Function at 0x100ab40a
Capabilities:
Check mutex on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c0108
mov eax, dword fs:[0]
push eax
sub esp, 0x284
mov eax, dword [0x100ed3e0]
xor eax, ebp
mov dword [ebp - 0x20], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x26c], ecx
call fcn.100b1652
test eax, eax
je 0x100ab44b
xor eax, eax
jmp 0x100ab8f5
lea ecx, [ebp - 0x14]
call fcn.1001e01d
and dword [ebp - 4], 0
mov ecx, dword [ebp - 0x26c]
add ecx, 0x44
call fcn.1000ba55
mov dword [ebp - 0x270], eax
push 0x100cda8a
lea ecx, [ebp - 0x14]
call fcn.10039cd5
push eax
push str.ShellExtPath
push dword [ebp - 0x270]
mov eax, dword [ebp - 0x270]
mov eax, dword [eax]
call dword [eax + 0x14]
push 0x100d2680
lea ecx, [ebp - 0x14]
call fcn.1003dc8d
movzx eax, al
test eax, eax
je 0x100ab52a
mov ecx, dword [ebp - 0x26c]
add ecx, 0x44
call fcn.1000ba55
mov dword [ebp - 0x274], eax
push 0
push 0x100d2684
push dword [ebp - 0x274]
mov eax, dword [ebp - 0x274]
mov eax, dword [eax]
call dword [eax + 0x18]
push eax
lea ecx, [ebp - 0x14]
call fcn.1000ba55
push eax
lea eax, [ebp - 0x23c]
push eax
call fcn.100b21a5
add esp, 0xc
mov dword [ebp - 0x278], eax
mov eax, dword [ebp - 0x278]
mov dword [ebp - 0x27c], eax
mov byte [ebp - 4], 1
push dword [ebp - 0x27c]
mov ecx, dword [ebp - 0x26c]
add ecx, 0x74
call fcn.10003bbe
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x23c]
call fcn.10010769
jmp 0x100ab651
lea ecx, [ebp - 0x238]
call fcn.1001e01d
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x26c]
add ecx, 0x44
call fcn.1000ba55
mov dword [ebp - 0x280], eax
push str.qmshNo.dll
lea ecx, [ebp - 0x238]
call fcn.10039cd5
push eax
push str.ShellExtName
push dword [ebp - 0x280]
mov eax, dword [ebp - 0x280]
mov eax, dword [eax]
call dword [eax + 0x14]
push str.suiji
lea ecx, [ebp - 0x238]
call fcn.1003dc5b
movzx eax, al
test eax, eax
je 0x100ab5e4
lea eax, [ebp - 0x240]
push eax
call fcn.100b24a4
pop ecx
mov dword [ebp - 0x284], eax
mov eax, dword [ebp - 0x284]
mov dword [ebp - 0x288], eax
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x288]
call fcn.1000ba55
push eax
lea ecx, [ebp - 0x238]
call fcn.10034f96
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x240]
call fcn.10010769
push str..dll
lea ecx, [ebp - 0x238]
call fcn.1003dad8
and word [ebp - 0x234], 0
push 0x208
push 0
lea eax, [ebp - 0x232]
push eax
call fcn.10071b30
add esp, 0xc
lea eax, [ebp - 0x234]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea ecx, [ebp - 0x238]
call fcn.1000ba55
push eax
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x234]
push eax
mov ecx, dword [ebp - 0x26c]
add ecx, 0x74
call fcn.10003bd7
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x238]
call fcn.1000aabd
push 0
push 0x100d26c4
mov ecx, dword [ebp - 0x26c]
add ecx, 0x74
call fcn.1000ba55
push eax
push 0xdf
push dword [0x10109260]
call fcn.100a51dd
add esp, 0x14
test eax, eax
jne 0x100ab6d6
push 0x8c
mov ecx, dword [ebp - 0x26c]
call fcn.100a1d60
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x244], esp
push 0x100cda8b
call fcn.10001405
push 0
push 0x3e8
push 0
push 0x19
mov ecx, 0x10109340
call fcn.100b38bb
and dword [ebp - 0x248], 0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.1000aabd
mov eax, dword [ebp - 0x248]
jmp 0x100ab8f5
mov ecx, dword [ebp - 0x26c]
add ecx, 0x74
call fcn.1000ba55
push eax
call fcn.100a2e1b
pop ecx
test eax, eax
jne 0x100ab747
push 0x8c
mov ecx, dword [ebp - 0x26c]
call fcn.100a1d60
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x24c], esp
push 0x100cda9a
call fcn.10001405
push 0
push 0x3e8
push 0
push 0x1a
mov ecx, 0x10109340
call fcn.100b38bb
and dword [ebp - 0x250], 0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.1000aabd
mov eax, dword [ebp - 0x250]
jmp 0x100ab8f5
mov ecx, dword [ebp - 0x26c]
add ecx, 0x74
call fcn.1000ba55
push eax
call fcn.100a285a
pop ecx
mov ecx, dword [ebp - 0x26c]
add ecx, 0x74
call fcn.1000ba55
push eax
call fcn.1003883c
mov ecx, eax
call fcn.10037d1b
push dword [ebp + 8]
lea eax, [ebp - 0x258]
push eax
mov ecx, dword [ebp - 0x26c]
call fcn.100a71fe
mov dword [ebp - 0x28c], eax
mov eax, dword [ebp - 0x28c]
mov dword [ebp - 0x290], eax
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x290]
call fcn.1000ba55
push eax
call fcn.100a4786
pop ecx
neg eax
sbb eax, eax
inc eax
mov byte [ebp - 0x251], al
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x258]
call fcn.10010769
movzx eax, byte [ebp - 0x251]
test eax, eax
je 0x100ab831
push 0x8e
mov ecx, dword [ebp - 0x26c]
call fcn.100a1d60
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x25c], esp
push 0x100cda9b
call fcn.10001405
push 0
push 0x3e8
push 0
push 0x1c
mov ecx, 0x10109340
call fcn.100b38bb
and dword [ebp - 0x260], 0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.1000aabd
mov eax, dword [ebp - 0x260]
jmp 0x100ab8f5
mov dword [ebp - 0x18], 0x8f
push str.Global4B6605C2_1188_5E22_6525_F7A4B4B7C6C3
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [ebp - 0x10], eax
push str.Global98BB2AB4_DF77_40f7_A306_1BA0C3022726
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push eax
lea ecx, [ebp - 0x1c]
call fcn.10010bbe
mov byte [ebp - 4], 5
push 0x3a98
lea ecx, [ebp - 0x1c]
call fcn.1000ba55
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x100ab884
and dword [ebp - 0x18], 0
cmp dword [ebp - 0x10], 0
je 0x100ab897
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [ebp - 0x10], 0
cmp dword [ebp - 0x18], 0
je 0x100ab8c8
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x264], esp
push 0x100cdaae
call fcn.10001405
push 0
push 0x3e8
push 0
push dword [ebp - 0x18]
mov ecx, 0x10109340
call fcn.100b38bb
xor eax, eax
cmp dword [ebp - 0x18], 0
sete al
mov dword [ebp - 0x268], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1c]
call fcn.10020f2f
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.1000aabd
mov eax, dword [ebp - 0x268]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x20]
xor ecx, ebp
call fcn.10071b1a
leave
ret 4