Function at 0x100ab3ee
Capabilities:
Check mutex on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c0120
mov eax, dword fs:[0]
push eax
sub esp, 0x284
mov eax, dword [0x100ed3e0]
xor eax, ebp
mov dword [ebp - 0x20], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x26c], ecx
call fcn.100b1636
test eax, eax
je 0x100ab42f
xor eax, eax
jmp 0x100ab8d9
lea ecx, [ebp - 0x14]
call fcn.1001e317
and dword [ebp - 4], 0
mov ecx, dword [ebp - 0x26c]
add ecx, 0x44
call fcn.10010b64
mov dword [ebp - 0x270], eax
push 0x100cda8a
lea ecx, [ebp - 0x14]
call fcn.100131ac
push eax
push str.ShellExtPath
push dword [ebp - 0x270]
mov eax, dword [ebp - 0x270]
mov eax, dword [eax]
call dword [eax + 0x14]
push 0x100d2698
lea ecx, [ebp - 0x14]
call fcn.1003e8ce
movzx eax, al
test eax, eax
je 0x100ab50e
mov ecx, dword [ebp - 0x26c]
add ecx, 0x44
call fcn.10010b64
mov dword [ebp - 0x274], eax
push 0
push 0x100d269c
push dword [ebp - 0x274]
mov eax, dword [ebp - 0x274]
mov eax, dword [eax]
call dword [eax + 0x18]
push eax
lea ecx, [ebp - 0x14]
call fcn.10010b64
push eax
lea eax, [ebp - 0x23c]
push eax
call fcn.100b2189
add esp, 0xc
mov dword [ebp - 0x278], eax
mov eax, dword [ebp - 0x278]
mov dword [ebp - 0x27c], eax
mov byte [ebp - 4], 1
push dword [ebp - 0x27c]
mov ecx, dword [ebp - 0x26c]
add ecx, 0x74
call fcn.10003cf8
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x23c]
call fcn.100106f6
jmp 0x100ab635
lea ecx, [ebp - 0x238]
call fcn.1001e317
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x26c]
add ecx, 0x44
call fcn.10010b64
mov dword [ebp - 0x280], eax
push str.qmshNo.dll
lea ecx, [ebp - 0x238]
call fcn.100131ac
push eax
push str.ShellExtName
push dword [ebp - 0x280]
mov eax, dword [ebp - 0x280]
mov eax, dword [eax]
call dword [eax + 0x14]
push str.suiji
lea ecx, [ebp - 0x238]
call fcn.1003e89c
movzx eax, al
test eax, eax
je 0x100ab5c8
lea eax, [ebp - 0x240]
push eax
call fcn.100b2488
pop ecx
mov dword [ebp - 0x284], eax
mov eax, dword [ebp - 0x284]
mov dword [ebp - 0x288], eax
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x288]
call fcn.10010b64
push eax
lea ecx, [ebp - 0x238]
call fcn.10034d8d
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x240]
call fcn.100106f6
push 0x100d26d0
lea ecx, [ebp - 0x238]
call fcn.1003e719
and word [ebp - 0x234], 0
push 0x208
push 0
lea eax, [ebp - 0x232]
push eax
call fcn.10071b20
add esp, 0xc
lea eax, [ebp - 0x234]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea ecx, [ebp - 0x238]
call fcn.10010b64
push eax
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x234]
push eax
mov ecx, dword [ebp - 0x26c]
add ecx, 0x74
call fcn.10003d11
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x238]
call fcn.1000aa65
push 0
push 0x100d26dc
mov ecx, dword [ebp - 0x26c]
add ecx, 0x74
call fcn.10010b64
push eax
push 0xdf
push dword [0x10109268]
call fcn.100a51ed
add esp, 0x14
test eax, eax
jne 0x100ab6ba
push 0x8c
mov ecx, dword [ebp - 0x26c]
call fcn.100a1d70
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x244], esp
push 0x100cda8b
call fcn.1000142c
push 0
push 0x3e8
push 0
push 0x19
mov ecx, 0x10109348
call fcn.100b389f
and dword [ebp - 0x248], 0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.1000aa65
mov eax, dword [ebp - 0x248]
jmp 0x100ab8d9
mov ecx, dword [ebp - 0x26c]
add ecx, 0x74
call fcn.10010b64
push eax
call fcn.100a2e2b
pop ecx
test eax, eax
jne 0x100ab72b
push 0x8c
mov ecx, dword [ebp - 0x26c]
call fcn.100a1d70
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x24c], esp
push 0x100cda9a
call fcn.1000142c
push 0
push 0x3e8
push 0
push 0x1a
mov ecx, 0x10109348
call fcn.100b389f
and dword [ebp - 0x250], 0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.1000aa65
mov eax, dword [ebp - 0x250]
jmp 0x100ab8d9
mov ecx, dword [ebp - 0x26c]
add ecx, 0x74
call fcn.10010b64
push eax
call fcn.100a286a
pop ecx
mov ecx, dword [ebp - 0x26c]
add ecx, 0x74
call fcn.10010b64
push eax
call fcn.1003873d
mov ecx, eax
call fcn.10037bfd
push dword [ebp + 8]
lea eax, [ebp - 0x258]
push eax
mov ecx, dword [ebp - 0x26c]
call fcn.100a720e
mov dword [ebp - 0x28c], eax
mov eax, dword [ebp - 0x28c]
mov dword [ebp - 0x290], eax
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x290]
call fcn.10010b64
push eax
call fcn.100a4796
pop ecx
neg eax
sbb eax, eax
inc eax
mov byte [ebp - 0x251], al
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x258]
call fcn.100106f6
movzx eax, byte [ebp - 0x251]
test eax, eax
je 0x100ab815
push 0x8e
mov ecx, dword [ebp - 0x26c]
call fcn.100a1d70
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x25c], esp
push 0x100cda9b
call fcn.1000142c
push 0
push 0x3e8
push 0
push 0x1c
mov ecx, 0x10109348
call fcn.100b389f
and dword [ebp - 0x260], 0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.1000aa65
mov eax, dword [ebp - 0x260]
jmp 0x100ab8d9
mov dword [ebp - 0x18], 0x8f
push str.Global4B6605C2_1188_5E22_6525_F7A4B4B7C6C3
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [ebp - 0x10], eax
push str.Global98BB2AB4_DF77_40f7_A306_1BA0C3022726
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push eax
lea ecx, [ebp - 0x1c]
call fcn.1002102a
mov byte [ebp - 4], 5
push 0x3a98
lea ecx, [ebp - 0x1c]
call fcn.10010b64
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x100ab868
and dword [ebp - 0x18], 0
cmp dword [ebp - 0x10], 0
je 0x100ab87b
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [ebp - 0x10], 0
cmp dword [ebp - 0x18], 0
je 0x100ab8ac
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x264], esp
push 0x100cdaae
call fcn.1000142c
push 0
push 0x3e8
push 0
push dword [ebp - 0x18]
mov ecx, 0x10109348
call fcn.100b389f
xor eax, eax
cmp dword [ebp - 0x18], 0
sete al
mov dword [ebp - 0x268], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1c]
call fcn.100213e6
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.1000aa65
mov eax, dword [ebp - 0x268]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x20]
xor ecx, ebp
call fcn.10071b0a
leave
ret 4