Function at 0x103cc5c
Capabilities:
Set file attributes
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x530
mov eax, dword [0x1099a38]
mov ecx, dword [ebp + 0xc]
and dword [ebp - 0x528], 0
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push edi
push eax
push 0x103
lea eax, [ebp - 0x20c]
push eax
mov dword [ebp - 0x52c], ecx
mov dword [ebp - 0x520], ebx
call fcn.0108c975
lea eax, [ebp - 0x20c]
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x103cca9
sub eax, ecx
cmp eax, 5
lea edi, [ebp + eax - 0x210]
jl 0x103cd04
push 4
push 0x100eef8
push edi
call dword [sym.imp.msvcrt.dll__strnicmp]
add esp, 0xc
test eax, eax
jne 0x103cd04
push 4
mov esi, 0x100fcec
push 0x1000
movsd dword es:[edi], dword [esi]
push 0x200000
push eax
movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
test edi, edi
mov dword [ebp - 0x524], edi
jne 0x103cd15
push 0x100fcc4
call fcn.010430af
pop ecx
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.0106bc50
leave
ret 0xc
mov esi, ebx
test ebx, ebx
mov ebx, dword [sym.imp.msvcrt.dll_strstr]
mov dword [ebp - 0x51c], edi
je 0x103ce50
mov eax, dword [ebp - 0x524]
add eax, 0x1ff000
cmp edi, eax
jae 0x103ce50
mov eax, dword [esi + 8]
test eax, eax
je 0x103ce45
push 0x100fcb4
push eax
call ebx
test eax, eax
pop ecx
pop ecx
je 0x103ce45
push 0x100fc98
push dword [esi + 8]
call ebx
test eax, eax
pop ecx
pop ecx
jne 0x103ce45
mov ecx, dword [esi + 8]
mov edi, esi
lea edx, [ebp - 0x108]
mov al, byte [ecx]
inc ecx
mov byte [edx], al
inc edx
test al, al
jne 0x103cd7a
lea eax, [ebp - 0x108]
push 0x100fcb4
push eax
call ebx
mov byte [eax], 0
lea eax, [ebp - 0x108]
push 0x100fc8c
push eax
call ebx
add esp, 0x10
test eax, eax
je 0x103ce02
lea eax, [ebp - 0x108]
push 0x5c
push eax
call dword [sym.imp.msvcrt.dll_strchr]
test eax, eax
pop ecx
pop ecx
je 0x103cdee
push 0x104
lea ecx, [ebp - 0x414]
push ecx
inc eax
push eax
push 0x10f54c0
call fcn.01070fc9
xor eax, eax
mov cl, byte [ebp + eax - 0x414]
mov byte [ebp + eax - 0x108], cl
inc eax
test cl, cl
jne 0x103cdd9
jmp 0x103ce02
xor eax, eax
mov cl, byte [eax + 0x10f54c0]
mov byte [ebp + eax - 0x108], cl
inc eax
test cl, cl
jne 0x103cdf0
mov eax, dword [ebp - 0x524]
add eax, 0x1ff000
cmp dword [ebp - 0x51c], eax
jae 0x103ce3f
push dword [edi + 0xc]
lea eax, [ebp - 0x108]
push eax
push 0x100fc7c
push dword [ebp - 0x51c]
call dword [sym.imp.msvcrt.dll_sprintf]
mov edi, dword [edi]
add dword [ebp - 0x51c], eax
add esp, 0x10
test edi, edi
jne 0x103ce02
mov edi, dword [ebp - 0x51c]
mov esi, dword [esi + 4]
test esi, esi
jne 0x103cd2b
mov esi, dword [ebp - 0x520]
test esi, esi
mov dword [ebp - 0x520], esi
je 0x103d015
jmp 0x103ce6c
mov esi, dword [ebp - 0x520]
mov eax, dword [ebp - 0x524]
add eax, 0x1ff000
cmp edi, eax
jae 0x103d015
mov eax, dword [esi + 8]
test eax, eax
je 0x103d004
push 0x100fcb4
push eax
call ebx
test eax, eax
pop ecx
pop ecx
jne 0x103d004
push 0x100fc98
push dword [esi + 8]
call ebx
test eax, eax
pop ecx
pop ecx
jne 0x103d004
mov ecx, dword [esi + 8]
mov edi, esi
lea edx, [ebp - 0x108]
mov al, byte [ecx]
inc ecx
mov byte [edx], al
inc edx
test al, al
jne 0x103cebb
lea eax, [ebp - 0x108]
push 0x100fc6c
push eax
call ebx
test eax, eax
pop ecx
pop ecx
je 0x103cffe
mov byte [eax], 0
lea eax, [ebp - 0x108]
push 0x100fc8c
push eax
call ebx
test eax, eax
pop ecx
pop ecx
je 0x103cf4c
lea eax, [ebp - 0x108]
push 0x5c
push eax
call dword [sym.imp.msvcrt.dll_strchr]
test eax, eax
pop ecx
pop ecx
je 0x103cf38
push 0x104
lea ecx, [ebp - 0x414]
push ecx
inc eax
push eax
push 0x10f54c0
call fcn.01070fc9
xor eax, eax
mov cl, byte [ebp + eax - 0x414]
mov byte [ebp + eax - 0x108], cl
inc eax
test cl, cl
jne 0x103cf23
jmp 0x103cf4c
xor eax, eax
mov cl, byte [eax + 0x10f54c0]
mov byte [ebp + eax - 0x108], cl
inc eax
test cl, cl
jne 0x103cf3a
mov eax, dword [ebp - 0x524]
add eax, 0x1ff000
cmp dword [ebp - 0x51c], eax
jae 0x103cffe
mov ecx, dword [edi + 0xc]
lea edx, [ebp - 0x310]
mov al, byte [ecx]
inc ecx
mov byte [edx], al
inc edx
test al, al
jne 0x103cf6c
lea eax, [ebp - 0x310]
push 0x2c
push eax
call dword [sym.imp.msvcrt.dll_strchr]
test eax, eax
pop ecx
pop ecx
je 0x103cfaa
lea ecx, [eax + 1]
lea esi, [ebp - 0x518]
sub esi, ecx
mov dl, byte [ecx]
mov byte [esi + ecx], dl
inc ecx
test dl, dl
jne 0x103cf96
mov esi, dword [ebp - 0x520]
mov byte [eax], dl
jmp 0x103cfbf
xor eax, eax
mov cl, byte [ebp + eax - 0x310]
mov byte [ebp + eax - 0x518], cl
inc eax
test cl, cl
jne 0x103cfac
lea eax, [ebp - 0x310]
push eax
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x518]
push eax
push dword [ebp - 0x52c]
push 0x100fc50
push dword [ebp - 0x51c]
call dword [sym.imp.msvcrt.dll_sprintf]
mov edi, dword [edi]
add dword [ebp - 0x51c], eax
add esp, 0x18
test edi, edi
jne 0x103cf4c
mov edi, dword [ebp - 0x51c]
mov eax, dword [esi + 4]
test eax, eax
mov dword [ebp - 0x520], eax
jne 0x103ce66
push dword [ebp - 0x52c]
lea eax, [ebp - 0x310]
push 0x100fc34
push 0x104
push eax
call fcn.01037486
lea eax, [ebp - 0x310]
push eax
lea eax, [ebp - 0x20c]
push eax
push 0x100fc20
push edi
call dword [sym.imp.msvcrt.dll_sprintf]
mov ebx, dword [ebp - 0x524]
add edi, eax
lea eax, [ebx + 0x1ff000]
add esp, 0x20
cmp edi, eax
jae 0x103d0eb
push 0x80
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0
push 0x80000080
push 2
push 0
push 1
push 0x40000000
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x103d0e1
push 0
lea eax, [ebp - 0x530]
push eax
sub edi, ebx
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x103d0c2
mov dword [ebp - 0x528], 1
xor ebx, ebx
jmp 0x103d0ca
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x20c]
push eax
push 0
call fcn.01034d42
jmp 0x103d0fc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x103d0fc
push 0x100fbe8
call fcn.010430af
mov ebx, dword [ebp - 0x530]
pop ecx
push ebx
call fcn.01037f35
mov eax, dword [ebp - 0x528]
jmp 0x103cd06