Function at 0x413410
Capabilities:
Check mutex on windows
Get common file path
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x42dff6
mov eax, dword fs:[0]
push eax
sub esp, 0xe18
mov eax, dword [0x4b3774]
xor eax, esp
mov dword [esp + 0xe14], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4b3774]
xor eax, esp
push eax
lea eax, [esp + 0xe2c]
mov dword fs:[0], eax
mov ebp, dword [esp + 0xe40]
mov eax, dword [esp + 0xe3c]
push ebp
push eax
lea ecx, [esp + 0x2c]
call fcn.00415a80
xor ebx, ebx
push ebx
lea ecx, [esp + 0x18]
push str.AOMEI_PXE_Boot_Tool
push ecx
mov dword [esp + 0xe40], ebx
call dword [sym.imp.QtCore4.dll_public:_static_class_QString___cdecl_QObject::tr_char_const___char_const__]
add esp, 0xc
push eax
mov ecx, 0x4b3974
mov byte [esp + 0xe38], 1
call dword [sym.imp.QtCore4.dll_public:_class_QString____thiscall_QString::operator_class_QString_const__]
mov edx, dword [esp + 0x14]
mov byte [esp + 0xe34], bl
or eax, 0xffffffff
lock xadd dword [edx], eax
jne 0x4134b7
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.QtCore4.dll_private:_static_void___cdecl_QString::free_struct_QString::Data__]
add esp, 4
call sub.Comn.dll_GetObjectLogPXE
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx]
push 0x4324c0
call eax
push str.GlobalAomeiPxe
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4135e5
push ebx
push ebx
push 3
push ebx
push ebx
push 0xc0000000
push str..pipeAomeiPxePipe
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ecx, dword [0x43246c]
mov edx, dword [0x432470]
push 0x3f8
mov esi, eax
lea eax, [esp + 0xa34]
push ebx
push eax
mov dword [esp + 0xa34], ecx
mov dword [esp + 0xa38], edx
call sub.MSVCR80.dll_memset
add esp, 0xc
push ebx
lea ecx, [esp + 0x20]
push ecx
push 0x400
lea edx, [esp + 0xa34]
push edx
push esi
mov dword [esp + 0x30], ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, ebx
jne 0x41355f
push str.WriteFile_to_Pipe_error_n
call dword [sym.imp.MSVCR80.dll_printf]
add esp, 4
call sub.Comn.dll_GetObjectLang
mov edx, dword [eax]
push 0xffffffffffffffff
mov ecx, eax
mov eax, dword [edx]
push str.70114
call eax
push eax
lea ecx, [esp + 0x1c]
push ecx
call dword [sym.imp.QtCore4.dll_public:_static_class_QString___cdecl_QString::fromWCharArray_unsigned_short_int_const___int_]
add esp, 0xc
push ebx
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push eax
push 0x4b3974
push ebx
mov byte [esp + 0xe48], 2
mov dword [ecx], 0x400
call dword [sym.imp.QtGui4.dll_public:_static_enum_QMessageBox::StandardButton___cdecl_QMessageBox::information_class_QWidget___class_QString_const___class_QString_const___class_QFlags_enum_QMessageBox::StandardButton___enum_QMessageBox::StandardButton_]
mov edx, dword [esp + 0x28]
add esp, 0x14
mov byte [esp + 0xe34], bl
or eax, 0xffffffff
lock xadd dword [edx], eax
jne 0x4135ca
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.QtCore4.dll_private:_static_void___cdecl_QString::free_struct_QString::Data__]
add esp, 4
lea ecx, [esp + 0x24]
mov dword [esp + 0xe34], 0xffffffff
call fcn.00415ab0
xor eax, eax
jmp 0x413a4a
push str.CrashDumpWorker.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
cmp esi, ebx
jne 0x413606
push str.Load_CrashDumpWorker.dll_Error
call dword [sym.imp.QtCore4.dll_void___cdecl_qDebug_char_const__]
add esp, 4
jmp 0x413622
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.AddCrashCallBack
push esi
call edi
push str.SetCrashDumpOn
push esi
call edi
cmp eax, ebx
je 0x413622
call eax
push 0x11c
lea edx, [esp + 0xf8]
push ebx
push edx
call sub.MSVCR80.dll_memset
add esp, 0xc
lea eax, [esp + 0xf4]
push eax
mov dword [esp + 0xf8], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
or edi, 0xffffffff
push edi
push str.:res_tool_pxe_image.png
call dword [sym.imp.QtCore4.dll_private:_static_struct_QString::Data____cdecl_QString::fromAscii_helper_char_const___int_]
mov dword [esp + 0x1c], eax
add esp, 4
mov eax, esp
mov dword [esp + 0x20], esp
push ebx
lea ecx, [esp + 0x1c]
push ecx
lea ecx, [esp + 0x38]
mov byte [esp + 0xe40], 3
mov dword [eax], ebx
call dword [sym.imp.QtGui4.dll_public:_void___thiscall_QPixmap::constructor_class_QString_const___char_const___class_QFlags_enum_Qt::ImageConversionFlag__]
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0xe38], 4
call dword [sym.imp.QtGui4.dll_public:_void___thiscall_QIcon::constructor_class_QPixmap_const__]
push eax
mov byte [esp + 0xe38], 5
call dword [sym.imp.QtGui4.dll_public:_static_void___cdecl_QApplication::setWindowIcon_class_QIcon_const__]
add esp, 4
lea ecx, [esp + 0x20]
mov byte [esp + 0xe34], 4
call dword [sym.imp.QtGui4.dll_public:_void___thiscall_QIcon::destructor_void_]
lea ecx, [esp + 0x2c]
mov byte [esp + 0xe34], 3
call dword [sym.imp.QtGui4.dll_public_virtual:_void___thiscall_QPixmap::destructor_void_]
mov edx, dword [esp + 0x14]
mov byte [esp + 0xe34], bl
mov eax, edi
lock xadd dword [edx], eax
jne 0x4136f1
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.QtCore4.dll_private:_static_void___cdecl_QString::free_struct_QString::Data__]
add esp, 4
call dword [sym.imp.QtGui4.dll_public:_static_class_QDesktopWidget____cdecl_QApplication::desktop_void_]
cmp eax, ebx
je 0x413720
mov ecx, dword [eax + 0x10]
mov eax, dword [ecx + 0x18]
sub eax, dword [ecx + 0x10]
add ecx, 0x10
add eax, 1
cmp eax, 0x556
mov dword [0x4b31ac], eax
jg 0x413720
mov dword [0x4b31ac], 0x556
push ecx
mov eax, esp
mov dword [esp + 0x20], esp
push ebx
lea ecx, [esp + 0x40]
mov dword [eax], ebx
call fcn.00411a70
push 0x1fe
lea edx, [esp + 0x82e]
push ebx
push edx
mov byte [esp + 0xe40], 6
mov word [esp + 0x834], bx
call sub.MSVCR80.dll_memset
add esp, 0xc
push 0x200
lea eax, [esp + 0x82c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x1fe
lea ecx, [esp + 0x62e]
push ebx
push ecx
mov word [esp + 0x634], bx
call sub.MSVCR80.dll_memset
add esp, 0xc
push 0x200
lea edx, [esp + 0x62c]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [esp + 0x628]
push eax
lea ecx, [esp + 0xc0]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::constructor_unsigned_short_int_const__]
lea ecx, [esp + 0x828]
push ecx
lea ecx, [esp + 0xdc]
mov byte [esp + 0xe38], 7
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::constructor_unsigned_short_int_const__]
mov esi, 5
cmp dword [esp + 0xf8], esi
mov byte [esp + 0xe34], 8
lea ecx, [esp + 0xbc]
jbe 0x4137f4
push str._netsh.exe_advfirewall_firewall_delete_rule_name___ampxe_
jmp 0x413820
push str._netsh_firewall_delete_allowedprogram__
call dword [0x4311d4]
lea edx, [esp + 0xd8]
push edx
lea ecx, [esp + 0xc0]
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int______thiscall_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::operator_class_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int___const__]
push 0x4322f0
lea ecx, [esp + 0xc0]
call dword [0x4311d4]
lea eax, [esp + 0xbc]
push eax
lea ecx, [esp + 0x1f]
call fcn.0040fbe0
lea ecx, [esp + 0x628]
push ecx
lea ecx, [esp + 0xa4]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::constructor_unsigned_short_int_const__]
cmp dword [esp + 0xf8], esi
mov byte [esp + 0xe34], 9
lea ecx, [esp + 0xa0]
jbe 0x41388b
push str._netsh.exe_advfirewall_firewall_add_rule_name___ampxe__dirin_program___
call dword [0x4311d4]
lea edx, [esp + 0xd8]
push edx
lea ecx, [esp + 0xa4]
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int______thiscall_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::operator_class_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int___const__]
push str.__action_allow_
jmp 0x4138c2
push str._netsh.exe_firewall_add_allowedprogram__
call dword [0x4311d4]
lea eax, [esp + 0xd8]
push eax
lea ecx, [esp + 0xa4]
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int______thiscall_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::operator_class_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int___const__]
push 0x4322f0
lea ecx, [esp + 0xa4]
call dword [0x4311d4]
push str._ampxe
lea ecx, [esp + 0xa4]
call dword [0x4311d4]
lea ecx, [esp + 0xa0]
push ecx
lea ecx, [esp + 0x1f]
call fcn.0040fbe0
cmp dword [esp + 0xe3c], 1
lea edx, [esp + 0x38]
mov dword [0x4b3970], edx
jne 0x41395d
lea ecx, [esp + 0xa0]
mov byte [esp + 0xe34], 8
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::destructor_void_]
lea ecx, [esp + 0xd8]
mov byte [esp + 0xe34], 7
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::destructor_void_]
lea ecx, [esp + 0xbc]
mov byte [esp + 0xe34], 6
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::destructor_void_]
lea ecx, [esp + 0x38]
mov byte [esp + 0xe34], bl
call fcn.00411790
lea ecx, [esp + 0x24]
mov dword [esp + 0xe34], edi
call fcn.00415ab0
mov eax, 1
jmp 0x413a4a
push 0x418
lea eax, [esp + 0x214]
push ebx
push eax
call sub.MSVCR80.dll_memset
mov ecx, dword [ebp + 4]
mov al, byte [ecx]
add esp, 0xc
cmp al, 0x53
je 0x4139b4
cmp al, 0x73
je 0x413988
cmp al, 0x72
jne 0x4138f4
cmp al, 0x53
je 0x4139b4
cmp al, 0x73
je 0x4139b4
cmp al, 0x72
jne 0x4139dd
lea edx, [esp + 0x210]
push edx
call fcn.004132d0
add esp, 4
cmp al, 1
je 0x4139bb
lea ecx, [esp + 0x38]
call dword [sym.imp.QtGui4.dll_public:_void___thiscall_QWidget::show_void_]
jmp 0x4139dd
mov byte [esp + 0x211], bl
sub esp, 0x418
mov edi, esp
mov ecx, 0x106
lea esi, [esp + 0x628]
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x450]
call fcn.0040fef0
call dword [sym.imp.QtGui4.dll_public:_static_int___cdecl_QApplication::exec_void_]
lea ecx, [esp + 0xa0]
mov esi, eax
mov byte [esp + 0xe34], 8
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::destructor_void_]
lea ecx, [esp + 0xd8]
mov byte [esp + 0xe34], 7
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::destructor_void_]
lea ecx, [esp + 0xbc]
mov byte [esp + 0xe34], 6
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::destructor_void_]
lea ecx, [esp + 0x38]
mov byte [esp + 0xe34], bl
call fcn.00411790
lea ecx, [esp + 0x24]
mov dword [esp + 0xe34], 0xffffffff
call fcn.00415ab0
mov eax, esi
mov ecx, dword [esp + 0xe2c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0xe14]
xor ecx, esp
call fcn.0042c614
add esp, 0xe24
ret