Function at 0x101154d0
Capabilities:
Set file attributes
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1014
call fcn.101f99e0
mov eax, dword [0x102519c8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x1010], eax
mov ebx, ecx
mov dword [ebp - 0x1008], ebx
test edi, edi
je 0x101155bf
lea eax, [ebx + 8]
mov esi, edi
mov dword [ebp - 0x100c], eax
mov edx, 0x104
mov ecx, eax
sub esi, eax
lea esp, [esp]
lea eax, [edx + 0x7ffffefa]
test eax, eax
je 0x10115540
movzx eax, word [esi + ecx]
test ax, ax
je 0x10115540
mov word [ecx], ax
add ecx, 2
sub edx, 1
jne 0x10115520
jmp 0x10115544
test edx, edx
jne 0x10115547
sub ecx, 2
xor eax, eax
mov word [ecx], ax
call fcn.10003180
mov esi, dword [eax + 0x154]
test esi, esi
je 0x10115562
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0xe
call fcn.10003680
add esp, 4
push edi
test eax, eax
je 0x10115575
call eax
jmp 0x1011557b
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
test esi, esi
je 0x10115588
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp ebx, 0xffffffff
je 0x101155b9
test bl, 0x10
jne 0x101155b9
mov esi, dword [ebp - 0x100c]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push 0x80
push esi
mov dword [ebp - 0x1010], eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov ebx, dword [ebp - 0x1008]
jmp 0x101155c8
mov ebx, dword [ebp - 0x1008]
lea esi, [ebx + 8]
mov dword [ebp - 0x100c], esi
push 0
push 0x80
push 2
push 0
push 3
push 0x40000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x101155fd
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101f99c6
mov esp, ebp
pop ebp
ret 4
cmp dword [ebx + 4], 2
jne 0x10115625
push 0
lea eax, [ebp - 0x1014]
mov word [ebp - 0x1004], 0xfeff
push eax
push 2
lea eax, [ebp - 0x1004]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebx + 0x210]
mov ecx, dword [eax]
mov dword [ebx + 0x218], ecx
cmp ecx, eax
je 0x101157a3
jmp 0x10115640
cmp dword [ebx + 4], 2
mov esi, dword [ecx + 8]
jne 0x1011571f
lea eax, [ebp - 0x1004]
mov edx, 0x800
mov ecx, eax
sub esi, ecx
lea esp, [esp]
lea ecx, [edx + 0x7ffff7fe]
test ecx, ecx
je 0x10115680
movzx ecx, word [esi + eax]
test cx, cx
je 0x10115680
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x10115660
jmp 0x10115684
test edx, edx
jne 0x10115687
sub eax, 2
xor ecx, ecx
mov word [eax], cx
lea ecx, [ebp - 0x1004]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10115695
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 1]
mov byte [ebp + ecx*2 - 0x1004], 0xd
cmp eax, 0x1000
jae 0x101157db
mov byte [ebp + eax - 0x1004], 0
lea eax, [ecx*2 + 3]
mov byte [ebp + ecx*2 - 0x1002], 0xa
cmp eax, 0x1000
jae 0x101157db
mov byte [ebp + eax - 0x1004], 0
lea eax, [ecx*2 + 4]
cmp eax, 0x1000
jae 0x101157db
lea ecx, [ecx*2 + 5]
mov byte [ebp + eax - 0x1004], 0
cmp ecx, 0x1000
jae 0x101157db
mov byte [ebp + ecx - 0x1004], 0
jmp 0x1011576b
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10115724
push 0
push 0
push 0x1000
sub ecx, edx
lea eax, [ebp - 0x1004]
push eax
sar ecx, 1
push ecx
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov word [ebp + eax - 0x1004], 0xa0d
add eax, 2
cmp eax, 0x1000
jae 0x101157db
mov byte [ebp + eax - 0x1004], 0
push 0
lea ecx, [ebp - 0x1014]
push ecx
push eax
lea eax, [ebp - 0x1004]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebx + 0x218]
mov ecx, dword [eax]
mov dword [ebx + 0x218], ecx
cmp ecx, dword [ebx + 0x210]
jne 0x10115640
mov esi, dword [ebp - 0x100c]
push edi
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x1010]
test eax, eax
je 0x101157c3
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.101f99c6
mov esp, ebp
pop ebp
ret 4
call fcn.101c8260
int3