Function at 0x1015255
Capabilities:
Get common file path
Get hostname

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x1578
call fcn.010181a0
mov eax, dword [0x101ac60]
push ebx
push esi
push edi
lea ecx, [ebp - 0x194]
push ecx
lea ecx, [ebp - 0x25c]
push ecx
lea ecx, [ebp - 0x324]
push ecx
lea ecx, [ebp - 0xcc]
push ecx
lea ecx, [ebp - 0x3ec]
xor ebx, ebx
push ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push 0x1004814
push eax
mov dword [ebp - 0x1504], eax
mov dword [ebp - 0x1528], 0x10
mov dword [ebp - 0x150c], ebx
mov dword [ebp - 0x1518], 0x208
mov word [ebp - 0x3ec], bx
mov word [ebp - 0xcc], bx
mov word [ebp - 0x324], bx
mov word [ebp - 0x25c], bx
mov word [ebp - 0x194], bx
call dword [sym.imp.msvcrt.dll_swscanf]
mov edi, dword [sym.imp.msvcrt.dll_wcslen]
lea eax, [ebp - 0xcc]
push eax
call edi
mov esi, dword [sym.imp.msvcrt.dll_swprintf]
add esp, 0x20
cmp eax, 2
jne 0x1015378
cmp word [ebp - 0xca], 0x3a
jne 0x1015378
movzx eax, word [ebp - 0xcc]
push eax
push 0x1002b6c
push 0x101a9ce
call esi
mov ax, word [ebp - 0xcc]
add esp, 0xc
mov word [0x101a9cc], ax
call fcn.0100c985
test eax, eax
jne 0x1015344
push 0x5de
jmp 0x1015c95
xor eax, eax
mov ax, word [0x101a9cc]
push 0x101ab62
push 0x101aa9a
push eax
call fcn.0100a405
movzx eax, word [ebp - 0xcc]
push eax
push 0x100480c
push 0x101aa34
call esi
add esp, 0xc
jmp 0x1015531
lea eax, [ebp - 0xcc]
push eax
call edi
cmp eax, 7
pop ecx
jne 0x10153f0
cmp word [ebp - 0xc8], 0x2e
jne 0x10153f0
lea eax, [ebp - 0xcc]
push eax
push 0x101a9ce
call dword [sym.imp.msvcrt.dll_wcscpy]
mov ax, word [ebp - 0xc4]
pop ecx
pop ecx
mov word [0x101a9da], bx
mov word [0x101a9cc], ax
call fcn.0100c985
test eax, eax
jne 0x10153cc
push 0x5ea
jmp 0x1015c95
xor eax, eax
mov ax, word [0x101a9cc]
push 0x101ab62
push 0x101aa9a
push eax
call fcn.0100a405
movzx eax, word [ebp - 0xc4]
jmp 0x1015363
lea eax, [ebp - 0xcc]
push eax
call edi
cmp eax, 0x31
pop ecx
jne 0x1015d1e
cmp word [ebp - 0xc8], 0x3f
jne 0x1015d1e
lea eax, [ebp - 0xcc]
push eax
mov esi, 0x101a9ce
push esi
call dword [sym.imp.msvcrt.dll_wcscpy]
pop ecx
pop ecx
mov word [0x101aa2e], bx
call fcn.0100c985
test eax, eax
jne 0x1015440
push 0x5f8
jmp 0x1015c95
push 0xa
lea eax, [ebp - 0x1578]
pop ecx
mov dword [eax], 0x100197c
mov dword [eax + 4], ebx
add eax, 8
dec ecx
jne 0x1015449
push 0x101a9cc
push esi
mov dword [ebp - 0x151c], ebx
call fcn.0100a295
test eax, eax
jne 0x1015481
lea eax, [ebp - 0x151c]
push eax
lea eax, [ebp - 0x1578]
push eax
push esi
call fcn.0100ad22
push 0x101ab62
push dword [ebp - 0x151c]
lea eax, [ebp - 0x1578]
push eax
xor eax, eax
mov ax, word [0x101a9cc]
push 0x101aa9a
push eax
call fcn.0100a316
push esi
mov dword [ebp - 0x1510], ebx
mov dword [ebp - 0x1514], ebx
call edi
test eax, eax
pop ecx
jbe 0x101550e
mov eax, dword [ebp - 0x1510]
movzx eax, word [eax*2 + 0x101a9ce]
push 0x80
push eax
call dword [sym.imp.msvcrt.dll_iswctype]
test eax, eax
pop ecx
pop ecx
je 0x10154fc
mov eax, dword [ebp - 0x1510]
mov ecx, dword [ebp - 0x1514]
mov ax, word [eax*2 + 0x101a9ce]
inc dword [ebp - 0x1514]
mov word [ecx*2 + 0x101aa34], ax
inc dword [ebp - 0x1510]
push esi
call edi
cmp dword [ebp - 0x1510], eax
pop ecx
jb 0x10154ba
mov eax, dword [ebp - 0x1514]
push 0x10071b7
push 0xa
mov word [eax*2 + 0x101aa34], bx
push 8
lea eax, [ebp - 0x1578]
push eax
call fcn.01005d54
cmp dword [0x101a848], 2
je 0x101554b
push ebx
call fcn.0100adb1
push eax
push 0x1a9
jmp 0x1015d2a
push dword [0x101a20c]
push dword [0x101a208]
push dword [0x101a1f4]
push dword [0x101a1f0]
call fcn.01017fa0
cmp edx, 1
jg 0x101557f
jl 0x1015573
cmp eax, ebx
ja 0x101557f
mov dword [0x101a1d8], 0x7d0
jmp 0x10155b7
cmp edx, 5
jg 0x1015596
jl 0x101558a
cmp eax, ebx
ja 0x1015596
mov dword [0x101a1d8], 0xfa0
jmp 0x10155b7
cmp edx, 0x19
jg 0x10155ad
jl 0x10155a1
cmp eax, ebx
ja 0x10155ad
mov dword [0x101a1d8], 0x1f40
jmp 0x10155b7
mov dword [0x101a1d8], 0x7d00
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push 0x10047fc
lea eax, [ebp - 0x324]
push eax
call esi
test eax, eax
jne 0x10155db
mov dword [0x101a0d0], 1
jmp 0x10155fb
push 0x10047ec
lea eax, [ebp - 0x324]
push eax
call esi
test eax, eax
jne 0x1015cdd
mov dword [0x101a0d0], 2
lea eax, [ebp - 0x25c]
push eax
call edi
test eax, eax
pop ecx
je 0x1015676
mov esi, dword [sym.imp.msvcrt.dll__wcsicmp]
lea eax, [ebp - 0x25c]
push eax
push 0x10047dc
call esi
test eax, eax
pop ecx
pop ecx
jne 0x1015670
lea eax, [ebp - 0x194]
push eax
mov dword [0x1025810], 1
call edi
test eax, eax
pop ecx
je 0x1015676
lea eax, [ebp - 0x194]
push eax
push 0x10047d0
call esi
neg eax
sbb eax, eax
inc eax
mov dword [0x1025818], eax
lea eax, [ebp - 0x194]
push eax
push 0x10047c4
call esi
add esp, 0x10
neg eax
sbb eax, eax
inc eax
mov dword [0x1025814], eax
jmp 0x1015676
mov dword [0x1025810], ebx
cmp dword [0x1025810], ebx
je 0x10156c1
mov edi, 0x1004788
push edi
push 1
push 0x1f0003
call dword [sym.imp.KERNEL32.dll_OpenEventW]
cmp eax, ebx
mov dword [0x1025800], eax
jne 0x10156c1
call fcn.0100b23e
test eax, eax
je 0x10156c1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push 0x1004764
push 1
push 0x66a
push 0x4e
call fcn.0100b327
add esp, 0x18
lea eax, [ebp - 0x1524]
push eax
push 5
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
lea eax, [ebp - 0xaa4]
push eax
push dword [ebp - 0x1524]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
lea eax, [ebp - 0xaa4]
push eax
lea eax, [ebp - 0x644]
push eax
call dword [sym.imp.msvcrt.dll_wcscpy]
mov edi, dword [sym.imp.msvcrt.dll_wcscat]
lea eax, [ebp - 0x644]
push 0x1004744
push eax
call edi
push 0x101ab62
lea eax, [ebp - 0x108c]
push 0x1004718
push eax
call dword [sym.imp.msvcrt.dll_swprintf]
add esp, 0x1c
lea eax, [ebp - 0x1518]
push eax
lea eax, [ebp - 0x84c]
push eax
push 0x1004700
mov esi, 0x1001680
push esi
lea eax, [ebp - 0x150c]
push eax
mov dword [ebp - 0x1518], 0x208
call fcn.0100ae6d
test eax, eax
jne 0x1015776
push dword [ebp - 0x150c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x150c], ebx
lea eax, [ebp - 0x84c]
jmp 0x10157f9
lea eax, [ebp - 0x1518]
push eax
lea eax, [ebp - 0x84c]
push eax
push 0x10046e4
push esi
lea eax, [ebp - 0x150c]
push eax
mov dword [ebp - 0x1518], 0x208
call fcn.0100ae6d
test eax, eax
jne 0x101580e
push dword [ebp - 0x150c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x84c]
push 0x10046e0
push eax
mov dword [ebp - 0x150c], ebx
call dword [sym.imp.msvcrt.dll_wcscmp]
test eax, eax
pop ecx
pop ecx
jne 0x101580e
lea eax, [ebp - 0xaa4]
push eax
lea eax, [ebp - 0x644]
push eax
call dword [sym.imp.msvcrt.dll_wcscpy]
lea eax, [ebp - 0x644]
push 0x10046b8
push eax
call edi
add esp, 0x10
lea eax, [ebp - 0x644]
push eax
call fcn.0100b181
test eax, eax
je 0x101580e
xor edi, edi
inc edi
mov dword [0x102580c], edi
jmp 0x1015811
xor edi, edi
inc edi
call fcn.0100b23e
test eax, eax
mov esi, 0x1004680
je 0x1015831
push esi
push 2
push 0x6b3
push 0x4e
call fcn.0100b327
add esp, 0x10
call fcn.0100b23e
test eax, eax
je 0x1015856
push dword [ebp - 0x1504]
push 0x1004650
push 2
push 0x6b4
push 0x4e
call fcn.0100b327
add esp, 0x14
call fcn.0100b23e
test eax, eax
je 0x1015871
push esi
push 2
push 0x6b5
push 0x4e
call fcn.0100b327
add esp, 0x10
mov dword [0x101a380], 0x64
mov dword [0x101a384], ebx
call fcn.0100a23b
test eax, eax
je 0x1015922
lea eax, [ebp - 0x1508]
push eax
mov esi, 0x1f4
push esi
lea eax, [ebp - 0xe8c]
push eax
push ebx
push ebx
push ebx
mov dword [0x102581c], edi
mov dword [ebp - 0x1508], 0x101ab62
mov dword [ebp - 0x1504], ebx
call fcn.0100adb1
push eax
push 0x27f
push esi
lea eax, [ebp - 0x1474]
push eax
call fcn.0100aff0
push eax
push 0x2400
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
test eax, eax
push 6
jne 0x10158e8
push ebx
jmp 0x10158ef
lea eax, [ebp - 0xe8c]
push eax
call fcn.0101355d
mov eax, dword [0x1025800]
cmp eax, ebx
je 0x1015904
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
push ebx
push 0x1fa9
push 0x111
push dword [0x10257dc]
call dword [sym.imp.USER32.dll_PostMessageW]
mov eax, edi
jmp 0x1015d59
mov eax, dword [0x101a1e8]
mov ecx, dword [0x101a2c8]
push 0x101a7f8
push 0x101a9ac
add ecx, eax
push ecx
call fcn.01005205
test eax, eax
jne 0x101594d
push 0x6e0
jmp 0x1015c95
push 0x101a7ec
mov eax, 0x10000
push 0x101a99c
push eax
mov dword [0x101a250], eax
mov dword [0x101a254], ebx
call fcn.01005205
test eax, eax
jne 0x101597b
push 0x6e4
jmp 0x1015c95
mov eax, dword [0x101a1e8]
push 0x101a7f0
push 0x101a9a0
add eax, 0x10000
push eax
call fcn.01005205
test eax, eax
jne 0x10159a3
push 0x6e7
jmp 0x1015c95
mov edx, dword [0x101a1e8]
mov ecx, dword [0x101a1ec]
mov esi, dword [0x101a7f0]
mov eax, edx
sub eax, edi
sbb ecx, ebx
xor edi, edi
and eax, esi
and ecx, edi
or eax, ecx
je 0x10159d3
lea eax, [edx - 1]
not eax
and eax, esi
add eax, edx
mov dword [0x101a7f0], eax
call fcn.010123b4
test eax, eax
jne 0x10159e6
push 0x6f4
jmp 0x1015c95
call fcn.0100ef07
test eax, eax
jne 0x10159f9
push 0x6f7
jmp 0x1015c95
mov eax, dword [0x101a290]
mov dword [0x101a3a0], eax
mov eax, dword [0x101a294]
mov dword [0x101a3a4], eax
mov eax, dword [0x101a3a8]
push 0x101a7f4
push 0x101a9a8
shl eax, 4
push eax
call fcn.01005205
test eax, eax
jne 0x1015a33
push 0x6fc
jmp 0x1015c95
mov ecx, dword [0x101a3a8]
mov esi, dword [0x101a7ec]
mov edi, dword [0x101a7f4]
shl ecx, 4
mov eax, ecx
shr ecx, 2
add esi, 0x28
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push dword [0x101a9a4]
call dword [sym.imp.KERNEL32.dll_GlobalLock]
cmp eax, ebx
jne 0x1015a73
push 0x701
jmp 0x1015c95
push 3
pop esi
push dword [0x101a7f8]
mov dword [0x101a260], esi
push dword [0x101a7f0]
mov dword [0x101a264], ebx
push eax
push dword [0x101a7f4]
push 0x101a260
call fcn.01014e08
test eax, eax
jne 0x1015ab4
push dword [0x101a9a4]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
jmp 0x1015d57
cmp dword [0x101a260], esi
jne 0x1015ac4
cmp dword [0x101a264], ebx
je 0x1015ace
push 0x707
jmp 0x1015c95
push dword [0x101a2c8]
lea eax, [ebp - 0x1520]
push eax
push dword [0x101a7f8]
push 0x70
call fcn.0100d1cc
test eax, eax
jne 0x1015af6
push 0x70a
jmp 0x1015c95
push dword [0x101a9a4]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov ecx, dword [ebp - 0x1520]
movzx eax, word [ecx + 0x14]
add eax, ecx
mov al, byte [eax + 8]
cmp al, 3
ja 0x1015ccf
cmp al, 1
jb 0x1015ccf
lea eax, [ebp - 0x1528]
push eax
push 0x101a804
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
jne 0x1015b41
push 0x71a
jmp 0x1015c95
xor eax, eax
mov ax, word [0x101a9cc]
push 0x10257e4
push 0x10257e0
push eax
call fcn.0101258c
test eax, eax
jne 0x1015b67
push 0x71e
jmp 0x1015c95
mov eax, dword [0x101a1e0]
mov ecx, dword [0x101a1e4]
mov edx, eax
or edx, ecx
jne 0x1015b82
push 0x722
jmp 0x1015c95
push ebx
push 0x101a998
push ebx
push 8
push ecx
push eax
call fcn.01018000
mov ecx, dword [0x101a1e8]
lea eax, [eax + ecx + 0x19]
push eax
call fcn.01005205
test eax, eax
jne 0x1015bb0
push 0x725
jmp 0x1015c95
call fcn.010088ba
test eax, eax
jne 0x1015bc3
push 0x728
jmp 0x1015c95
push ebx
push dword [0x101a1d8]
xor esi, esi
inc esi
push esi
push dword [0x10257dc]
call dword [sym.imp.USER32.dll_SetTimer]
test eax, eax
jne 0x1015be8
push 0x72b
jmp 0x1015c95
push 0x19
pop ecx
xor eax, eax
mov word [ebp - 0x1500], bx
push 9
lea edi, [ebp - 0x14fe]
rep stosd dword es:[edi], eax
pop ecx
lea edi, [ebp - 0x149a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov edi, dword [sym.imp.msvcrt.dll_wcscpy]
lea eax, [ebp - 0x1500]
push 0x101a9ce
push eax
mov dword [0x101a1dc], ebx
mov dword [0x101a84c], esi
call edi
mov eax, dword [0x101a0d0]
mov dword [ebp - 0x1478], eax
lea eax, [ebp - 0x149a]
push 0x1002120
push eax
call edi
add esp, 0x10
push dword [0x1025820]
lea eax, [ebp - 0x1500]
push 0x8c
push eax
push 0x200d
call fcn.01005c52
call fcn.0100b23e
test eax, eax
je 0x1015c85
push 0x101ab62
push 0x1004620
push 2
push 0x741
push 0x4e
call fcn.0100b327
add esp, 0x14
mov eax, dword [0x101a0d0]
dec eax
je 0x1015cb1
dec eax
je 0x1015ca9
push 0x74d
push 0x100372c
push 0x10036c8
call fcn.01007320
jmp 0x1015d57
push ebx
push 0x1fa5
jmp 0x1015cb7
push ebx
push 0x1fa4
push 0x111
push dword [0x10257dc]
call dword [sym.imp.USER32.dll_PostMessageW]
mov eax, esi
jmp 0x1015d59
push ebx
call fcn.0100adb1
push eax
push 0x277
jmp 0x1015d2a
push ebx
call fcn.0100adb1
push eax
push 1
lea ecx, [ebp - 0x1508]
call fcn.010072f7
push 5
push dword [ebp - 0x1504]
call fcn.0101355d
call fcn.0100b23e
test eax, eax
je 0x1015d42
push 0x10045f4
push ebx
push 0x643
push 0x4e
call fcn.0100b327
add esp, 0x10
jmp 0x1015d42
push ebx
call fcn.0100adb1
push eax
push 0x251
lea ecx, [ebp - 0x1508]
call fcn.010072f7
push 5
push dword [ebp - 0x1504]
call fcn.0101355d
lea ecx, [ebp - 0x1508]
mov dword [ebp - 0x1508], 0x100197c
call fcn.0100709f
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.01017c5b
leave
ret 4