI32.dll_DsGetDcNameW]
and dword [ebp - reloc.NETAPI32.dll_DsGetDcNameW], 0
push edx
call fcn.010029e1
push dword [eax]
mov esi, dword [sym.imp.OLEAUT32.dll_VariantInit]
call esi
test eax, eax
jbe 0x100335d
cmp ebx, dword [ebp - reloc.NETAPI32.dll_DsGetDcNameW]
jge 0x100335d
push dword [ebp - 0x214]
mov ecx, dword [ebp - reloc.NETAPI32.dll_DsGetDcNameW]
call fcn.010029e1
mov eax, dword [eax]
mov ecx, dword [ebp - reloc.NETAPI32.dll_DsGetDcNameW]
mov ax, word [eax + ecx*2]
push dword [ebp - 0x214]
mov ecx, dword [ebp - reloc.NETAPI32.dll_DsGetDcNameW]
mov word [edi + ebx*2], ax
inc ebx
inc dword [ebp - reloc.NETAPI32.dll_DsGetDcNameW]
call fcn.010029e1
push dword [eax]
call esi
cmp dword [ebp - reloc.NETAPI32.dll_DsGetDcNameW], eax
jb 0x1003310
mov esi, dword [ebp - reloc.NETAPI32.dll_DsGetDcNameW]
push 0xd
pop eax
mov word [edi + ebx*2], ax
inc ebx
push 0xa
pop eax
mov word [edi + ebx*2], ax
mov eax, dword [ebp - reloc.NETAPI32.dll_DsGetDcNameW]
inc ebx
inc dword [ebp - reloc.NETAPI32.dll_DsGetDcNameW]
jmp 0x10032d1
push 0
push 0x80
push 4
push 0
push 1
push 0x40000000
lea eax, reloc.NETAPI32.dll_DsGetDcNameW
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, reloc.NETAPI32.dll_DsGetDcNameW
jne 0x10033bc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.01002565
mov dword [ebp - reloc.NETAPI32.dll_DsGetDcNameW], eax
xor eax, eax
cmp dword [ebp - reloc.NETAPI32.dll_DsGetDcNameW], eax
jl 0x10033ea
push 2
push eax
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, reloc.NETAPI32.dll_DsGetDcNameW
push eax
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
push edi
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
mov eax, dword [ebp - reloc.NETAPI32.dll_DsGetDcNameW]
pop ecx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.01005ace
leave
ret