Function at 0x9ab720
Capabilities:
Check os version
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x89c
mov eax, dword [0xb196ec]
xor eax, esp
mov dword [esp + 0x898], eax
mov eax, dword [0xb5418c]
mov ecx, dword [0xb54190]
push ebx
push esi
push edi
xor edi, edi
push 0x124
lea edx, [esp + 0x70]
push edi
push edx
mov dword [esp + 0x44], eax
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x74], edi
call fcn.00a7ffb0
add esp, 0xc
mov dword [esp + 0x10], edi
cmp dword [0xc07e2c], edi
jne 0x9ab7b6
mov esi, 1
mov dword [0xc07e2c], esi
cmp dword [0xbfc9d0], edi
jne 0x9ab7a2
mov dword [0xbfc9d0], esi
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, eax
js 0x9ab7a2
cmp al, 6
jb 0x9ab7a2
mov dword [0xbfc9d4], esi
mov eax, dword [0xbfc9d4]
push edi
push edi
mov dword [0xc1170c], eax
call fcn.009ab000
add esp, 8
mov ecx, str.KERNEL32.DLL
call fcn.0094c620
mov ebx, eax
mov dword [esp + 0x34], ebx
cmp ebx, edi
je 0x9abe88
mov ecx, str.PSAPI.DLL
call fcn.0094c620
mov dword [esp + 0x28], eax
cmp eax, edi
jne 0x9ab7fe
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x898]
xor ecx, esp
call fcn.00a78f21
mov esp, ebp
pop ebp
ret
cmp byte [0xc07800], 0
jne 0x9ab8d7
mov esi, 0xc076f8
call fcn.009a9d60
cmp byte [0xc076f8], 0
je 0x9ab825
mov ecx, esi
call fcn.00960910
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0xc076f8
push 0xc07c20
call esi
mov ecx, 0xc07c20
call fcn.00960910
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
push str.servicingTrustedInstaller.exe
push 0xc07c20
call edi
push 0xc076f8
push 0xc07d28
call esi
push str.WinSxS
push 0xc07d28
call edi
mov ecx, 0xc07d28
call fcn.00960910
push 0x104
push 0xc07800
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov ecx, 0xc07800
call fcn.00960910
push 0xc07800
push 0xc07908
call esi
push str.svchost.exe
push 0xc07908
call edi
push 0xc07800
push 0xc07a10
call esi
push str.VSSVC.exe
push 0xc07a10
call edi
push 0xc07800
push 0xc07b18
call esi
push str.poqexec.exe
push 0xc07b18
call edi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.CreateToolhelp32Snapshot
push ebx
call esi
push str.Process32First
push ebx
mov edi, eax
call esi
mov ecx, dword [esp + 0x34]
push str.Process32Next
push ecx
mov ebx, eax
call esi
mov edx, dword [esp + 0x28]
push str.GetProcessImageFileNameA
push edx
mov dword [esp + 0x34], eax
call esi
mov dword [esp + 0x14], eax
test edi, edi
je 0x9abe63
test ebx, ebx
je 0x9abe63
cmp dword [esp + 0x2c], 0
je 0x9abe63
test eax, eax
je 0x9abe63
push 0
push 2
call edi
mov dword [esp + 0x10], eax
cmp eax, 0xffffffff
je 0x9abe63
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x68]
push eax
push ecx
mov dword [esp + 0x70], 0x128
call ebx
test eax, eax
je 0x9abe63
mov eax, 0xbdb5d8
call fcn.0096ffb0
test eax, eax
je 0x9abe63
push 0x3ff
lea edx, [esp + 0x4a5]
push 0
push edx
mov byte [esp + 0x4ac], 0
call fcn.00a7ffb0
add esp, 0xc
push 0x103
lea eax, [esp + 0x39d]
push 0
push eax
mov byte [esp + 0x3a4], 0
call fcn.00a7ffb0
add esp, 0xc
push 0x207
lea ecx, [esp + 0x195]
push 0
push ecx
mov byte [esp + 0x19c], 0
call fcn.00a7ffb0
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [esp + 0x30], 0
mov ebx, eax
mov dword [esp + 0x18], ebx
je 0x9aba90
mov edx, dword [0xbe49b4]
mov eax, dword [0xbe499c]
lea ecx, [esp + 0x18]
mov dword [esp + 0x24], edx
push ecx
lea edx, [esp + 0x40]
push edx
mov edi, 0xbe499c
mov dword [esp + 0x28], eax
call fcn.0099cb00
lea esi, [esp + 0x20]
mov edi, eax
call fcn.009c0630
test al, al
je 0x9aba90
push ebx
lea ecx, [esp + 0x39c]
call fcn.009a3b30
test eax, eax
je 0x9aba5f
lea eax, [esp + 0x18]
push eax
push 0xbe499c
lea ebx, [esp + 0x4c]
call fcn.0099c9d0
mov ecx, dword [esp + 0x18]
push ecx
lea edx, [esp + 0x4a4]
push str.PID_added_to_Whitelist_3_:__u__avpmapp.exe
push edx
call fcn.00a78f30
add esp, 0xc
jmp 0x9aba7d
lea eax, [esp + 0x398]
push eax
push ebx
lea ecx, [esp + 0x4a8]
push str.PID_addition_to_Whitelist_failed:__u___s
push ecx
call fcn.00a78f30
add esp, 0x10
lea eax, [esp + 0x4a0]
call fcn.009a29a0
lea esp, [esp]
cmp dword [esp + 0x38], 0
je 0x9abbaf
mov edx, dword [0xbe4994]
mov eax, dword [0xbe497c]
lea ecx, [esp + 0x70]
mov dword [esp + 0x24], edx
push ecx
lea edx, [esp + 0x40]
push edx
mov edi, 0xbe497c
mov dword [esp + 0x28], eax
call fcn.0099cb00
lea esi, [esp + 0x20]
mov edi, eax
call fcn.009c0630
test al, al
je 0x9abbaf
cmp byte [esp + 0x190], 0
jne 0x9abaf7
mov eax, dword [esp + 0x70]
mov ecx, dword [esp + 0x14]
push eax
lea edx, [esp + 0x194]
call 0x9aaee0
add esp, 4
lea ecx, [esp + 0x190]
push ecx
lea edx, [esp + 0x90]
push edx
call fcn.009ab000
add esp, 8
test eax, eax
je 0x9abbaf
mov eax, dword [esp + 0x70]
push eax
lea ecx, [esp + 0x39c]
call fcn.009a4150
test eax, eax
je 0x9abb81
lea ecx, [esp + 0x70]
push ecx
push 0xbe497c
lea ebx, [esp + 0x64]
call fcn.0099c9d0
cmp byte [esp + 0x8c], 0
je 0x9abb65
mov eax, dword [esp + 0x70]
lea edx, [esp + 0x8c]
push edx
push eax
push str._SENS__PID_added_to_SensitivePID_A_:__u___s_
lea ecx, [esp + 0x4ac]
push ecx
jmp 0x9abb9b
mov edx, dword [esp + 0x70]
push edx
lea eax, [esp + 0x4a4]
push str._SENS__PID_added_to_SensitivePID_B_:__u
push eax
call fcn.00a78f30
add esp, 0xc
jmp 0x9abba3
mov edx, dword [esp + 0x70]
lea ecx, [esp + 0x398]
push ecx
push edx
push str._SENS__PID_addition_to_SensitivePID_failed:__u___s
lea eax, [esp + 0x4ac]
push eax
call fcn.00a78f30
add esp, 0x10
lea eax, [esp + 0x4a0]
call fcn.009a29a0
cmp dword [esp + 0x30], 0
je 0x9abe41
mov ecx, dword [0xbe49b4]
mov edx, dword [0xbe499c]
lea eax, [esp + 0x70]
mov dword [esp + 0x1c], ecx
push eax
lea ecx, [esp + 0x48]
push ecx
mov edi, 0xbe499c
mov dword [esp + 0x20], edx
call fcn.0099cb00
lea esi, [esp + 0x18]
mov edi, eax
call fcn.009c0630
test al, al
je 0x9abe41
lea edx, [esp + 0x8c]
push str.TPAutoConnect.exe
push edx
call fcn.00a88f66
add esp, 8
test eax, eax
jne 0x9abc62
cmp byte [esp + 0x190], al
jne 0x9abc3d
mov eax, dword [esp + 0x70]
mov ecx, dword [esp + 0x14]
push eax
lea edx, [esp + 0x194]
call 0x9aaee0
add esp, 4
cmp byte [esp + 0x190], 0
je 0x9abd95
push 0
lea ecx, [esp + 0x194]
push str.VMwareVMware_Tools_
push ecx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x9abd95
jmp 0x9abda9
cmp dword [0xc1170c], 0
je 0x9abd95
lea edx, [esp + 0x8c]
push str.svchost.exe
push edx
call fcn.00a88f66
add esp, 8
test eax, eax
je 0x9abcf0
lea eax, [esp + 0x8c]
push str.tiworker.exe
push eax
call fcn.00a88f66
add esp, 8
test eax, eax
je 0x9abcf0
lea ecx, [esp + 0x8c]
push str.TrustedInstaller.exe
push ecx
call fcn.00a88f66
add esp, 8
test eax, eax
je 0x9abcf0
lea edx, [esp + 0x8c]
push str.VSSVC.exe
push edx
call fcn.00a88f66
add esp, 8
test eax, eax
je 0x9abcf0
lea eax, [esp + 0x8c]
push str.poqexec.exe
push eax
call fcn.00a88f66
add esp, 8
test eax, eax
jne 0x9abd95
cmp byte [esp + 0x190], 0
jne 0x9abd1c
mov ecx, dword [esp + 0x70]
push ecx
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0x194]
call 0x9aaee0
add esp, 4
cmp byte [esp + 0x190], 0
je 0x9abd95
lea edx, [esp + 0x190]
push 0xc07908
push edx
call fcn.00a88f66
add esp, 8
test eax, eax
je 0x9abda9
mov eax, 0xc07d28
lea ecx, [esp + 0x190]
call fcn.0094c3e0
test eax, eax
je 0x9abda9
lea eax, [esp + 0x190]
push 0xc07c20
push eax
call fcn.00a88f66
add esp, 8
test eax, eax
je 0x9abda9
lea ecx, [esp + 0x190]
push 0xc07a10
push ecx
call fcn.00a88f66
add esp, 8
test eax, eax
je 0x9abda9
lea edx, [esp + 0x190]
push 0xc07b18
push edx
call fcn.00a88f66
add esp, 8
test eax, eax
je 0x9abda9
lea esi, [esp + 0x8c]
call 0x9aa790
test eax, eax
je 0x9abe41
mov eax, dword [esp + 0x70]
push eax
lea ecx, [esp + 0x39c]
call fcn.009a3b30
test eax, eax
je 0x9abe13
lea ecx, [esp + 0x70]
push ecx
push 0xbe499c
lea ebx, [esp + 0x58]
call fcn.0099c9d0
cmp byte [esp + 0x8c], 0
je 0x9abdf7
mov eax, dword [esp + 0x70]
lea edx, [esp + 0x8c]
push edx
push eax
push str.PID_added_to_Whitelist_4_:__u___s_
lea ecx, [esp + 0x4ac]
push ecx
jmp 0x9abe2d
mov edx, dword [esp + 0x70]
push edx
lea eax, [esp + 0x4a4]
push str.PID_added_to_Whitelist_5_:__u
push eax
call fcn.00a78f30
add esp, 0xc
jmp 0x9abe35
mov edx, dword [esp + 0x70]
lea ecx, [esp + 0x398]
push ecx
push edx
push str.PID_addition_to_Whitelist_failed:__u___s
lea eax, [esp + 0x4ac]
push eax
call fcn.00a78f30
add esp, 0x10
lea eax, [esp + 0x4a0]
call fcn.009a29a0
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x68]
push ecx
push edx
call dword [esp + 0x34]
test eax, eax
jne 0x9aba90
mov eax, dword [0xbdb5d8]
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov ecx, dword [esp + 0x34]
mov esi, dword [sym.imp.KERNEL32.dll_FreeLibrary]
push ecx
call esi
mov edx, dword [esp + 0x28]
push edx
call esi
cmp dword [esp + 0x10], 0
je 0x9abe88
lea eax, [esp + 0x10]
push eax
call fcn.00985290
mov ecx, dword [esp + 0x8a4]
pop edi
pop esi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.00a78f21
mov esp, ebp
pop ebp
ret