Function at 0x1002a933
Capabilities:
Create directory
Enumerate gui resources
Get common file path

Disassembly:
sub esp, 0xb94
mov eax, dword [0x1024bd20]
xor eax, esp
mov dword [esp + 0xb90], eax
mov eax, dword [section..data]
cmp eax, section..data
je 0x1002a968
push 0x101d4a68
push 0x4b
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.1002114e
add esp, 0x10
push ebx
push ebp
push esi
push edi
call fcn.10158e10
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
test eax, eax
je 0x1002a98e
push str.sidebar.exe
call fcn.10026320
mov dword [esp], 0xbb8
call edi
push 0xa
xor bl, bl
xor bh, bh
call fcn.10028633
pop ecx
cmp word [eax], 0x31
je 0x1002abab
or dword [esp + 0x34], 0xffffffff
xor ebp, ebp
push 0xf
pop eax
mov word [esp + 0x28], ax
xor eax, eax
inc eax
mov dword [esp + 0x2c], ebp
push 0x21
push 0x42
mov dword [esp + 0x38], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], ebp
mov dword [esp + 0x2c], ebp
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
jne 0x1002a9f1
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x1002abab
push 0x101d4748
mov dword [eax], 0x14
mov dword [eax + 4], ebp
mov dword [eax + 8], ebp
mov dword [eax + 0x10], ebp
add eax, 0x14
push 0xd
push eax
call fcn.1017c44b
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
lea eax, [esp + 0x14]
mov dword [esp + 0x20], esi
push eax
push 1
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x34]
push eax
call fcn.1002624d
add esp, 0x10
test eax, eax
jne 0x1002ab3c
push 0x101d4858
lea ecx, [esp + 0x58]
call fcn.1000f0e0
push str..gadget_shellopenDropTarget
lea ecx, [esp + 0x70]
call fcn.1000f0e0
lea eax, [esp + 0x54]
push eax
lea eax, [esp + 0x70]
push eax
lea eax, [esp + 0x44]
push connect
push eax
call fcn.1002a6db
add esp, 0x10
lea ecx, [esp + 0x6c]
push ebp
push 1
call fcn.1000ee50
push ebp
push 1
lea ecx, [esp + 0x5c]
call fcn.1000ee50
cmp dword [esp + 0x4c], ebp
jne 0x1002aaae
mov ebp, str.6B9228DA_9C15_419e_856C_19E768A13BDC
push ebp
call fcn.1000f0b0
pop ecx
push eax
push ebp
lea ecx, [esp + 0x44]
call fcn.1000efb0
xor ebp, ebp
cmp dword [esp + 0x50], 8
lea ecx, [esp + 0x84]
lea eax, [esp + 0x3c]
cmovae eax, dword [esp + 0x3c]
push ecx
push eax
call dword [sym.imp.ole32.dll_CLSIDFromString]
test eax, eax
jne 0x1002ab2c
lea eax, [esp + 0x10]
push eax
push 0x1021de08
push 3
push ebp
lea eax, [esp + 0x94]
push eax
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jne 0x1002ab1e
mov eax, dword [esp + 0x10]
push eax
mov ecx, dword [eax]
call dword [ecx + 4]
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x18]
push edx
push ebp
push ebp
push ebp
push dword [esp + 0x24]
mov dword [esp + 0x2c], ebp
mov ecx, dword [eax]
push eax
call dword [ecx + 0x18]
mov eax, dword [esp + 0x10]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
jmp 0x1002ab20
mov bl, 1
mov eax, dword [esp + 0x14]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
jmp 0x1002ab2e
mov bl, 1
push ebp
push 1
lea ecx, [esp + 0x44]
call fcn.1000ee50
jmp 0x1002ab3e
mov bl, 1
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.ole32.dll_ReleaseStgMedium]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov esi, 0xc8
push ebp
push 0x1002a662
mov dword [0x10255db0], ebp
call dword [sym.imp.USER32.dll_EnumWindows]
test eax, eax
je 0x1002ab9c
cmp dword [0x10255db0], 0
je 0x1002ab94
mov bh, 1
call dword [sym.imp.USER32.dll_GetForegroundWindow]
cmp eax, dword [esp + 0xba8]
jne 0x1002ab91
push dword [0x10255db0]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
inc esi
jmp 0x1002ab98
test bh, bh
jne 0x1002aba3
push 0x64
call edi
dec esi
jne 0x1002ab55
test bh, bh
je 0x1002abab
test bl, bl
je 0x1002acc6
mov esi, 0x400
lea eax, [esp + 0x3a0]
push esi
push eax
call fcn.1017c9f0
push 0x101d4914
lea eax, [esp + 0x3ac]
push esi
push eax
call fcn.1017c18a
add esp, 0x14
lea eax, [esp + 0x98]
lea ecx, [esp + 0x94]
mov dword [esp + 0x94], eax
push 3
push 0x101d4748
call fcn.1002bbeb
push dword [esp + 0x94]
lea eax, [esp + 0x3a4]
push esi
push eax
call fcn.1017c18a
xor eax, eax
xor ebx, ebx
push 0x206
mov word [esp + 0x1a8], ax
lea eax, [esp + 0x1aa]
push ebx
push eax
call fcn.10179250
add esp, 0x18
lea eax, [esp + 0x198]
push eax
push ebx
push ebx
push 0x1c
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x1002aca9
lea eax, [esp + 0x198]
push eax
call fcn.1000f0b0
pop ecx
push eax
lea eax, [esp + 0x19c]
mov esi, 0x1024717c
push eax
mov ecx, esi
call fcn.1000efb0
mov edi, str.MicrosoftWindows_SidebarGadgetsDTPro.gadget_
push edi
call fcn.1000f0b0
pop ecx
push eax
push edi
mov ecx, esi
call fcn.100136d0
cmp dword [0x10247190], 8
cmovae esi, dword [0x1024717c]
push esi
call fcn.1017cb42
pop ecx
test eax, eax
jne 0x1002aca9
push ebx
push 0x1002a8b7
push ebx
lea eax, [esp + 0x3ac]
push eax
call dword [sym.imp.SETUPAPI.dll_SetupIterateCabinetW]
lea eax, [esp + 0x98]
cmp dword [esp + 0x94], eax
je 0x1002acc6
push dword [esp + 0x94]
call fcn.10178445
pop ecx
mov eax, dword [section..data]
pop edi
pop esi
pop ebp
pop ebx
cmp eax, section..data
je 0x1002aceb
push 0x101d4a68
push 0x4c
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.1002114e
add esp, 0x10
mov ecx, dword [esp + 0xb90]
xor ecx, esp
call fcn.1017868e
add esp, 0xb94
ret