Function at 0x101f3cb
Capabilities:
Get common file path
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x4d8
mov eax, dword [0x10372b8]
push ebx
mov ebx, dword [ebp + 0xc]
and dword [ebx], 0
push esi
push edi
mov edi, dword [ebp + 8]
push 0x3a
push edi
mov dword [ebp - 4], eax
mov dword [ebp - 0x4cc], ebx
call dword [sym.imp.msvcrt.dll_wcschr]
test eax, eax
mov esi, dword [sym.imp.msvcrt.dll_wcsrchr]
pop ecx
pop ecx
jne 0x101f4b4
mov ax, word [edi]
cmp ax, 0x5c
je 0x101f4b4
cmp ax, 0x2f
je 0x101f4b4
push 0x104
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x101f45a
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x101f449
call esi
jmp 0x101f769
call esi
and eax, 0xffff
or eax, 0x80070000
jmp 0x101f769
cmp eax, 3
jne 0x101f467
and word [ebp - 0x208], 0
lea eax, [ebp - 0x20c]
push 0x5c
push eax
call esi
test eax, eax
pop ecx
pop ecx
je 0x101f47c
and word [eax], 0
push edi
push 0x1002fa4
lea eax, [ebp - 0x20c]
push eax
push 0x1002f94
lea eax, [ebp - 0x494]
push 0x144
push eax
call fcn.0100d7d2
add esp, 0x18
test eax, eax
jl 0x101f50a
lea eax, [ebp - 0x494]
mov dword [ebp - 0x4c8], eax
jmp 0x101f4ba
mov dword [ebp - 0x4c8], edi
mov edi, dword [ebp - 0x4c8]
push 0x2e
push edi
mov dword [ebp - 0x4d0], 0x80004005
call esi
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x101f5e6
push 0x1002f88
push esi
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
jne 0x101f5e6
push esi
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
mov ecx, 0x104
sub ecx, eax
sub esi, edi
shl ecx, 1
sar esi, 1
cmp esi, ecx
jl 0x101f514
mov eax, 0x80070057
jmp 0x101f769
mov eax, dword [0x1037360]
cmp dword [eax + 0x1c], 1
jne 0x101f564
test edi, edi
jne 0x101f527
xor eax, eax
jmp 0x101f549
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea esi, [eax + eax + 2]
mov eax, esi
add eax, 3
and eax, 0xfffffffc
call fcn.01034ea0
mov eax, esp
push esi
push edi
push eax
call fcn.0102efe0
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
jmp 0x101f57d
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x101f5e0
push 0
lea eax, [ebp - 0x4d8]
push eax
push 4
lea eax, [ebp - 0x4d4]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x101f5cc
cmp dword [ebp - 0x4d8], 4
jne 0x101f5cc
cmp dword [ebp - 0x4d4], 0xabcdabc3
jne 0x101f5cc
and dword [ebp - 0x4d0], 0
mov esi, 0x100185c
lea edi, [ebp - 0x4c4]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x4d0], 0
jge 0x101f727
mov ebx, dword [ebp - 0x4cc]
xor esi, esi
lea eax, [ebp - 0x4c4]
push eax
push dword [ebp - 0x4c8]
call dword [sym.imp.ole32.dll_GetClassFile]
test eax, eax
jge 0x101f61d
cmp eax, 0x800401e6
jne 0x101f6f8
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
inc esi
cmp esi, 0xa
jb 0x101f5e8
jmp 0x101f710
push 4
pop ecx
lea edi, [ebp - 0x4a4]
lea esi, [ebp - 0x4c4]
xor edx, edx
mov dword [ebp - 0x4a4], 0xbb64df2f
mov word [ebp - 0x4a0], 0x88e4
mov word [ebp - 0x49e], 0x11d0
mov byte [ebp - 0x49c], 0x9e
mov byte [ebp - 0x49b], 0x87
mov byte [ebp - 0x49a], 0
mov byte [ebp - 0x499], 0xc0
mov byte [ebp - 0x498], 0x4f
mov byte [ebp - 0x497], 0xd7
mov byte [ebp - 0x496], 8
mov byte [ebp - 0x495], 0x1f
repe cmpsd dword [esi], dword es:[edi]
mov dword [ebp - 0x4b4], 0x1eaf7042
mov word [ebp - 0x4b0], 0x9f92
mov word [ebp - 0x4ae], 0x11d0
mov byte [ebp - 0x4ac], 0x89
mov byte [ebp - 0x4ab], 0xaa
mov byte [ebp - 0x4aa], 0
mov byte [ebp - 0x4a9], 0xa0
mov byte [ebp - 0x4a8], 0xc9
mov byte [ebp - 0x4a7], 5
mov byte [ebp - 0x4a6], 0x41
mov byte [ebp - 0x4a5], 0x29
jne 0x101f6e1
mov esi, 0x100182c
jmp 0x101f6ff
push 4
pop ecx
lea edi, [ebp - 0x4b4]
lea esi, [ebp - 0x4c4]
xor edx, edx
repe cmpsd dword [esi], dword es:[edi]
jne 0x101f709
jmp 0x101f6fa
xor eax, eax
mov esi, 0x100183c
lea edi, [ebp - 0x4c4]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
cmp eax, 0x800401e6
jne 0x101f721
mov esi, 0x100185c
lea edi, [ebp - 0x4c4]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
jmp 0x101f72d
test eax, eax
jge 0x101f72d
jmp 0x101f769
mov ebx, dword [ebp - 0x4cc]
push ebx
push 0x100180c
push 1
push 0
lea eax, [ebp - 0x4c4]
push eax
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x101f769
mov eax, dword [ebx]
push dword [ebp - 0x4c8]
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
mov esi, eax
test esi, esi
jge 0x101f767
mov eax, dword [ebx]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
and dword [ebx], 0
mov eax, esi
lea esp, [ebp - 0x4e4]
mov ecx, dword [ebp - 4]
call fcn.01034a90
pop edi
pop esi
pop ebx
leave
ret 8