Function at 0x1003b6b
Capabilities:
Check if file exists
Get file attributes
Get system information on windows
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x74]
sub esp, 0x368
push ebx
push esi
push edi
push 7
pop ecx
push 6
mov esi, 0x1001768
lea edi, [ebp - 0x9c]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
pop ecx
push 6
mov esi, 0x100174c
lea edi, [ebp - 0x44]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
pop ecx
mov esi, 0x1001730
lea edi, [ebp - 0x60]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
push 5
pop ecx
mov esi, 0x1001718
lea edi, [ebp - 0x28]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 5
pop ecx
mov esi, 0x1001700
lea edi, [ebp - 0x10]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 5
pop ecx
mov esi, 0x10016e8
lea edi, [ebp + 8]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 8
pop ecx
push 0xc
mov esi, 0x10016c8
lea edi, [ebp - 0xbc]
rep movsd dword es:[edi], dword [esi]
pop ecx
mov esi, 0x1001694
lea edi, [ebp - 0x1f4]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov esi, 0x1001680
lea edi, [ebp + 0x20]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 7
pop ecx
movsb byte es:[edi], byte [esi]
mov esi, 0x1001664
lea edi, [ebp - 0x7c]
rep movsd dword es:[edi], dword [esi]
xor esi, esi
push esi
push 0x80
push 2
push esi
mov dword [ebp + 0x60], 1
mov dword [ebp + 0x34], 0x1001644
mov dword [ebp + 0x38], 0x1001630
mov dword [ebp + 0x3c], 0x1001610
mov dword [ebp + 0x40], 0x10015f8
mov dword [ebp + 0x44], 0x10015dc
mov dword [ebp + 0x48], 0x10015b0
mov dword [ebp + 0x4c], 0x1001598
mov dword [ebp + 0x50], 0x100156c
mov dword [ebp + 0x54], 0x1001534
mov dword [ebp + 0x58], esi
push esi
push 0x40000000
push 0x1012dc8
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
mov dword [ebp + 0x6c], ebx
jne 0x1003c9d
push esi
push 0x10
push esi
push esi
push 0x462
push dword [ebp + 0x7c]
call fcn.01003267
xor eax, eax
jmp 0x1004199
push 0x200
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
cmp eax, esi
mov dword [ebp + 0x70], eax
jne 0x1003cc9
push esi
push 0x10
push esi
push esi
push 0x44c
push dword [ebp + 0x7c]
call fcn.01003267
push ebx
jmp 0x100418b
push 0x100
lea eax, [ebp - 0x2f4]
push eax
push 0x41c
call fcn.010029f0
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
push esi
lea eax, [ebp + 0x68]
push eax
lea eax, [ebp - 0x2f4]
push eax
call edi
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
push eax
lea eax, [ebp - 0x2f4]
push eax
push ebx
call esi
mov ebx, dword [sym.imp.USER32.dll_wsprintfA]
push 0x1012ecc
lea eax, [ebp - 0x9c]
push eax
push dword [ebp + 0x70]
call ebx
add esp, 0xc
push 0
lea eax, [ebp + 0x68]
push eax
push dword [ebp + 0x70]
call edi
push eax
push dword [ebp + 0x70]
push dword [ebp + 0x6c]
call esi
push dword [0x1013e38]
lea eax, [ebp - 0x44]
push eax
push dword [ebp + 0x70]
call ebx
add esp, 0xc
push 0
lea eax, [ebp + 0x68]
push eax
push dword [ebp + 0x70]
call edi
push eax
push dword [ebp + 0x70]
push dword [ebp + 0x6c]
call esi
push dword [0x1013e3c]
lea eax, [ebp - 0x60]
push eax
push dword [ebp + 0x70]
call ebx
add esp, 0xc
push 0
lea eax, [ebp + 0x68]
push eax
push dword [ebp + 0x70]
call edi
push eax
push dword [ebp + 0x70]
push dword [ebp + 0x6c]
call esi
push 0x1012fd0
lea eax, [ebp - 0x28]
push eax
push dword [ebp + 0x70]
call ebx
add esp, 0xc
push 0
lea eax, [ebp + 0x68]
push eax
push dword [ebp + 0x70]
call edi
push eax
push dword [ebp + 0x70]
push dword [ebp + 0x6c]
call esi
push 0x10130d4
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0x70]
call ebx
add esp, 0xc
push 0
lea eax, [ebp + 0x68]
push eax
push dword [ebp + 0x70]
call edi
push eax
push dword [ebp + 0x70]
push dword [ebp + 0x6c]
call esi
test byte [0x1013e4e], 1
mov eax, 0x100152c
jne 0x1003ddb
mov eax, 0x1001524
push eax
lea eax, [ebp + 8]
push eax
push dword [ebp + 0x70]
call ebx
add esp, 0xc
push 0
lea eax, [ebp + 0x68]
push eax
push dword [ebp + 0x70]
call edi
push eax
push dword [ebp + 0x70]
push dword [ebp + 0x6c]
call esi
mov eax, dword [0x1013e4c]
test eax, 0x20000
je 0x1003e0d
xor eax, eax
inc eax
jmp 0x1003e25
test eax, 0x40000
je 0x1003e19
push 2
pop eax
jmp 0x1003e25
and eax, 0x80000
neg eax
sbb eax, eax
and eax, 3
push dword [eax*4 + 0x10112d4]
lea eax, [ebp - 0xbc]
push eax
push dword [ebp + 0x70]
call ebx
add esp, 0xc
push 0
lea eax, [ebp + 0x68]
push eax
push dword [ebp + 0x70]
call edi
push eax
push dword [ebp + 0x70]
push dword [ebp + 0x6c]
call esi
push 0x1013920
lea eax, [ebp - 0x1f4]
push eax
push dword [ebp + 0x70]
call ebx
add esp, 0xc
push 0
lea eax, [ebp + 0x68]
push eax
push dword [ebp + 0x70]
call edi
push eax
push dword [ebp + 0x70]
push dword [ebp + 0x6c]
call esi
push 0x10143c0
push 0x104
lea eax, [ebp - 0x1c0]
push eax
push 0x1001520
push 0x1001514
push 0x1001454
call fcn.010035e3
lea eax, [ebp - 0x1c0]
push eax
lea eax, [ebp + 0x20]
push eax
push dword [ebp + 0x70]
call ebx
add esp, 0xc
push 0
lea eax, [ebp + 0x68]
push eax
push dword [ebp + 0x70]
call edi
push eax
push dword [ebp + 0x70]
push dword [ebp + 0x6c]
call esi
push 0x10143c0
push 0x15
push 0x1001500
push 0x1001454
call fcn.01002ab7
test eax, eax
jg 0x1003ee0
push 0x15
pop eax
push eax
lea eax, [ebp - 0x7c]
push eax
push dword [ebp + 0x70]
call ebx
add esp, 0xc
push 0
lea eax, [ebp + 0x68]
push eax
push dword [ebp + 0x70]
call edi
push eax
push dword [ebp + 0x70]
push dword [ebp + 0x6c]
call esi
mov dword [ebp + 0x64], 0x1001644
lea ebx, [ebp + 0x34]
push 0
lea eax, [ebp + 0x68]
push eax
push dword [ebp + 0x64]
call edi
push eax
push dword [ebp + 0x64]
push dword [ebp + 0x6c]
call esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
mov dword [ebp + 0x64], eax
jne 0x1003f0b
mov eax, dword [0x1013e64]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
mov dword [ebp + 0x64], eax
jmp 0x1003f3e
mov eax, dword [ebp + 0x64]
test eax, eax
je 0x1004058
push dword [eax + 4]
push dword [ebp + 0x70]
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [ebp + 0x64]
push dword [eax]
push dword [ebp + 0x70]
call ebx
push dword [ebp + 0x70]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1004045
test al, 0x10
jne 0x1004045
test byte [0x1013e4c], 2
lea eax, [ebp - 0x1c0]
je 0x1003fad
push 0x100146c
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push dword [ebp + 0x70]
lea eax, [ebp - 0x1c0]
push eax
call ebx
push 0x100146c
lea eax, [ebp - 0x1c0]
push eax
call ebx
jmp 0x1003fc0
push 0x104
push eax
push dword [ebp + 0x70]
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
test eax, eax
je 0x1004034
push 0
lea eax, [ebp + 0x68]
push eax
lea eax, [ebp - 0x1c0]
push eax
call edi
push eax
lea eax, [ebp - 0x1c0]
push eax
push dword [ebp + 0x6c]
call esi
push 0
lea eax, [ebp + 0x68]
push eax
push 0x10014fc
call edi
push eax
push 0x10014fc
push dword [ebp + 0x6c]
call esi
test eax, eax
mov ecx, dword [ebp + 0x64]
mov ecx, dword [ecx + 0xc]
mov dword [ebp + 0x60], eax
mov dword [ebp + 0x64], ecx
jne 0x1003f3b
push dword [ebp + 0x70]
call dword [sym.imp.KERNEL32.dll_LocalFree]
push dword [ebp + 0x6c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
cmp dword [ebp + 0x60], eax
jne 0x1004196
push eax
push 0x10
push eax
push eax
push 0x463
jmp 0x1003c8e
xor eax, eax
push eax
push 0x10
push eax
push eax
push 0x46f
jmp 0x1004177
push 0
push 0x10
push 0
push dword [ebp + 0x70]
push 0x46e
jmp 0x1004177
cmp dword [ebp + 0x60], 0
je 0x1004008
test byte [0x1013e4c], 4
je 0x1004008
lea eax, [ebp + 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push 0x10143c0
push 0xffffffffffffffff
push 0x10014ec
push 0x1001454
call fcn.01002ab7
xor ecx, ecx
cmp word [ebp + 0x38], cx
jne 0x1004150
cmp eax, ecx
jne 0x1004159
mov dword [ebp + 0x5c], 1
cmp dword [ebp + 0x5c], ecx
mov dword [ebp + 0x64], ecx
jle 0x1004008
cmp dword [ebp + 0x60], 0
je 0x1004008
mov ecx, dword [ebp + 0x64]
xor eax, eax
push eax
push dword [ecx*4 + 0x10112c8]
push eax
push eax
call fcn.010033f9
test eax, eax
jne 0x100413c
push 0x104
lea eax, [ebp - 0x1c0]
push eax
mov eax, dword [ebp + 0x64]
push dword [eax*4 + 0x10112c8]
call fcn.0100322e
test eax, eax
je 0x1004165
push 0x100146c
push dword [ebp + 0x70]
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x1c0]
push eax
push dword [ebp + 0x70]
call ebx
push 0x100146c
push dword [ebp + 0x70]
call ebx
push 0
lea eax, [ebp + 0x68]
push eax
push dword [ebp + 0x70]
call edi
push eax
push dword [ebp + 0x70]
push dword [ebp + 0x6c]
call esi
push 0
lea eax, [ebp + 0x68]
push eax
push 2
push 0x10014fc
push dword [ebp + 0x6c]
call esi
mov dword [ebp + 0x60], eax
inc dword [ebp + 0x64]
mov eax, dword [ebp + 0x64]
cmp eax, dword [ebp + 0x5c]
jl 0x10040ae
jmp 0x1004008
cmp eax, 1
jne 0x100409b
mov dword [ebp + 0x5c], 3
jmp 0x10040a2
push 0
push 0x10
push 0
lea eax, [ebp - 0x1c0]
push eax
push 0x46d
push dword [ebp + 0x7c]
call fcn.01003267
push dword [ebp + 0x70]
call dword [sym.imp.KERNEL32.dll_LocalFree]
push dword [ebp + 0x6c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1003c96
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
add ebp, 0x74
leave
ret 4