Function at 0x101cc89
Capabilities:
Check if file exists
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa7c
push ebx
push esi
mov esi, dword [sym.imp.SHLWAPI.dll_PathCombineW]
push edi
push 0x1001a4c
mov edi, 0x103e000
push edi
lea eax, [ebp - 0x66c]
push eax
call esi
push 0x1003ac0
push edi
lea eax, [ebp - 0x25c]
push eax
call esi
xor esi, esi
push esi
push 0x80
push 2
push esi
push 3
push 0x40000000
lea eax, [ebp - 0x25c]
push eax
call dword [sym.imp.SHLWAPI.dll_Ordinal_52]
cmp eax, 0xffffffff
mov dword [ebp - 8], eax
je 0x101d300
mov edi, 0x1003a9c
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push esi
mov ebx, eax
lea eax, [ebp - 0x18]
push eax
push ebx
push edi
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp ebx, dword [ebp - 0x18]
jne 0x101d300
lea eax, [ebp - 0x25c]
push eax
lea eax, [ebp - 4]
push eax
call fcn.01007bc3
cmp dword [ebp - 4], esi
je 0x101d300
mov eax, dword [0x103e87c]
mov ecx, dword [eax]
push 0x104
lea edx, [ebp - 0xa7c]
push edx
push eax
call dword [ecx + 0x10]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
lea edx, [ebp - 0xa7c]
push edx
push eax
call dword [ecx + 0x14]
mov eax, dword [0x103e87c]
mov ecx, dword [eax]
lea edx, [ebp - 0xc]
push edx
mov ebx, 0x10035f8
push ebx
push eax
call dword [ecx + 0x1c]
push 8
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
cmp eax, esi
pop ecx
je 0x101cd88
push dword [ebp - 0xc]
mov ecx, eax
call fcn.01007684
mov edi, eax
jmp 0x101cd8a
xor edi, edi
mov eax, dword [edi]
push 0x104
lea ecx, [ebp - 0xa7c]
push ecx
push edi
call dword [eax]
mov eax, dword [edi]
push edi
call dword [eax + 4]
push 1
mov ecx, edi
mov dword [ebp - 8], eax
call fcn.0101ad08
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
lea edx, [ebp - 0xc]
push edx
push ebx
push eax
call dword [ecx + 0x1c]
push 8
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
cmp eax, esi
pop ecx
je 0x101cdd5
push dword [ebp - 0xc]
mov ecx, eax
call fcn.01007684
mov edi, eax
jmp 0x101cdd7
xor edi, edi
mov eax, dword [edi]
lea ecx, [ebp - 0xa7c]
push ecx
push edi
call dword [eax + 8]
push dword [ebp - 8]
mov eax, dword [edi]
push edi
call dword [eax + 0xc]
xor ebx, ebx
inc ebx
push ebx
mov ecx, edi
call fcn.0101ad08
mov eax, dword [0x103e87c]
mov ecx, dword [eax]
lea edx, [ebp - 0x14]
push edx
mov edi, 0x1001aac
push edi
push eax
call dword [ecx + 4]
test eax, eax
jl 0x101ce62
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
lea edx, [ebp - 0x10]
push edx
push edi
push eax
call dword [ecx + 0x18]
push 0xc
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
cmp eax, esi
pop ecx
je 0x101ce39
push dword [ebp - 0x10]
mov ecx, eax
call fcn.01007c36
mov edi, eax
jmp 0x101ce3b
xor edi, edi
mov eax, dword [edi]
lea ecx, [ebp - 0x66c]
push ecx
push edi
call dword [eax + 0x84]
mov eax, dword [edi]
push ebx
push edi
call dword [eax + 0x70]
mov eax, dword [edi]
push esi
push esi
push edi
call dword [eax + 0x58]
push ebx
mov ecx, edi
call fcn.0101021e
mov eax, dword [0x103e87c]
mov ecx, dword [eax]
lea edx, [ebp - 0x14]
push edx
mov edi, 0x1001a1c
push edi
push eax
call dword [ecx + 4]
test eax, eax
jl 0x101cecc
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
lea edx, [ebp - 0x10]
push edx
push edi
push eax
call dword [ecx + 0x18]
push 0xc
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
cmp eax, esi
pop ecx
je 0x101cea3
push dword [ebp - 0x10]
mov ecx, eax
call fcn.01007c36
mov edi, eax
jmp 0x101cea5
xor edi, edi
mov eax, dword [edi]
lea ecx, [ebp - 0x66c]
push ecx
push edi
call dword [eax + 0x84]
mov eax, dword [edi]
push ebx
push edi
call dword [eax + 0x70]
mov eax, dword [edi]
push esi
push esi
push edi
call dword [eax + 0x58]
push ebx
mov ecx, edi
call fcn.0101021e
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x30]
mov ecx, dword [ebp - 4]
cmp ecx, esi
je 0x101cee2
push ebx
call fcn.0100b47d
push esi
lea eax, [ebp - 0x66c]
push eax
lea eax, [ebp - 0x25c]
push eax
call dword [sym.imp.SHLWAPI.dll_Ordinal_112]
test eax, eax
je 0x101d300
push 0x10037a8
push 0x103e000
lea eax, [ebp - 0x25c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
mov ebx, dword [sym.imp.SHLWAPI.dll_Ordinal_298]
lea eax, [ebp - 0x25c]
push eax
mov edi, 0x1001744
push edi
push 0x1003a80
push 0x1001a74
call ebx
lea eax, [ebp - 0x25c]
push eax
push edi
push 0x1003a68
push 0x1001a74
call ebx
lea eax, [ebp - 0x25c]
push eax
push esi
push esi
push esi
call ebx
mov edi, dword [sym.imp.SHLWAPI.dll_PathCombineW]
push 0x1001a94
push 0x103e000
lea eax, [ebp - 0x25c]
push eax
call edi
lea eax, [ebp - 0x25c]
push eax
push esi
push esi
push 0x1003a50
call ebx
lea eax, [ebp - 0x25c]
push eax
push esi
push esi
push 0x1003a30
call ebx
lea eax, [ebp - 0x25c]
push eax
push esi
push esi
push 0x1003a1c
call ebx
lea eax, [ebp - 0x25c]
push eax
push esi
push esi
push 0x1003a00
call ebx
lea eax, [ebp - 0x25c]
push eax
push esi
push esi
push 0x10039e0
call ebx
lea eax, [ebp - 0x25c]
push eax
push esi
push esi
push esi
call ebx
push 0x10039c8
push 0x103e000
lea eax, [ebp - 0x25c]
push eax
call edi
lea eax, [ebp - 0x25c]
push eax
push 0x1001740
push 0x10039b8
mov edi, 0x10039a0
push edi
call ebx
lea eax, [ebp - 0x25c]
push eax
push 0x1001740
push edi
push edi
call ebx
lea eax, [ebp - 0x25c]
push eax
push 0x1001740
push 0x10039b8
push 0x1003984
call ebx
lea eax, [ebp - 0x25c]
push eax
push esi
push esi
push esi
call ebx
push 0x1003754
push 0x103e000
lea eax, [ebp - 0x464]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x464]
push eax
push 0x10039c8
push 0x1003974
push 0x10018b0
call fcn.0102dc77
lea eax, [ebp - 0x464]
push eax
push 0x10016f0
push 0x1003960
mov edi, 0x1003648
push edi
call ebx
lea eax, [ebp - 0x464]
push eax
push esi
push 0x1003950
push edi
call ebx
lea eax, [ebp - 0x464]
push eax
push esi
push 0x1003940
push edi
call ebx
lea eax, [ebp - 0x464]
push eax
push esi
push 0x100392c
push edi
call ebx
lea eax, [ebp - 0x464]
push eax
push esi
push 0x1003918
push edi
call ebx
lea eax, [ebp - 0x464]
push eax
push esi
push 0x1003904
push edi
call ebx
lea eax, [ebp - 0x464]
push eax
push 0x10038dc
push 0x10038c4
push 0x1001a74
call fcn.0102dc77
lea eax, [ebp - 0x464]
push eax
push esi
push esi
push esi
call ebx
push 0x103e000
call dword [sym.imp.SHLWAPI.dll_Ordinal_137]
push 0xf
pop ecx
xor eax, eax
push 3
push esi
push esi
push esi
push esi
lea edi, [ebp - 0x54]
rep stosd dword es:[edi], eax
mov eax, dword [0x103d7c8]
push 0xfffffffffffffffe
push dword [0x1110f44]
mov dword [ebp - 0x54], 0x3c
mov dword [ebp - 0x50], 0x40
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], 0x10038b8
mov dword [ebp - 0x44], 0x100389c
mov dword [ebp - 0x40], 0x1003874
mov dword [ebp - 0x3c], 0x103e000
mov dword [ebp - 0x38], 6
call dword [sym.imp.USER32.dll_SetWindowPos]
sub esp, 0x3c
push 0xf
pop ecx
mov edi, esp
lea esi, [ebp - 0x54]
rep movsd dword es:[edi], dword [esi]
call fcn.0102c49a
mov edi, dword [sym.imp.SHLWAPI.dll_PathCombineW]
push 0x1003858
mov esi, 0x103e000
push esi
lea eax, [ebp - 0x25c]
push eax
call edi
push 0x1001aac
push esi
lea eax, [ebp - 0x66c]
push eax
call edi
lea eax, [ebp - 0x66c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x101d1af
lea eax, [ebp - 0x25c]
push eax
push 0
push 0x1003940
push 0x1003648
call ebx
push 0x1001a1c
push esi
lea eax, [ebp - 0x66c]
push eax
call edi
lea eax, [ebp - 0x66c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
xor edi, edi
test eax, eax
jne 0x101d1e5
lea eax, [ebp - 0x25c]
push eax
push edi
push 0x1003848
push 0x1003648
call ebx
cmp dword [0x103e424], edi
jne 0x101d1fd
cmp dword [0x11109ec], edi
jne 0x101d1fd
cmp dword [0x103e420], edi
jne 0x101d211
lea eax, [ebp - 0x25c]
push eax
push edi
push 0x1002638
push 0x1003828
call ebx
lea eax, [ebp - 0x25c]
push eax
push edi
push edi
push edi
call ebx
push 0xf
pop ecx
xor eax, eax
lea edi, [ebp - 0x54]
rep stosd dword es:[edi], eax
mov eax, dword [0x103d7c8]
push 3
mov dword [ebp - 0x4c], eax
xor eax, eax
push eax
push eax
push eax
push eax
push 0xfffffffffffffffe
push dword [0x1110f44]
mov dword [ebp - 0x54], 0x3c
mov dword [ebp - 0x50], 0x40
mov dword [ebp - 0x48], 0x10038b8
mov dword [ebp - 0x44], 0x100389c
mov dword [ebp - 0x40], 0x1003800
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x38], 6
call dword [sym.imp.USER32.dll_SetWindowPos]
sub esp, 0x3c
push 0xf
pop ecx
mov edi, esp
lea esi, [ebp - 0x54]
rep movsd dword es:[edi], dword [esi]
call fcn.0102c49a
push 0
push 0x108cc68
push 0x108fbb8
push 0x103d9e8
mov ebx, 0x103e000
push ebx
mov edi, 0x10037ec
push edi
call sub.IEAKENG.dll_SignFileW
push 0x10037d8
push 0x103ddf8
lea eax, [ebp - 0x874]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
call fcn.0102c70c
mov esi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
push eax
lea eax, [ebp - 0x874]
push eax
call esi
push 0x103c550
lea eax, [ebp - 0x874]
push eax
call esi
lea eax, [ebp - 0x874]
push eax
call fcn.0102eda3
push 0
lea eax, [ebp - 0x874]
push eax
push edi
push ebx
call fcn.0102c1fa
test eax, eax
je 0x101d304
xor eax, eax
jmp 0x101d30f
push dword [ebp + 8]
call fcn.01027eb9
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 4