Function at 0x100c0620
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1018f085
mov eax, dword fs:[0]
push eax
sub esp, 0xb88
mov eax, dword [0x101d8724]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0xb88], ecx
lea ecx, [ebp - 0x1e4]
call fcn.1009f100
mov dword [ebp - 4], 0
mov dword [ebp - 4], 1
mov eax, dword [ebp + 8]
xor ecx, ecx
cmp dword [eax + 0x10], 0
sete cl
movzx edx, cl
test edx, edx
je 0x100c0925
push 0
lea eax, [ebp - 0x4c]
push eax
call fcn.100e3f90
add esp, 8
mov dword [ebp - 0xb8c], eax
mov ecx, dword [ebp - 0xb8c]
mov dword [ebp - 0xb1c], ecx
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0xb1c]
call fcn.100b71d0
mov dword [ebp - 0xb20], eax
mov edx, dword [ebp - 0xb20]
push edx
lea ecx, [ebp - 0x2c]
call fcn.10083e30
mov byte [ebp - 4], 3
mov byte [ebp - 4], 4
mov byte [ebp - 0x204], 0
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x204]
call fcn.100c1af0
mov byte [ebp - 4], 5
mov byte [ebp - 4], 8
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x2c]
call fcn.10083eb0
mov byte [ebp - 4], 0xa
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x4c]
call fcn.10081a60
movzx ecx, byte [ebp - 0x204]
neg ecx
sbb ecx, ecx
and ecx, fcn.1011da80
je 0x100c07b1
push str..AHCL
lea ecx, [ebp - 0x68]
call fcn.1009f160
mov byte [ebp - 4], 0xb
mov byte [ebp - 4], 0xc
lea edx, [ebp - 0x68]
push edx
lea eax, [ebp - 0x200]
push eax
lea ecx, [ebp - 0x84]
push ecx
call fcn.100c21f0
add esp, 0xc
mov dword [ebp - 0xb90], eax
mov edx, dword [ebp - 0xb90]
mov dword [ebp - 0xb28], edx
mov byte [ebp - 4], 0xd
mov eax, dword [0x101a1a18]
push eax
push 0
mov ecx, dword [ebp - 0xb28]
push ecx
lea ecx, [ebp - 0x1e4]
call fcn.10085bd0
mov byte [ebp - 4], 0xe
mov byte [ebp - 4], 0xf
push 0
push 1
lea ecx, [ebp - 0x84]
call fcn.10085cf0
mov byte [ebp - 4], 0xc
mov byte [ebp - 4], 0x10
mov byte [ebp - 4], 0x11
push 0
push 1
lea ecx, [ebp - 0x68]
call fcn.10085cf0
mov byte [ebp - 4], 9
push str.AHCL
lea ecx, [ebp - 0xe4]
call fcn.100e1330
mov byte [ebp - 4], 0x12
lea edx, [ebp - 0x1e4]
push edx
lea ecx, [ebp - 0x144]
call fcn.10082270
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x124]
call fcn.100b6b40
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x104]
call fcn.100b6b90
mov byte [ebp - 4], 0x15
mov byte [ebp - 4], 0x16
lea eax, [ebp - 0xe4]
push eax
push 0x8806
push 0x101e57b0
lea ecx, [ebp - 0x144]
push ecx
push 0x104
push 0
lea edx, [ebp - 0x164]
push edx
call fcn.100e3ce0
add esp, 0x1c
mov dword [ebp - 0xb94], eax
mov eax, dword [ebp - 0xb94]
mov dword [ebp - 0xb2c], eax
mov byte [ebp - 4], 0x17
mov ecx, dword [ebp - 0xb2c]
push ecx
lea ecx, [ebp - 0x204]
call fcn.100c1e60
mov byte [ebp - 4], 0x18
mov byte [ebp - 4], 0x16
movzx edx, byte [ebp - 0x164]
test edx, edx
je 0x100c087f
lea ecx, [ebp - 0x164]
call fcn.100b71d0
mov ecx, eax
call fcn.10083eb0
mov byte [ebp - 0x164], 0
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x144]
call fcn.10063f10
mov byte [ebp - 4], 9
lea ecx, [ebp - 0xe4]
call fcn.10063f10
movzx eax, byte [ebp - 0x204]
neg eax
sbb eax, eax
add eax, 1
movzx ecx, al
test ecx, ecx
je 0x100c08f9
mov byte [ebp - 0xb15], 0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x204]
call fcn.100c19f0
mov dword [ebp - 4], 0x19
mov dword [ebp - 4], 0x1a
push 0
push 1
lea ecx, [ebp - 0x1e4]
call fcn.10085cf0
mov dword [ebp - 4], 0xffffffff
mov al, byte [ebp - 0xb15]
jmp 0x100c0ac1
mov edx, dword [0x101a1a18]
push edx
push 0
lea eax, [ebp - 0x200]
push eax
lea ecx, [ebp - 0x1e4]
call fcn.10085bd0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x204]
call fcn.100c19f0
jmp 0x100c093d
mov ecx, dword [0x101a1a18]
push ecx
push 0
mov edx, dword [ebp + 8]
push edx
lea ecx, [ebp - 0x1e4]
call fcn.10085bd0
lea eax, [ebp - 0x1e4]
push eax
lea ecx, [ebp - 0x1c4]
call fcn.100c0ae0
mov byte [ebp - 4], 0x1b
push 0
push 0x80
push 2
push 0
push 3
push 0x40000000
lea ecx, [ebp - 0x1c4]
push ecx
call fcn.100e2cc0
add esp, 0x1c
mov dword [ebp - 0x1c8], eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1c4]
call fcn.10063f10
cmp dword [ebp - 0x1c8], 0xffffffff
jne 0x100c09cd
mov byte [ebp - 0xb16], 0
mov dword [ebp - 4], 0x1c
mov dword [ebp - 4], 0x1d
push 0
push 1
lea ecx, [ebp - 0x1e4]
call fcn.10085cf0
mov dword [ebp - 4], 0xffffffff
mov al, byte [ebp - 0xb16]
jmp 0x100c0ac1
mov dword [ebp - 0x208], str.K7C0DB872A3F777C0
mov dword [ebp - 0x20c], 0x900
lea edx, [ebp - 0x20c]
push edx
lea eax, [ebp - 0xb14]
push eax
mov ecx, dword [ebp - 0x208]
push ecx
mov edx, dword [str.SoftwareLicenses]
push edx
mov eax, 0xe
shl eax, 2
mov ecx, dword [0x101db5fc]
mov edx, dword [0x101db5fc]
mov esi, dword [0x101db5fc]
mov esi, dword [esi + 0x6c]
xor esi, dword [edx + 0x64]
xor esi, dword [ecx + eax]
and esi, 8
neg esi
sbb esi, esi
add esi, 0x80000002
push esi
mov ecx, dword [ebp - 0xb88]
call fcn.100bd1f0
push 0
lea eax, [ebp - 0x210]
push eax
mov ecx, dword [ebp - 0x20c]
push ecx
lea edx, [ebp - 0xb14]
push edx
mov eax, dword [ebp - 0x1c8]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 0x1c8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 0xb17], 1
mov dword [ebp - 4], 0x1e
mov dword [ebp - 4], 0x1f
push 0
push 1
lea ecx, [ebp - 0x1e4]
call fcn.10085cf0
mov dword [ebp - 4], 0xffffffff
mov al, byte [ebp - 0xb17]
jmp 0x100c0ac1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1014c68a
mov esp, ebp
pop ebp
ret 4