Function at 0x1002dd20
Capabilities:
Create directory
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1009b488
mov eax, dword fs:[0]
push eax
mov eax, 0x1af4
call fcn.10099130
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x1af4], edi
mov dword [ebp - 0x1670], 0
mov eax, dword [edi + 8]
cmp eax, dword [edi + 0xc]
je 0x1002e569
xorps xmm0, xmm0
lea eax, [ebp - 0x1678]
movdqu xmmword [ebp - 0x1680], xmm0
mov dword [ebp - 0x167c], eax
mov dword [ebp - 0x1680], 0
push 0x104
lea eax, [ebp - 0x834]
mov dword [ebp - 4], 0
push eax
push str._UserData
call sym.HncFoundation.dll_HncPathToAbsolute
cmp dword [ebp + 8], 0
lea eax, [ebp - 0x834]
push eax
lea eax, [ebp - 0x21c]
je 0x1002ddf9
push str._sERS
push eax
call fcn.10028380
mov esi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea eax, [ebp - 0x21c]
add esp, 0xc
push 0
push eax
call esi
lea eax, [ebp - 0x834]
push eax
lea eax, [ebp - 0x21c]
push str._sERSLog
push eax
call fcn.10028380
jmp 0x1002de0a
push str._sUFB
push eax
call fcn.10028380
mov esi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
add esp, 0xc
lea eax, [ebp - 0x21c]
push 0
push eax
call esi
push 0x430
lea eax, [ebp - 0x1ae4]
push 0
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
xor eax, eax
cmp dword [eax*8 + 0x100f67e0], 8
je 0x1002de44
inc eax
cmp eax, 0x20
jl 0x1002de30
xor eax, eax
jmp 0x1002de4b
mov eax, dword [eax*8 + 0x100f67e4]
push 0
push SysReAllocString
push eax
lea ecx, [ebp - 0x1ae4]
call sym.HncFoundation.dll_public:_void___thiscall_CHncRegistry::constructor_unsigned_short_int_const___struct_HKEY_____int_
xor eax, eax
mov byte [ebp - 4], 1
push 0x206
push eax
mov word [ebp - 0x62c], ax
lea eax, [ebp - 0x62a]
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
lea eax, [ebp - 0x62c]
lea ecx, [ebp - 0x1ae4]
push 0x104
push eax
push str.UserGUID
push 0
call sym.HncFoundation.dll_public:_int___thiscall_CHncRegistry::GetStringValue_unsigned_short_int_const___unsigned_short_int_const___unsigned_short_int___int_
lea eax, [ebp - 0x168c]
push eax
call dword [sym.imp.MSVCR120.dll__time64]
add esp, 4
lea eax, [ebp - 0x168c]
push eax
lea eax, [ebp - 0x16b0]
push eax
call dword [sym.imp.MSVCR120.dll__localtime64_s]
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x424], ax
lea eax, [ebp - 0x422]
push eax
call sub.MSVCR120.dll_memset
mov eax, dword [ebp - 0x16a0]
add esp, 0x14
inc eax
push dword [ebp - 0x16b0]
push dword [ebp - 0x16ac]
push dword [ebp - 0x16a8]
push dword [ebp - 0x16a4]
push eax
mov eax, dword [ebp - 0x169c]
add eax, 0x76c
push eax
lea eax, [ebp - 0x424]
push str._04d_02d_02d__02d_02d_02d
push eax
call fcn.10028380
mov eax, dword [0x100f5084]
lea ecx, [ebp - 0x1aec]
add esp, 0x20
mov dword [ebp - 0x1aec], eax
push str.ErrorReportQAMode
call sym.HncFoundation.dll_public:_int___thiscall_CHncStringW::Assign_unsigned_short_int_const__
mov byte [ebp - 4], 2
mov dword [ebp - 0x1670], 1
call sym.HncFoundation.dll_class_Hnc::Framework____cdecl_Hnc::GetFramework_void_
lea ecx, [ebp - 0x1aec]
push ecx
mov ecx, eax
mov edx, dword [eax]
mov eax, dword [edx + 0x140]
call eax
test eax, eax
je 0x1002df72
cmp dword [ebp + 8], 0
mov byte [ebp - 0x1aed], 1
jne 0x1002df79
mov byte [ebp - 0x1aed], 0
mov dword [ebp - 4], 1
mov ecx, dword [ebp - 0x1aec]
add ecx, 0xfffffff4
cmp dword [ecx], 0xfffffffe
je 0x1002dfad
or eax, 0xffffffff
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x1002dfad
mov eax, dword [ebp - 0x1aec]
add eax, 0xfffffff4
push eax
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete___void__]
add esp, 4
cmp byte [ebp - 0x1aed], 0
je 0x1002dfdd
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x21c]
push eax
push 0x100c1db8
push eax
call fcn.10028380
add esp, 0x10
lea eax, [ebp - 0x21c]
push 0
push eax
call esi
push 0x104
lea eax, [ebp - 0x1054]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x104
lea eax, [ebp - 0x166c]
push eax
push 0x104
lea eax, [ebp - 0xe4c]
push eax
push 0x104
lea eax, [ebp - 0x1464]
push eax
push 0x104
lea eax, [ebp - 0x125c]
push eax
lea eax, [ebp - 0x1054]
push eax
call dword [sym.imp.MSVCR120.dll__wsplitpath_s]
add esp, 0x24
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x62c]
push eax
push 0x100c1d64
lea eax, [ebp - 0xe4c]
push eax
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0xc44]
push str._s_s_s__s__s.ufb2
push eax
call fcn.10028380
add esp, 0x1c
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x62c]
push eax
push 0x100c1d64
lea eax, [ebp - 0xe4c]
push eax
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0xa3c]
push str._s_s_s__s__s.txt
push eax
call fcn.10028380
lea esi, [ebp - 0x21c]
add esp, 0x1c
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x1002e0a4
sub esi, ecx
sar esi, 1
cmp word [ebp - 0x21c], ax
jne 0x1002e0c6
mov eax, 0x100c0632
jmp 0x1002e182
lea ecx, [esi*4 + 4]
lea eax, [ecx + 8]
cmp eax, ecx
jbe 0x1002e129
lea eax, [esi*4 + 0xc]
cmp eax, 0x400
ja 0x1002e0fe
call fcn.100990e0
mov eax, esp
mov dword [ebp - 0x1aec], eax
test eax, eax
je 0x1002e131
mov dword [eax], 0xcccc
add eax, 8
jmp 0x1002e12b
xor eax, eax
add ecx, 8
setb al
neg eax
or eax, ecx
push eax
call dword [sym.imp.MSVCR120.dll_malloc]
add esp, 4
mov dword [ebp - 0x1aec], eax
test eax, eax
je 0x1002e131
mov dword [eax], 0xdddd
add eax, 8
jmp 0x1002e12b
xor eax, eax
mov dword [ebp - 0x1aec], eax
push eax
lea ecx, [ebp - 0x1680]
call fcn.10010950
lea eax, [esi*4 + 4]
xor ecx, ecx
cmp eax, 1
jle 0x1002e178
mov dword [ebp - 0x1670], ecx
xor edx, edx
lea ecx, [ebp - 0x1670]
push ecx
push 0
push eax
push dword [ebp - 0x1aec]
lea eax, [ebp - 0x21c]
xor ecx, ecx
push 0xffffffffffffffff
push eax
call fcn.10035400
add esp, 0x18
mov ecx, eax
mov eax, dword [ebp - 0x1aec]
mov byte [ecx + eax], 0
push esi
push dword [edi + 0x14]
push 0xffffffffffffffff
push eax
push 2
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp dword [0x100fd950], 0
mov dword [ebp - 0x1ae8], 0
je 0x1002e29d
cmp word [ebp - 0xa3c], 0
jne 0x1002e1be
mov esi, 0x100c0632
jmp 0x1002e274
lea esi, [ebp - 0xa3c]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x1002e1c7
sub esi, ecx
sar esi, 1
lea ecx, [esi*4 + 4]
lea eax, [ecx + 8]
cmp eax, ecx
jbe 0x1002e239
lea eax, [esi*4 + 0xc]
cmp eax, 0x400
ja 0x1002e20e
call fcn.100990e0
mov eax, esp
mov dword [ebp - 0x1aec], eax
test eax, eax
je 0x1002e241
mov dword [eax], 0xcccc
add eax, 8
jmp 0x1002e23b
xor eax, eax
add ecx, 8
setb al
neg eax
or eax, ecx
push eax
call dword [sym.imp.MSVCR120.dll_malloc]
add esp, 4
mov dword [ebp - 0x1aec], eax
test eax, eax
je 0x1002e241
mov dword [eax], 0xdddd
add eax, 8
jmp 0x1002e23b
xor eax, eax
mov dword [ebp - 0x1aec], eax
push eax
lea ecx, [ebp - 0x1680]
call fcn.10010950
push 0
lea eax, [esi*4 + 4]
mov esi, dword [ebp - 0x1aec]
push eax
push esi
push 0xffffffffffffffff
lea eax, [ebp - 0xa3c]
push eax
push 0
push 0
call sym.HncFoundation.dll_HncUnicodeToAnsi
test esi, esi
je 0x1002e290
push 0x100c1e08
push esi
push 0x100fd94c
call dword [sym.imp.MSVCR120.dll_fopen_s]
add esp, 0xc
test eax, eax
jne 0x1002e525
cmp dword [0x100fd94c], 0
je 0x1002e525
cmp word [ebp - 0xc44], 0
jne 0x1002e2b1
mov esi, 0x100c0632
jmp 0x1002e36d
lea esi, [ebp - 0xc44]
lea ecx, [esi + 2]
lea ebx, [ebx]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x1002e2c0
sub esi, ecx
sar esi, 1
lea ecx, [esi*4 + 4]
lea eax, [ecx + 8]
cmp eax, ecx
jbe 0x1002e332
lea eax, [esi*4 + 0xc]
cmp eax, 0x400
ja 0x1002e307
call fcn.100990e0
mov eax, esp
mov dword [ebp - 0x1aec], eax
test eax, eax
je 0x1002e33a
mov dword [eax], 0xcccc
add eax, 8
jmp 0x1002e334
xor eax, eax
add ecx, 8
setb al
neg eax
or eax, ecx
push eax
call dword [sym.imp.MSVCR120.dll_malloc]
add esp, 4
mov dword [ebp - 0x1aec], eax
test eax, eax
je 0x1002e33a
mov dword [eax], 0xdddd
add eax, 8
jmp 0x1002e334
xor eax, eax
mov dword [ebp - 0x1aec], eax
push eax
lea ecx, [ebp - 0x1680]
call fcn.10010950
push 0
lea eax, [esi*4 + 4]
mov esi, dword [ebp - 0x1aec]
push eax
push esi
push 0xffffffffffffffff
lea eax, [ebp - 0xc44]
push eax
push 0
push 0
call sym.HncFoundation.dll_HncUnicodeToAnsi
test esi, esi
je 0x1002e38b
push 0x100c1dc4
lea eax, [ebp - 0x1ae8]
push esi
push eax
call dword [sym.imp.MSVCR120.dll_fopen_s]
add esp, 0xc
test eax, eax
jne 0x1002e525
cmp dword [ebp - 0x1ae8], 0
je 0x1002e525
mov esi, dword [edi + 8]
mov dword [ebp - 0x1aec], esi
cmp esi, dword [edi + 0xc]
je 0x1002e4f9
lea ebx, [ebx]
cmp dword [0x100fd950], 0
mov edi, dword [esi]
mov dword [ebp - 0x1af8], edi
je 0x1002e474
movzx eax, byte [edi]
cmp eax, 0x10
ja case.default.0x1002e3d1
jmp dword [eax*4 + 0x1002e58c]
push str.TYPE_:_UFB_SYSINFO_RPOC_n
jmp 0x1002e44d
push str.TYPE_:_UFB_ACTION_PROC_n
jmp 0x1002e44d
push str.TYPE_:_UFB_FONT_PROC_n
jmp 0x1002e44d
push str.TYPE_:_UFB_COLOR_PROC_n
jmp 0x1002e44d
push str.TYPE_:_UFB_DOCFIL_PROC_n
jmp 0x1002e44d
push str.TYPE_:_UFB_IMGFIL_PROC_n
jmp 0x1002e44d
push str.TYPE_:_UFB_TMP_PROC_n
jmp 0x1002e44d
push str.TYPE_:_UFB_HELP_PROC_n
jmp 0x1002e44d
push str.TYPE_:_UFB_HNC_COLOR_PROC_n
jmp 0x1002e44d
push str.TYPE_:_UFB_IMAGE_GROUP_PROC_n
jmp 0x1002e44d
push str.TYPE_:_UFB_BUTTON_EXCUTE_PROC_n
jmp 0x1002e44d
push str.TYPE_:_UFB_WORKSPACE_PROC_n
jmp 0x1002e44d
push str.TYPE_:_UFB_TOOLBAR_PROC_n
jmp 0x1002e44d
push str.TYPE_:_UFB_THEME_PROC_n
jmp 0x1002e44d
push str.TYPE_:_UFB_TOOLBOX_PROC_n
jmp 0x1002e44d
push str.TYPE_:_UFB_DEADACTION_PROC_n
jmp 0x1002e44d
push str.TYPE_:_UFB_PRINT_PROC_n
push dword [0x100fd94c]
mov eax, dword [sym.imp.MSVCR120.dll_fprintf]
call eax
add esp, 8
push dword [edi + 4]
push str.Data_Count_:__d_n
push dword [0x100fd94c]
call dword [sym.imp.MSVCR120.dll_fprintf]
add esp, 0xc
push dword [ebp - 0x1ae8]
push 1
push 1
push edi
call dword [sym.imp.MSVCR120.dll_fwrite]
push dword [ebp - 0x1ae8]
add edi, 4
push 1
push 4
push edi
mov dword [ebp - 0x1afc], edi
call dword [sym.imp.MSVCR120.dll_fwrite]
add esp, 0x20
cmp dword [edi], 0
jbe 0x1002e4e1
xor edi, edi
mov esi, edi
jmp 0x1002e4b0
mov eax, dword [ebp - 0x1af8]
mov ecx, dword [ebp - 0x1af4]
mov eax, dword [eax + 8]
add eax, edi
push eax
push dword [ebp - 0x1ae8]
call fcn.1002e5d0
mov eax, dword [ebp - 0x1afc]
inc esi
add edi, 0x18
cmp esi, dword [eax]
jb 0x1002e4b0
mov esi, dword [ebp - 0x1aec]
mov edi, dword [ebp - 0x1af4]
add esi, 4
mov dword [ebp - 0x1aec], esi
cmp esi, dword [edi + 0xc]
jne 0x1002e3b0
cmp dword [0x100fd950], 0
mov esi, dword [sym.imp.MSVCR120.dll_fclose]
je 0x1002e513
push dword [0x100fd94c]
call esi
add esp, 4
push dword [ebp - 0x1ae8]
call esi
add esp, 4
mov ecx, edi
call fcn.1002ea10
mov eax, dword [ebp - 0x1adc]
mov dword [ebp - method.CHncRegistry.virtual_0], vtable.CHncRegistry.0
test eax, eax
je 0x1002e540
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x16c0]
test eax, eax
je 0x1002e55e
push eax
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete___void__]
add esp, 4
mov dword [ebp - 0x16c0], 0
lea ecx, [ebp - 0x1680]
call fcn.10010900
lea esp, [ebp - 0x1b0c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.100944ae
mov esp, ebp
pop ebp
ret 4