Function at 0x100088bb
Capabilities:
Create directory
Get common file path
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x198]
sub esp, 0x218
mov eax, dword [0x1007ef24]
xor eax, ebp
mov dword [ebp + 0x194], eax
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push ebx
mov dword [ebp - 0x78], esi
call fcn.10043e25
mov dword [esi + 0x50a4], eax
mov dword [esp], 0x1ff
lea eax, [ebp - 0x6b]
push ebx
push eax
mov byte [esi + 0x216], bl
mov byte [ebp - 0x6c], bl
call fcn.10042a90
add esp, 0xc
push ebx
push 0x25
lea eax, [ebp - 0x6c]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
cmp byte [ebp - 0x6c], bl
jne 0x10008922
xor al, al
jmp 0x10008f31
push edi
lea edi, [ebp - 0x6c]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x10008927
mov esi, str.hardpolMyIEData_
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push ebx
lea eax, [ebp - 0x6c]
push eax
movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea edi, [ebp - 0x6c]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x1000894a
mov esi, str.SysDat.bin
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov esi, 0x800000
push esi
call fcn.1001e0bd
push esi
mov ebx, eax
push 0
push ebx
call fcn.10042a90
mov eax, dword [ebp - 0x78]
mov ecx, dword [eax + 8]
mov dword [ebx], ecx
mov ecx, dword [eax + 0xc]
add esp, 0x10
mov dword [ebp - 0x80], ebx
push 4
pop esi
add ebx, esi
mov dword [ebx], ecx
mov ecx, dword [eax + 0x10]
add ebx, esi
mov dword [ebx], ecx
mov cl, byte [eax + 0x14]
add ebx, esi
mov byte [ebx], cl
mov cl, byte [eax + 0x15]
inc ebx
mov byte [ebx], cl
mov cl, byte [eax + 0x230]
inc ebx
mov byte [ebx], cl
mov ecx, dword [eax + 0x834]
inc ebx
mov dword [ebx], ecx
add ebx, esi
push 0x40
mov edi, ebx
pop ecx
lea esi, [eax + 0x838]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [eax + 0xa38]
mov edx, pe_nt_image_headers32
add ebx, edx
mov dword [ebx], ecx
add ebx, 4
push 0x40
mov edi, ebx
pop ecx
lea esi, [eax + 0xa3c]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [eax + 0xb3c]
add ebx, edx
mov dword [ebx], ecx
add ebx, 4
push 8
lea esi, [eax + 0xba4]
mov edi, ebx
pop ecx
rep movsd dword es:[edi], dword [esi]
mov eax, dword [eax + 0xba0]
add ebx, 0x20
test eax, eax
jne 0x10008a09
xor esi, esi
jmp 0x10008a17
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10008a0c
sub eax, edx
mov esi, eax
mov edi, dword [ebp - 0x78]
mov dword [ebx], esi
push esi
push dword [edi + 0xba0]
add ebx, 4
push ebx
call fcn.10043ac0
mov eax, dword [ebp - 0x78]
add esp, 0xc
add ebx, esi
lea esi, [edi + 0xbc8]
push 8
mov edi, ebx
pop ecx
rep movsd dword es:[edi], dword [esi]
mov eax, dword [eax + 0xbc4]
add ebx, 0x20
test eax, eax
jne 0x10008a53
and dword [ebp - 0x70], eax
jmp 0x10008a62
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10008a56
sub eax, edx
mov dword [ebp - 0x70], eax
mov eax, dword [ebp - 0x70]
mov esi, dword [ebp - 0x78]
push 4
pop edi
push eax
mov dword [ebx], eax
push dword [esi + 0xbc4]
add ebx, edi
push ebx
call fcn.10043ac0
add ebx, dword [ebp - 0x70]
mov eax, dword [esi + 0xb94]
mov dword [ebx], eax
mov eax, dword [esi + 0xb84]
add ebx, edi
mov dword [ebx], eax
mov eax, dword [esi + 0xb7c]
add ebx, edi
mov dword [ebx], eax
mov eax, dword [esi + 0xb70]
add ebx, edi
mov dword [ebx], eax
mov eax, dword [esi + 0xb68]
add ebx, edi
mov dword [ebx], eax
mov eax, dword [esi + 0xb9c]
add ebx, edi
mov dword [ebx], eax
mov eax, dword [esi + 0xb78]
add ebx, edi
mov dword [ebx], eax
mov eax, dword [esi + 0xb74]
add ebx, edi
mov dword [ebx], eax
mov eax, dword [esi + 0xb80]
add ebx, edi
mov dword [ebx], eax
mov eax, dword [esi + 0xb90]
add ebx, edi
mov dword [ebx], eax
mov eax, dword [esi + 0xb98]
add ebx, edi
mov dword [ebx], eax
mov eax, dword [esi + 0xb88]
add ebx, edi
mov dword [ebx], eax
mov eax, dword [esi + 0xb8c]
add ebx, edi
mov dword [ebx], eax
mov eax, dword [esi + 0xb6c]
add ebx, edi
mov dword [ebx], eax
mov eax, dword [ebp - 0x78]
add esp, 0xc
add ebx, edi
push 8
add esi, 0xb40
mov edi, ebx
pop ecx
rep movsd dword es:[edi], dword [esi]
mov eax, dword [eax + 0xb60]
add ebx, 0x20
test eax, eax
jne 0x10008b2f
xor esi, esi
jmp 0x10008b3d
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10008b32
sub eax, edx
mov esi, eax
mov edi, dword [ebp - 0x78]
mov dword [ebx], esi
push esi
push dword [edi + 0xb60]
add ebx, 4
push ebx
call fcn.10043ac0
mov edi, dword [edi + 0xb64]
add esp, 0xc
add ebx, esi
test edi, edi
jne 0x10008b65
xor esi, esi
jmp 0x10008b73
mov esi, edi
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x10008b6a
sub esi, ecx
mov edi, dword [ebp - 0x78]
mov dword [ebx], esi
push esi
push dword [edi + 0xb64]
add ebx, 4
push ebx
call fcn.10043ac0
mov eax, dword [ebp - 0x78]
and dword [ebp - 0x74], 0
add esp, 0xc
add ebx, esi
push 8
lea esi, [edi + 0x50ac]
pop ecx
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [eax + 0x50cc]
add ebx, 0x20
mov dword [ebx], ecx
add ebx, 4
cmp dword [eax + 0x50cc], 0
push 4
pop edi
jle 0x10008c82
and dword [ebp - 0x7c], 0
mov eax, dword [ebp - 0x78]
mov esi, dword [eax + 0x50d0]
add esi, dword [ebp - 0x7c]
mov eax, dword [esi + 0xc]
mov dword [ebx], eax
mov eax, dword [esi + 0x18]
add ebx, edi
mov dword [ebx], eax
mov eax, dword [esi + 0x1c]
add ebx, edi
mov dword [ebx], eax
mov eax, dword [esi + 0x14]
add ebx, edi
mov dword [ebx], eax
mov eax, dword [esi + 0x10]
add ebx, edi
mov dword [ebx], eax
mov eax, dword [esi + 8]
add ebx, edi
mov dword [ebx], eax
mov eax, dword [esi + 0x20]
add ebx, edi
mov dword [ebx], eax
mov eax, dword [esi + 0x20]
add ebx, edi
mov dword [ebx], eax
mov eax, dword [esi + 4]
add ebx, edi
test eax, eax
jne 0x10008c13
and dword [ebp - 0x70], eax
jmp 0x10008c22
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10008c16
sub eax, edx
mov dword [ebp - 0x70], eax
mov eax, dword [ebp - 0x70]
push eax
mov dword [ebx], eax
push dword [esi + 4]
add ebx, edi
push ebx
call fcn.10043ac0
mov eax, dword [esi]
add ebx, dword [ebp - 0x70]
add esp, 0xc
test eax, eax
jne 0x10008c44
and dword [ebp - 0x70], eax
jmp 0x10008c53
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10008c47
sub eax, edx
mov dword [ebp - 0x70], eax
mov eax, dword [ebp - 0x70]
push eax
mov dword [ebx], eax
push dword [esi]
add ebx, edi
push ebx
call fcn.10043ac0
add ebx, dword [ebp - 0x70]
mov eax, dword [ebp - 0x78]
add dword [ebp - 0x7c], 0x28
add esp, 0xc
inc dword [ebp - 0x74]
mov ecx, dword [ebp - 0x74]
cmp ecx, dword [eax + 0x50cc]
jl 0x10008bc3
mov ecx, dword [ebp - 0x78]
add ecx, 0x6eec
call fcn.100079c3
and dword [ebp - 0x74], 0
mov dword [ebx], eax
add ebx, edi
test eax, eax
mov dword [ebp - 0x7c], eax
jbe 0x10008d60
mov ecx, dword [ebp - 0x78]
push dword [ebp - 0x74]
add ecx, 0x6eec
call fcn.100079d6
mov esi, dword [eax]
mov eax, dword [esi]
test eax, eax
jne 0x10008cc1
and dword [ebp - 0x70], eax
jmp 0x10008cd0
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10008cc4
sub eax, edx
mov dword [ebp - 0x70], eax
mov eax, dword [ebp - 0x70]
push eax
mov dword [ebx], eax
push dword [esi]
add ebx, edi
push ebx
call fcn.10043ac0
mov eax, dword [esi + 4]
add ebx, dword [ebp - 0x70]
add esp, 0xc
test eax, eax
jne 0x10008cf2
and dword [ebp - 0x70], eax
jmp 0x10008d01
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10008cf5
sub eax, edx
mov dword [ebp - 0x70], eax
mov eax, dword [ebp - 0x70]
push eax
mov dword [ebx], eax
push dword [esi + 4]
add ebx, edi
push ebx
call fcn.10043ac0
mov eax, dword [esi + 8]
add ebx, dword [ebp - 0x70]
add esp, 0xc
test eax, eax
jne 0x10008d24
and dword [ebp - 0x70], eax
jmp 0x10008d33
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10008d27
sub eax, edx
mov dword [ebp - 0x70], eax
mov eax, dword [ebp - 0x70]
push eax
mov dword [ebx], eax
push dword [esi + 8]
add ebx, edi
push ebx
call fcn.10043ac0
add ebx, dword [ebp - 0x70]
mov eax, dword [esi + 0xc]
mov dword [ebx], eax
add esp, 0xc
add ebx, edi
inc dword [ebp - 0x74]
mov eax, dword [ebp - 0x74]
cmp eax, dword [ebp - 0x7c]
jb 0x10008ca3
mov ecx, dword [ebp - 0x78]
add ecx, 0x6edc
call fcn.100079c3
and dword [ebp - 0x74], 0
mov dword [ebx], eax
add ebx, edi
test eax, eax
mov dword [ebp - 0x7c], eax
jbe 0x10008eb0
mov ecx, dword [ebp - 0x78]
push dword [ebp - 0x74]
add ecx, 0x6edc
call fcn.100079d6
mov esi, dword [eax]
mov eax, dword [esi + 0x18]
mov dword [ebx], eax
mov eax, dword [esi + 0x1c]
add ebx, edi
mov dword [ebx], eax
mov eax, dword [esi + 0x20]
add ebx, edi
mov dword [ebx], eax
mov eax, dword [esi + 4]
add ebx, edi
test eax, eax
jne 0x10008db5
and dword [ebp - 0x70], eax
jmp 0x10008dc4
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10008db8
sub eax, edx
mov dword [ebp - 0x70], eax
mov eax, dword [ebp - 0x70]
push eax
mov dword [ebx], eax
push dword [esi + 4]
add ebx, edi
push ebx
call fcn.10043ac0
mov eax, dword [esi + 0x10]
add ebx, dword [ebp - 0x70]
add esp, 0xc
test eax, eax
jne 0x10008de7
and dword [ebp - 0x70], eax
jmp 0x10008df6
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10008dea
sub eax, edx
mov dword [ebp - 0x70], eax
mov eax, dword [ebp - 0x70]
push eax
mov dword [ebx], eax
push dword [esi + 0x10]
add ebx, edi
push ebx
call fcn.10043ac0
mov eax, dword [esi + 0xc]
add ebx, dword [ebp - 0x70]
add esp, 0xc
test eax, eax
jne 0x10008e19
and dword [ebp - 0x70], eax
jmp 0x10008e28
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10008e1c
sub eax, edx
mov dword [ebp - 0x70], eax
mov eax, dword [ebp - 0x70]
push eax
mov dword [ebx], eax
push dword [esi + 0xc]
add ebx, edi
push ebx
call fcn.10043ac0
mov eax, dword [esi]
add ebx, dword [ebp - 0x70]
add esp, 0xc
test eax, eax
jne 0x10008e4a
and dword [ebp - 0x70], eax
jmp 0x10008e59
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10008e4d
sub eax, edx
mov dword [ebp - 0x70], eax
mov eax, dword [ebp - 0x70]
push eax
mov dword [ebx], eax
push dword [esi]
add ebx, edi
push ebx
call fcn.10043ac0
mov eax, dword [esi + 0x14]
add ebx, dword [ebp - 0x70]
add esp, 0xc
test eax, eax
jne 0x10008e7b
and dword [ebp - 0x70], eax
jmp 0x10008e8a
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10008e7e
sub eax, edx
mov dword [ebp - 0x70], eax
mov eax, dword [ebp - 0x70]
push eax
mov dword [ebx], eax
push dword [esi + 0x14]
add ebx, edi
push ebx
call fcn.10043ac0
add ebx, dword [ebp - 0x70]
add esp, 0xc
inc dword [ebp - 0x74]
mov eax, dword [ebp - 0x74]
cmp eax, dword [ebp - 0x7c]
jb 0x10008d81
mov esi, dword [ebp - 0x80]
mov dword [ebp - 0x74], ebx
sub dword [ebp - 0x74], esi
xor ecx, ecx
xor eax, eax
cmp dword [ebp - 0x74], ecx
jle 0x10008ece
movsx edx, byte [ecx + esi]
add eax, edx
inc ecx
cmp ecx, dword [ebp - 0x74]
jl 0x10008ec2
mov dword [ebx], eax
add ebx, edi
sub ebx, esi
mov eax, ebx
cdq
and edx, 7
add eax, edx
sar eax, 3
test eax, eax
jle 0x10008efe
mov edi, esi
mov dword [ebp - 0x7c], eax
mov ecx, dword [ebp - 0x78]
push str.mypty589mypty589
push edi
call fcn.10006476
add edi, 8
dec dword [ebp - 0x7c]
jne 0x10008ee8
lea eax, [ebp - 0x6c]
push 0x100643b4
push eax
call fcn.100435d9
mov edi, eax
test edi, edi
pop ecx
pop ecx
je 0x10008f27
push edi
push ebx
push 1
push esi
call fcn.10043fb5
push edi
call fcn.1004338d
add esp, 0x14
push esi
call fcn.1001e0b8
pop ecx
mov al, 1
pop edi
mov ecx, dword [ebp + 0x194]
pop esi
xor ecx, ebp
pop ebx
call fcn.10042977
add ebp, 0x198
leave
ret 4