Function at 0x1016de3
Capabilities:
Get common file path
Get hostname

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x1578
call fcn.0101b580
mov eax, dword [0x101dc68]
push ebx
push esi
push edi
lea ecx, [ebp - 0x25c]
push ecx
lea ecx, [ebp - 0x324]
push ecx
lea ecx, [ebp - 0x194]
push ecx
lea ecx, [ebp - 0xcc]
push ecx
lea ecx, [ebp - 0x3ec]
xor ebx, ebx
push ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push 0x1004bb4
push eax
mov dword [ebp - 0x1504], eax
mov dword [ebp - 0x1528], 0x10
mov dword [ebp - 0x150c], ebx
mov dword [ebp - 0x1518], 0x208
mov word [ebp - 0x3ec], bx
mov word [ebp - 0xcc], bx
mov word [ebp - 0x194], bx
mov word [ebp - 0x324], bx
mov word [ebp - 0x25c], bx
call dword [sym.imp.msvcrt.dll_swscanf]
mov edi, dword [sym.imp.msvcrt.dll_wcslen]
lea eax, [ebp - 0xcc]
push eax
call edi
mov esi, dword [sym.imp.msvcrt.dll_swprintf]
add esp, 0x20
cmp eax, 2
jne 0x1016f06
cmp word [ebp - 0xca], 0x3a
jne 0x1016f06
movzx eax, word [ebp - 0xcc]
push eax
push 0x1002a24
push 0x101d9b6
call esi
mov ax, word [ebp - 0xcc]
add esp, 0xc
mov word [0x101d9b4], ax
call fcn.0100da3a
test eax, eax
jne 0x1016ed2
push 0x6c1
jmp 0x101784a
xor eax, eax
mov ax, word [0x101d9b4]
push 0x101db4a
push 0x101da82
push eax
call fcn.0100adf7
movzx eax, word [ebp - 0xcc]
push eax
push 0x1004bac
push 0x101da1c
call esi
add esp, 0xc
jmp 0x10170c5
lea eax, [ebp - 0xcc]
push eax
call edi
cmp eax, 7
pop ecx
jne 0x1016f81
cmp word [ebp - 0xc8], 0x2e
jne 0x1016f81
push 0x33
lea eax, [ebp - 0xcc]
push eax
push 0x101d9b6
call dword [sym.imp.msvcrt.dll_wcsncpy]
mov ax, word [ebp - 0xc4]
add esp, 0xc
mov word [0x101d9c2], bx
mov word [0x101d9b4], ax
call fcn.0100da3a
test eax, eax
jne 0x1016f5d
push 0x6cd
jmp 0x101784a
xor eax, eax
mov ax, word [0x101d9b4]
push 0x101db4a
push 0x101da82
push eax
call fcn.0100adf7
movzx eax, word [ebp - 0xc4]
jmp 0x1016ef1
lea eax, [ebp - 0xcc]
push eax
call edi
cmp eax, 0x31
pop ecx
jne 0x10178db
cmp word [ebp - 0xc8], 0x3f
jne 0x10178db
push 0x33
lea eax, [ebp - 0xcc]
push eax
mov esi, 0x101d9b6
push esi
call dword [sym.imp.msvcrt.dll_wcsncpy]
add esp, 0xc
mov word [0x101da16], bx
call fcn.0100da3a
test eax, eax
jne 0x1016fd4
push 0x6db
jmp 0x101784a
push 0xa
lea eax, [ebp - 0x1578]
pop ecx
mov dword [eax], 0x1001924
mov dword [eax + 4], ebx
add eax, 8
dec ecx
jne 0x1016fdd
push 0x101d9b4
push esi
mov dword [ebp - 0x151c], ebx
call fcn.0100ac87
test eax, eax
jne 0x1017015
lea eax, [ebp - 0x151c]
push eax
lea eax, [ebp - 0x1578]
push eax
push esi
call fcn.0100b714
push 0x101db4a
push dword [ebp - 0x151c]
lea eax, [ebp - 0x1578]
push eax
xor eax, eax
mov ax, word [0x101d9b4]
push 0x101da82
push eax
call fcn.0100ad08
push esi
mov dword [ebp - 0x1510], ebx
mov dword [ebp - 0x1514], ebx
call edi
test eax, eax
pop ecx
jbe 0x10170a2
mov eax, dword [ebp - 0x1510]
movzx eax, word [eax*2 + 0x101d9b6]
push 0x80
push eax
call dword [sym.imp.msvcrt.dll_iswctype]
test eax, eax
pop ecx
pop ecx
je 0x1017090
mov eax, dword [ebp - 0x1510]
mov ecx, dword [ebp - 0x1514]
mov ax, word [eax*2 + 0x101d9b6]
inc dword [ebp - 0x1514]
mov word [ecx*2 + 0x101da1c], ax
inc dword [ebp - 0x1510]
push esi
call edi
cmp dword [ebp - 0x1510], eax
pop ecx
jb 0x101704e
mov eax, dword [ebp - 0x1514]
push 0x1007b4b
push 0xa
mov word [eax*2 + 0x101da1c], bx
push 8
lea eax, [ebp - 0x1578]
push eax
call fcn.010066e4
cmp dword [0x101d830], 2
je 0x10170df
push ebx
call fcn.0100b7a3
push eax
push 0x1a9
jmp 0x10178e7
push dword [0x101d1dc]
push dword [0x101d1d8]
push dword [0x101d1c4]
push dword [0x101d1c0]
call fcn.0101b380
cmp edx, 1
jg 0x1017113
jl 0x1017107
cmp eax, ebx
ja 0x1017113
mov dword [0x101d1a8], 0x7d0
jmp 0x101714b
cmp edx, 5
jg 0x101712a
jl 0x101711e
cmp eax, ebx
ja 0x101712a
mov dword [0x101d1a8], 0xfa0
jmp 0x101714b
cmp edx, 0x19
jg 0x1017141
jl 0x1017135
cmp eax, ebx
ja 0x1017141
mov dword [0x101d1a8], 0x1f40
jmp 0x101714b
mov dword [0x101d1a8], 0x7d00
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push 0x1004b9c
lea eax, [ebp - 0x194]
push eax
call esi
test eax, eax
jne 0x101716f
mov dword [0x101d0a0], 1
jmp 0x10171ad
push 0x1004b8c
lea eax, [ebp - 0x194]
push eax
call esi
test eax, eax
jne 0x101718d
mov dword [0x101d0a0], 2
jmp 0x10171ad
push 0x1004b6c
lea eax, [ebp - 0x194]
push eax
call esi
test eax, eax
jne 0x101789a
mov dword [0x101d0a0], 3
lea eax, [ebp - 0x324]
push eax
call edi
test eax, eax
pop ecx
je 0x1017228
mov esi, dword [sym.imp.msvcrt.dll__wcsicmp]
lea eax, [ebp - 0x324]
push eax
push 0x1004b5c
call esi
test eax, eax
pop ecx
pop ecx
jne 0x1017222
lea eax, [ebp - 0x25c]
push eax
mov dword [0x1028810], 1
call edi
test eax, eax
pop ecx
je 0x1017228
lea eax, [ebp - 0x25c]
push eax
push 0x1004b50
call esi
neg eax
sbb eax, eax
inc eax
mov dword [0x1028818], eax
lea eax, [ebp - 0x25c]
push eax
push 0x1004b44
call esi
add esp, 0x10
neg eax
sbb eax, eax
inc eax
mov dword [0x1028814], eax
jmp 0x1017228
mov dword [0x1028810], ebx
cmp dword [0x1028810], ebx
je 0x1017273
mov edi, 0x1004b08
push edi
push 1
push 0x1f0003
call dword [sym.imp.KERNEL32.dll_OpenEventW]
cmp eax, ebx
mov dword [0x1028800], eax
jne 0x1017273
call fcn.0100bc76
test eax, eax
je 0x1017273
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push 0x1004ae4
push 1
push 0x750
push 0x4e
call fcn.0100bd8d
add esp, 0x18
lea eax, [ebp - 0x1524]
push eax
push 5
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
lea eax, [ebp - 0xaa4]
push eax
push dword [ebp - 0x1524]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
mov edi, dword [sym.imp.msvcrt.dll_wcscpy]
lea eax, [ebp - 0xaa4]
push eax
lea eax, [ebp - 0x644]
push eax
call edi
lea eax, [ebp - 0x644]
push 0x1004ac4
push eax
call dword [sym.imp.msvcrt.dll_wcscat]
push 0x101db4a
lea eax, [ebp - 0x108c]
push 0x1004a98
push eax
call dword [sym.imp.msvcrt.dll_swprintf]
add esp, 0x1c
lea eax, [ebp - 0x1518]
push eax
lea eax, [ebp - 0x84c]
push eax
push 0x1004a80
mov esi, 0x1001630
push esi
lea eax, [ebp - 0x150c]
push eax
mov dword [ebp - 0x1518], 0x208
call fcn.0100b85f
test eax, eax
jne 0x1017328
push dword [ebp - 0x150c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x150c], ebx
lea eax, [ebp - 0x84c]
jmp 0x10173ab
lea eax, [ebp - 0x1518]
push eax
lea eax, [ebp - 0x84c]
push eax
push 0x1004a64
push esi
lea eax, [ebp - 0x150c]
push eax
mov dword [ebp - 0x1518], 0x208
call fcn.0100b85f
test eax, eax
jne 0x10173bf
push dword [ebp - 0x150c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x84c]
push 0x1004a60
push eax
mov dword [ebp - 0x150c], ebx
call dword [sym.imp.msvcrt.dll_wcscmp]
test eax, eax
pop ecx
pop ecx
jne 0x10173bf
lea eax, [ebp - 0xaa4]
push eax
lea eax, [ebp - 0x644]
push eax
call edi
lea eax, [ebp - 0x644]
push 0x1004a38
push eax
call dword [sym.imp.msvcrt.dll_wcscat]
add esp, 0x10
lea eax, [ebp - 0x644]
push eax
call fcn.0100bbb9
test eax, eax
je 0x10173bf
mov dword [0x102880c], 1
call fcn.0100bc76
test eax, eax
mov esi, 0x1004a00
je 0x10173df
push esi
push 2
push 0x799
push 0x4e
call fcn.0100bd8d
add esp, 0x10
call fcn.0100bc76
test eax, eax
je 0x1017404
push dword [ebp - 0x1504]
push 0x10049d0
push 2
push 0x79a
push 0x4e
call fcn.0100bd8d
add esp, 0x14
call fcn.0100bc76
test eax, eax
je 0x101741f
push esi
push 2
push 0x79b
push 0x4e
call fcn.0100bd8d
add esp, 0x10
mov dword [0x101d368], 0x64
mov dword [0x101d36c], ebx
call fcn.0100ac2d
test eax, eax
je 0x10174d3
lea eax, [ebp - 0x1508]
push eax
mov esi, 0x1f4
push esi
lea eax, [ebp - 0xe8c]
push eax
push ebx
xor edi, edi
push ebx
inc edi
push ebx
mov dword [0x102881c], edi
mov dword [ebp - 0x1508], 0x101db4a
mov dword [ebp - 0x1504], ebx
call fcn.0100b7a3
push eax
push 0x27f
push esi
lea eax, [ebp - 0x1474]
push eax
call fcn.0100ba28
push eax
push 0x2400
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
test eax, eax
push 6
jne 0x1017499
push ebx
jmp 0x10174a0
lea eax, [ebp - 0xe8c]
push eax
call fcn.01014ae2
mov eax, dword [0x1028800]
cmp eax, ebx
je 0x10174b5
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
push ebx
push 0x1fa9
push 0x111
push dword [0x10287dc]
call dword [sym.imp.USER32.dll_PostMessageW]
mov eax, edi
jmp 0x1017916
mov eax, dword [0x101d1b8]
mov ecx, dword [0x101d2b0]
push 0x101d7e0
push 0x101d994
add ecx, eax
push ecx
call fcn.01005b95
test eax, eax
jne 0x10174fe
push 0x7c6
jmp 0x101784a
push 0x101d7d4
mov eax, 0x10000
push 0x101d984
push eax
mov dword [0x101d220], eax
mov dword [0x101d224], ebx
call fcn.01005b95
test eax, eax
jne 0x101752c
push 0x7ca
jmp 0x101784a
mov eax, dword [0x101d1b8]
push 0x101d7d8
push 0x101d988
add eax, 0x10000
push eax
call fcn.01005b95
test eax, eax
jne 0x1017554
push 0x7cd
jmp 0x101784a
mov edx, dword [0x101d1b8]
mov ecx, dword [0x101d1bc]
mov esi, dword [0x101d7d8]
mov eax, edx
sub eax, 1
sbb ecx, ebx
xor edi, edi
and eax, esi
and ecx, edi
or eax, ecx
je 0x1017585
lea eax, [edx - 1]
not eax
and eax, esi
add eax, edx
mov dword [0x101d7d8], eax
call fcn.010138d6
test eax, eax
jne 0x1017598
push 0x7da
jmp 0x101784a
call fcn.0100ffaf
test eax, eax
jne 0x10175ab
push 0x7dd
jmp 0x101784a
mov eax, dword [0x101d278]
mov dword [0x101d388], eax
mov eax, dword [0x101d27c]
mov dword [0x101d38c], eax
mov eax, dword [0x101d390]
push 0x101d7dc
push 0x101d990
shl eax, 4
push eax
call fcn.01005b95
test eax, eax
jne 0x10175e5
push 0x7e2
jmp 0x101784a
mov ecx, dword [0x101d390]
mov esi, dword [0x101d7d4]
mov edi, dword [0x101d7dc]
shl ecx, 4
mov eax, ecx
shr ecx, 2
add esi, 0x28
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push dword [0x101d98c]
call dword [sym.imp.KERNEL32.dll_GlobalLock]
cmp eax, ebx
jne 0x1017625
push 0x7e7
jmp 0x101784a
push 3
pop esi
push dword [0x101d7e0]
mov dword [0x101d230], esi
push dword [0x101d7d8]
mov dword [0x101d234], ebx
push eax
push dword [0x101d7dc]
push 0x101d230
call fcn.01016996
test eax, eax
jne 0x1017666
push dword [0x101d98c]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
jmp 0x1017914
cmp dword [0x101d230], esi
jne 0x1017676
cmp dword [0x101d234], ebx
je 0x1017680
push 0x7ed
jmp 0x101784a
push dword [0x101d2b0]
lea eax, [ebp - 0x1520]
push eax
push dword [0x101d7e0]
push 0x70
call fcn.0100e25a
test eax, eax
jne 0x10176a8
push 0x7f0
jmp 0x101784a
push dword [0x101d98c]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov ecx, dword [ebp - 0x1520]
movzx eax, word [ecx + 0x14]
add eax, ecx
mov al, byte [eax + 8]
cmp al, 3
ja 0x101788c
cmp al, 1
jb 0x101788c
lea eax, [ebp - 0x1528]
push eax
push 0x101d7ec
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
jne 0x10176f3
push 0x800
jmp 0x101784a
xor eax, eax
mov ax, word [0x101d9b4]
push 0x10287e4
push 0x10287e0
push eax
call fcn.01013aae
test eax, eax
jne 0x1017719
push 0x804
jmp 0x101784a
mov eax, dword [0x101d1b0]
mov ecx, dword [0x101d1b4]
mov edx, eax
or edx, ecx
jne 0x1017734
push 0x808
jmp 0x101784a
push ebx
push 0x101d980
push ebx
push 8
push ecx
push eax
call fcn.0101b3e0
mov ecx, dword [0x101d1b8]
lea eax, [eax + ecx + 0x19]
push eax
call fcn.01005b95
test eax, eax
jne 0x1017762
push 0x80b
jmp 0x101784a
call fcn.010092a6
test eax, eax
jne 0x1017775
push 0x80e
jmp 0x101784a
push ebx
push dword [0x101d1a8]
xor esi, esi
inc esi
push esi
push dword [0x10287dc]
call dword [sym.imp.USER32.dll_SetTimer]
test eax, eax
jne 0x101779a
push 0x811
jmp 0x101784a
push 0x19
pop ecx
xor eax, eax
mov word [ebp - 0x1500], bx
push 9
lea edi, [ebp - 0x14fe]
rep stosd dword es:[edi], eax
pop ecx
lea edi, [ebp - 0x149a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov edi, dword [sym.imp.msvcrt.dll_wcscpy]
lea eax, [ebp - 0x1500]
push 0x101d9b6
push eax
mov dword [0x101d1ac], ebx
mov dword [0x101d834], esi
call edi
mov eax, dword [0x101d0a0]
mov dword [ebp - 0x1478], eax
lea eax, [ebp - 0x149a]
push 0x1001fe8
push eax
call edi
add esp, 0x10
push dword [0x1028820]
lea eax, [ebp - 0x1500]
push 0x8c
push eax
push 0x200d
call fcn.010065e2
call fcn.0100bc76
test eax, eax
je 0x1017837
push 0x101db4a
push 0x10049a0
push 2
push 0x827
push 0x4e
call fcn.0100bd8d
add esp, 0x14
mov eax, dword [0x101d0a0]
dec eax
je 0x101786e
dec eax
je 0x1017866
dec eax
je 0x101785e
push 0x836
push 0x1003838
push 0x10037d8
call fcn.01007cb4
jmp 0x1017914
push ebx
push 0x1faf
jmp 0x1017874
push ebx
push 0x1fa5
jmp 0x1017874
push ebx
push 0x1fa4
push 0x111
push dword [0x10287dc]
call dword [sym.imp.USER32.dll_PostMessageW]
mov eax, esi
jmp 0x1017916
push ebx
call fcn.0100b7a3
push eax
push 0x277
jmp 0x10178e7
push ebx
call fcn.0100b7a3
push eax
push 1
lea ecx, [ebp - 0x1508]
call fcn.01007c8b
push 5
push dword [ebp - 0x1504]
call fcn.01014ae2
call fcn.0100bc76
test eax, eax
je 0x10178ff
push 0x1004974
push ebx
push 0x729
push 0x4e
call fcn.0100bd8d
add esp, 0x10
jmp 0x10178ff
push ebx
call fcn.0100b7a3
push eax
push 0x251
lea ecx, [ebp - 0x1508]
call fcn.01007c8b
push 5
push dword [ebp - 0x1504]
call fcn.01014ae2
lea ecx, [ebp - 0x1508]
mov dword [ebp - 0x1508], 0x1001924
call fcn.01007a33
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.0101b02f
leave
ret 4