Function at 0x10002cc0
Capabilities:
Get common file path
Get program files directory

Disassembly:
sub esp, 0x62c
mov eax, dword [0x100cc8ec]
xor eax, esp
mov dword [esp + 0x628], eax
mov eax, dword [esp + 0x634]
push ebx
push ebp
push esi
push edi
xor ebx, ebx
push 0x103
mov ebp, ecx
lea ecx, [esp + 0x25]
push ebx
push ecx
mov dword [esp + 0x28], eax
mov dword [esp + 0x1c], ebx
mov byte [esp + 0x2c], bl
call sub.MSVCR80.dll_memset
push 0x103
xor eax, eax
lea edx, [esp + 0x135]
push ebx
push edx
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov byte [esp + 0x13c], bl
call sub.MSVCR80.dll_memset
push 0x103
lea eax, [esp + 0x349]
push ebx
push eax
mov byte [esp + 0x350], bl
call sub.MSVCR80.dll_memset
push 0x103
lea ecx, [esp + 0x251]
push ebx
push ecx
mov byte [esp + 0x258], bl
call sub.MSVCR80.dll_memset
push 0x103
lea edx, [esp + 0x569]
push ebx
push edx
mov byte [esp + 0x570], bl
call sub.MSVCR80.dll_memset
push 0x103
lea eax, [esp + 0x471]
push ebx
push eax
mov byte [esp + 0x478], bl
call sub.MSVCR80.dll_memset
add esp, 0x48
push 0x104
lea ecx, [esp + 0x128]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x10002eb4
lea edx, [esp + 0x124]
push str.AnySign4PC.exe
push edx
call dword [sym.imp.MSVCR80.dll_strstr]
add esp, 8
test eax, eax
je 0x10002eb4
push 0x104
lea eax, [esp + 0x434]
push eax
push 0x104
lea ecx, [esp + 0x540]
push ecx
push 0x104
lea edx, [esp + 0x23c]
push edx
push 0x104
lea eax, [esp + 0x348]
push eax
lea ecx, [esp + 0x144]
push ecx
call dword [sym.imp.MSVCR80.dll__splitpath_s]
lea eax, [esp + 0x350]
add esp, 0x24
mov edx, eax
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x10002e16
lea edi, [esp + 0x20]
sub eax, edx
add edi, 0xffffffff
mov cl, byte [edi + 1]
add edi, 1
cmp cl, bl
jne 0x10002e28
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [esp + 0x228]
rep movsb byte es:[edi], byte [esi]
mov ecx, eax
jmp 0x10002e50
mov dl, byte [eax]
add eax, 1
cmp dl, bl
jne 0x10002e50
lea edi, [esp + 0x20]
sub eax, ecx
mov esi, ecx
add edi, 0xffffffff
mov cl, byte [edi + 1]
add edi, 1
cmp cl, bl
jne 0x10002e64
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [esp + 0x20]
rep movsb byte es:[edi], byte [esi]
add eax, 0xffffffff
mov cl, byte [eax + 1]
add eax, 1
cmp cl, bl
jne 0x10002e83
mov edx, dword [str.integrity.dat]
mov ecx, dword [0x1009ec70]
mov dword [eax], edx
mov edx, dword [0x1009ec74]
mov dword [eax + 4], ecx
mov cx, word [0x1009ec78]
mov dword [eax + 8], edx
mov word [eax + 0xc], cx
jmp 0x10002ee9
push ebx
push 0x26
lea edx, [esp + 0x28]
push edx
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea edi, [esp + 0x20]
add edi, 0xffffffff
lea ebx, [ebx]
mov al, byte [edi + 1]
add edi, 1
cmp al, bl
jne 0x10002ed0
mov ecx, 0xb
mov esi, str.SoftForumXecureWebAnySigndllintegrity.dat
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x18]
push ecx
call sub.XecureAcIO.dll_XFA_File_ReadBin
mov esi, eax
add esp, 8
cmp esi, ebx
je 0x10002f12
mov ecx, dword [ebp + 0x38]
mov edx, dword [ecx]
mov eax, dword [edx + 0xc]
push 0x1312d08
call eax
jmp 0x10002f3e
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x18]
push edx
call sub.XecureAcCodec.dll_XFA_BinToStr
mov ecx, dword [ebp + 0x2c]
mov eax, dword [ecx]
mov edx, dword [esp + 0x18]
mov eax, dword [eax + 0x148]
add esp, 8
push ebx
push ebx
push edx
call eax
mov ecx, dword [esp + 0x1c]
mov dword [ecx], eax
cmp dword [esp + 0x14], ebx
je 0x10002f51
lea edx, [esp + 0x14]
push edx
call sub.XecureAcIO.dll_XFA_BIN_Reset
add esp, 4
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x10002f62
push eax
call sub.XecureAcIO.dll_XFA_free
add esp, 4
mov ecx, dword [esp + 0x638]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10090524
add esp, 0x62c
ret 8