Function at 0x101034b
Capabilities:
Get common file path
Get hostname

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x11f8
call fcn.01012850
mov eax, dword [0x1014c68]
push ebx
push esi
push edi
lea ecx, [ebp - 0x194]
push ecx
lea ecx, [ebp - 0x25c]
push ecx
lea ecx, [ebp - 0x324]
push ecx
lea ecx, [ebp - 0xcc]
push ecx
lea ecx, [ebp - 0x3ec]
xor esi, esi
push ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push 0x1003b9c
push eax
mov dword [ebp - 0x11a8], 0x10
mov dword [ebp - 0x1194], esi
mov dword [ebp - 0x11a0], 0x208
mov word [ebp - 0x3ec], si
mov word [ebp - 0xcc], si
mov word [ebp - 0x324], si
mov word [ebp - 0x25c], si
mov word [ebp - 0x194], si
call dword [sym.imp.msvcrt.dll_swscanf]
mov edi, dword [sym.imp.msvcrt.dll_wcslen]
lea eax, [ebp - 0xcc]
push eax
call edi
add esp, 0x20
cmp eax, 2
jne 0x1010468
cmp word [ebp - 0xca], 0x3a
jne 0x1010468
movzx eax, word [ebp - 0xcc]
mov ebx, dword [sym.imp.USER32.dll_wsprintfW]
push eax
push 0x1002b64
push 0x10149d6
call ebx
mov ax, word [ebp - 0xcc]
add esp, 0xc
mov word [0x10149d4], ax
call fcn.01007692
test eax, eax
jne 0x1010434
push 0x2ef
jmp 0x1010b56
xor eax, eax
mov ax, word [0x10149d4]
push 0x1014b6a
push 0x1014aa2
push eax
call fcn.0100ab60
movzx eax, word [ebp - 0xcc]
push eax
push 0x1003b94
push 0x1014a3c
call ebx
add esp, 0xc
jmp 0x1010632
lea eax, [ebp - 0xcc]
push eax
call edi
cmp eax, 7
pop ecx
jne 0x10104f1
cmp word [ebp - 0xc8], 0x2e
jne 0x10104f1
lea eax, [ebp - 0xcc]
push eax
push 0x10149d6
call dword [sym.imp.msvcrt.dll_wcscpy]
mov ax, word [ebp - 0xc4]
pop ecx
pop ecx
mov word [0x10149e2], si
mov word [0x10149d4], ax
call fcn.01007692
test eax, eax
jne 0x10104bc
push 0x2fb
jmp 0x1010b56
xor eax, eax
mov ax, word [0x10149d4]
push 0x1014b6a
push 0x1014aa2
push eax
call fcn.0100ab60
movzx eax, word [ebp - 0xc4]
push eax
push 0x1003b94
push 0x1014a3c
call dword [sym.imp.USER32.dll_wsprintfW]
jmp 0x1010460
lea eax, [ebp - 0xcc]
push eax
call edi
cmp eax, 0x31
pop ecx
jne 0x1010b95
cmp word [ebp - 0xc8], 0x3f
jne 0x1010b95
lea eax, [ebp - 0xcc]
push eax
mov ebx, 0x10149d6
push ebx
call dword [sym.imp.msvcrt.dll_wcscpy]
pop ecx
pop ecx
mov word [0x1014a36], si
call fcn.01007692
test eax, eax
jne 0x1010541
push 0x309
jmp 0x1010b56
push 0xa
lea eax, [ebp - 0x11f8]
pop ecx
mov dword [eax], 0x100195c
mov dword [eax + 4], esi
add eax, 8
dec ecx
jne 0x101054a
push 0x10149d4
push ebx
mov dword [ebp - 0x118c], esi
call fcn.0100a9f0
test eax, eax
jne 0x1010582
lea eax, [ebp - 0x118c]
push eax
lea eax, [ebp - 0x11f8]
push eax
push ebx
call fcn.0100b537
push 0x1014b6a
push dword [ebp - 0x118c]
lea eax, [ebp - 0x11f8]
push eax
xor eax, eax
mov ax, word [0x10149d4]
push 0x1014aa2
push eax
call fcn.0100aa71
push ebx
mov dword [ebp - 0x1198], esi
mov dword [ebp - 0x119c], esi
call edi
test eax, eax
pop ecx
jbe 0x101060f
mov eax, dword [ebp - 0x1198]
movzx eax, word [eax*2 + 0x10149d6]
push 0x80
push eax
call dword [sym.imp.msvcrt.dll_iswctype]
test eax, eax
pop ecx
pop ecx
je 0x10105fd
mov eax, dword [ebp - 0x1198]
mov ecx, dword [ebp - 0x119c]
mov ax, word [eax*2 + 0x10149d6]
inc dword [ebp - 0x119c]
mov word [ecx*2 + 0x1014a3c], ax
inc dword [ebp - 0x1198]
push ebx
call edi
cmp dword [ebp - 0x1198], eax
pop ecx
jb 0x10105bb
mov eax, dword [ebp - 0x119c]
push 0x1005c64
push 0xa
mov word [eax*2 + 0x1014a3c], si
push 8
lea eax, [ebp - 0x11f8]
push eax
call fcn.010047b5
mov eax, dword [0x1014850]
cmp eax, 1
je 0x1010652
cmp eax, 3
je 0x1010652
push esi
call fcn.0100b5c6
push eax
push 0x192
jmp 0x1010ba1
push dword [0x1014214]
push dword [0x1014210]
push dword [0x10141fc]
push dword [0x10141f8]
call fcn.01012650
cmp edx, 1
jg 0x1010686
jl 0x101067a
cmp eax, esi
ja 0x1010686
mov dword [0x10141d8], 0x7d0
jmp 0x10106c1
cmp edx, 2
jg 0x10106a0
jl 0x1010694
cmp eax, 0x40000000
ja 0x10106a0
mov dword [0x10141d8], 0x1388
jmp 0x10106c1
cmp edx, 0x19
jg 0x10106b7
jl 0x10106ab
cmp eax, esi
ja 0x10106b7
mov dword [0x10141d8], 0x2710
jmp 0x10106c1
mov dword [0x10141d8], 0x7530
mov ebx, dword [sym.imp.msvcrt.dll_wcscmp]
lea eax, [ebp - 0x324]
push 0x1003b84
push eax
call ebx
test eax, eax
pop ecx
pop ecx
jne 0x10106e7
mov dword [0x10140d0], 1
jmp 0x1010709
lea eax, [ebp - 0x324]
push 0x1003b74
push eax
call ebx
test eax, eax
pop ecx
pop ecx
jne 0x1010b8a
mov dword [0x10140d0], 2
lea eax, [ebp - 0x25c]
push eax
call edi
test eax, eax
pop ecx
je 0x1010784
mov ebx, dword [sym.imp.msvcrt.dll__wcsicmp]
lea eax, [ebp - 0x25c]
push eax
push 0x1003b64
call ebx
test eax, eax
pop ecx
pop ecx
jne 0x101077e
lea eax, [ebp - 0x194]
push eax
mov dword [0x1031418], 1
call edi
test eax, eax
pop ecx
je 0x1010784
lea eax, [ebp - 0x194]
push eax
push 0x1003b58
call ebx
neg eax
sbb eax, eax
inc eax
mov dword [0x1031420], eax
lea eax, [ebp - 0x194]
push eax
push 0x1003b4c
call ebx
add esp, 0x10
neg eax
sbb eax, eax
inc eax
mov dword [0x103141c], eax
jmp 0x1010784
mov dword [0x1031418], esi
cmp dword [0x1031418], esi
je 0x10107a3
push 0x1003b10
push 1
push 0x1f0003
call dword [sym.imp.KERNEL32.dll_OpenEventW]
mov dword [0x1031408], eax
lea eax, [ebp - 0x11a0]
push eax
lea eax, [ebp - 0x84c]
push eax
push 0x1001a34
mov ebx, 0x1001670
push ebx
lea eax, [ebp - 0x1194]
push eax
mov dword [ebp - 0x11a0], 0x208
call fcn.0100b682
test eax, eax
jne 0x10107fc
push dword [ebp - 0x1194]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x10107fc
lea eax, [ebp - 0x84c]
push eax
mov dword [ebp - 0x1194], esi
call fcn.010063a7
test eax, eax
jne 0x101080d
push esi
call fcn.0100b5c6
push eax
push 0x25c
jmp 0x1010ba1
lea eax, [ebp - 0x11a4]
push eax
push 5
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
lea eax, [ebp - 0xaa4]
push eax
push dword [ebp - 0x11a4]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
lea eax, [ebp - 0xaa4]
push eax
lea eax, [ebp - 0x644]
push eax
call dword [sym.imp.msvcrt.dll_wcscpy]
mov edi, dword [sym.imp.msvcrt.dll_wcscat]
lea eax, [ebp - 0x644]
push 0x1003af0
push eax
call edi
push 0x1014b6a
lea eax, [ebp - 0x10fc]
push 0x1003ac8
push eax
call dword [sym.imp.msvcrt.dll_swprintf]
add esp, 0x1c
lea eax, [ebp - 0x11a0]
push eax
lea eax, [ebp - 0x84c]
push eax
push 0x1003aac
push ebx
lea eax, [ebp - 0x1194]
push eax
mov dword [ebp - 0x11a0], 0x208
call fcn.0100b682
test eax, eax
jne 0x1010903
push dword [ebp - 0x1194]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x84c]
push 0x1003aa8
push eax
call dword [sym.imp.msvcrt.dll_wcscmp]
test eax, eax
pop ecx
pop ecx
jne 0x1010903
lea eax, [ebp - 0xaa4]
push eax
lea eax, [ebp - 0x644]
push eax
call dword [sym.imp.msvcrt.dll_wcscpy]
lea eax, [ebp - 0x644]
push 0x1003a84
push eax
call edi
add esp, 0x10
lea eax, [ebp - 0x644]
push eax
call fcn.0100ba35
test eax, eax
je 0x1010903
mov dword [0x1031414], 1
push 0x10147f4
mov eax, 0x10000
push 0x10149a4
push eax
mov dword [0x1014388], 0x64
mov dword [0x101438c], esi
mov dword [0x1014258], eax
mov dword [0x101425c], esi
call fcn.01003d25
test eax, eax
jne 0x1010941
push 0x3cc
jmp 0x1010b56
cmp dword [0x1014214], esi
jg 0x10109d2
jl 0x101095b
cmp dword [0x1014210], 0xff7
jae 0x10109d2
push 0x100
lea eax, [ebp - 0xca4]
push eax
push 0xbd
push esi
mov dword [ebp - 0x1190], 0x1014b6a
mov dword [ebp - 0x118c], esi
call fcn.0100b5c6
push eax
call dword [sym.imp.USER32.dll_LoadStringW]
lea eax, [ebp - 0x1190]
push eax
push 0x12c
lea eax, [ebp - 0xefc]
push eax
push esi
push esi
lea eax, [ebp - 0xca4]
push eax
push 0x2400
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
test eax, eax
jne 0x10109bf
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1010bce
push 5
lea eax, [ebp - 0xefc]
push eax
call fcn.0100fc1f
jmp 0x1010bce
lea eax, [ebp - 0x11a8]
push eax
push 0x101480c
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
jne 0x10109f2
push 0x3e6
jmp 0x1010b56
xor eax, eax
mov ax, word [0x10149d4]
push 0x10313e4
push 0x10313e0
push eax
call fcn.0100eaf4
test eax, eax
jne 0x1010a18
push 0x3e9
jmp 0x1010b56
call fcn.0100690a
test al, al
jne 0x1010a2b
push 0x3eb
jmp 0x1010b56
cmp dword [0x1014850], 3
jne 0x1010a4e
cmp word [0x1014998], si
je 0x1010a4e
push esi
call fcn.0100b5c6
push eax
push 0x276
jmp 0x1010ba1
push esi
push 0x10149a0
push esi
push 8
push dword [0x10141ec]
push dword [0x10141e8]
call fcn.010126b0
add eax, 0x18
push eax
call fcn.01003d25
test eax, eax
jne 0x1010a7f
push 0x3f8
jmp 0x1010b56
call fcn.01008feb
test eax, eax
jne 0x1010a92
push 0x3fb
jmp 0x1010b56
push esi
push dword [0x10141d8]
xor ebx, ebx
inc ebx
push ebx
push dword [0x10313dc]
call dword [sym.imp.USER32.dll_SetTimer]
test eax, eax
jne 0x1010ab7
push 0x3ff
jmp 0x1010b56
push 0x19
pop ecx
xor eax, eax
mov word [ebp - 0x1188], si
push 9
lea edi, [ebp - 0x1186]
rep stosd dword es:[edi], eax
pop ecx
lea edi, [ebp - 0x1122]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x1188]
push 0x10149d6
push eax
mov dword [0x10141dc], esi
mov dword [0x1014854], ebx
call dword [sym.imp.msvcrt.dll_wcscpy]
mov eax, dword [0x10140d0]
mov dword [ebp - 0x1100], eax
mov eax, dword [0x1014850]
cmp eax, ebx
pop ecx
pop ecx
jne 0x1010b13
push 0x10023c8
jmp 0x1010b1d
cmp eax, 3
jne 0x1010b2a
push 0x10023bc
lea eax, [ebp - 0x1122]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push dword [0x1031430]
lea eax, [ebp - 0x1188]
push 0x8c
push eax
push 0x200d
call fcn.010046b3
mov eax, dword [0x10140d0]
dec eax
je 0x1010b6f
dec eax
je 0x1010b67
push 0x42d
push 0x1002ee8
push 0x1002e88
call fcn.01005dcd
jmp 0x1010bce
push esi
push 0x1fa5
jmp 0x1010b75
push esi
push 0x1fa4
push 0x111
push dword [0x10313dc]
call dword [sym.imp.USER32.dll_PostMessageW]
mov eax, ebx
jmp 0x1010bd0
push esi
call fcn.0100b5c6
push eax
push 1
jmp 0x1010ba1
push esi
call fcn.0100b5c6
push eax
push 0x251
lea ecx, [ebp - 0x1190]
call fcn.01005da4
push 5
push dword [ebp - 0x118c]
call fcn.0100fc1f
lea ecx, [ebp - 0x1190]
mov dword [ebp - 0x1190], 0x100195c
call fcn.01005ab1
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.01012308
leave
ret 4