Function at 0x1006c470
Capabilities:
Get common file path
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x18]
push esi
push edi
mov edi, dword [ebp + 0x10]
push 0
mov dword [ebp - 0x40c], edx
mov dword [ebp - 0x408], eax
call dword [sym.imp.ole32.dll_CoInitialize]
xor esi, esi
mov dword [0x100e2f00], 0
push esi
push 0x23
xorps xmm0, xmm0
push 0x100e3304
push esi
movdqa xmmword [0x100e2ed0], xmm0
movdqa xmmword [0x100e2ee0], xmm0
movdqa xmmword [0x100e2ef0], xmm0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
js 0x1006c519
mov esi, 0x100e3304
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x1006c4e5
sub esi, ecx
sar esi, 1
je 0x1006c519
cmp word [esi*2 + 0x100e3302], 0x5c
je 0x1006c519
mov eax, 0x5c
mov word [esi*2 + 0x100e3304], ax
inc esi
xor eax, eax
mov word [esi*2 + 0x100e3304], ax
mov eax, dword [ebp - 0x40c]
xorps xmm0, xmm0
push 0x400
push dword [ebp - 0x408]
mov dword [0x100e3b04], esi
mov esi, dword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
push 0
mov dword [0x100e431c], 0
movlpd qword [0x100e4320], xmm0
mov dword [0x100e4328], 0
mov dword [0x100e432c], 0
mov dword [0x100e4308], 1
mov dword [0x100e4330], 0
mov dword [0x100e4334], eax
mov dword [0x100e4338], 0
mov dword [0x100e433c], 0
mov dword [0x100e4348], 0
mov dword [0x100e4354], 0
mov dword [0x100e4364], 0
mov dword [0x100e4368], 0
mov dword [0x100e436c], 0
call esi
push 0x400
push edi
push dword [ebp - 0x40c]
call esi
push 0x400
push ebx
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryW]
test eax, eax
je 0x1006c600
mov ecx, str._rundll32.exe
lea edx, [eax + eax]
sub edx, ecx
add edx, ebx
lea esp, [esp]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [ecx + edx - 2], ax
test ax, ax
jne 0x1006c5f0
lea ecx, [ebp - 0x404]
sub ecx, edi
jmp 0x1006c610
movzx eax, word [edi]
lea edi, [edi + 2]
mov word [edi + ecx - 2], ax
test ax, ax
jne 0x1006c610
lea eax, [ebp - 0x404]
push 0x5c
push eax
call fcn.1007b71d
mov esi, eax
add esp, 8
test esi, esi
je 0x1006c92d
add esi, 2
mov ecx, str.hypertrm.exe
mov edx, esi
sub edx, ecx
jmp 0x1006c650
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [ecx + edx - 2], ax
test ax, ax
jne 0x1006c650
push 0x2e
push esi
call fcn.1007b71d
mov edx, eax
add esp, 8
test edx, edx
je 0x1006c8fa
mov ecx, 0x100c689c
sub edx, ecx
lea esp, [esp]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [ecx + edx], ax
test ax, ax
jne 0x1006c680
push 0
push 0x80
push 3
push 0
push 0
push SysReAllocString
lea eax, [ebp - 0x404]
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x1006c8fa
push 0
lea eax, [ebp - 0x410]
push eax
push 0x400
lea eax, [ebp - 0x404]
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_ReadFile]
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
lea eax, [ebp - 0x408]
mov dword [ebp - 0x408], 0x400
push eax
push 0x100e2f04
push 0xa
push str.12306
mov edx, 0x400
lea ecx, [ebp - 0x404]
call fcn.1005d0c0
movzx eax, word [0x100e2f04]
mov ecx, 0x100e2f34
mov word [0x100e43a8], ax
add esp, 0x10
movzx eax, word [0x100e2f06]
mov word [0x100e43ac], ax
movzx eax, byte [0x100e2f08]
lea edx, [ecx + 2]
mov dword [0x100e43b0], eax
movzx eax, byte [0x100e2f09]
mov dword [0x100e43b4], eax
movzx eax, word [0x100e2f0a]
mov word [0x100e43b8], ax
movzx eax, word [0x100e2f0c]
mov word [0x100e43bc], ax
movzx eax, word [0x100e2f0e]
mov word [0x100e43c0], ax
movzx eax, word [0x100e2f10]
mov word [0x100e4384], ax
movzx eax, word [0x100e2f12]
mov word [0x100e4386], ax
mov eax, dword [0x100e2f14]
mov dword [0x100e4388], eax
mov eax, dword [0x100e2f18]
mov dword [0x100e438c], eax
mov eax, dword [0x100e2f1c]
mov dword [0x100e4390], eax
mov eax, dword [0x100e2f20]
mov dword [0x100e4394], eax
mov eax, dword [0x100e2f24]
mov dword [0x100e4398], eax
mov eax, dword [0x100e2f28]
mov dword [0x100e439c], eax
mov eax, dword [0x100e2f2c]
mov dword [0x100e43a0], eax
mov eax, dword [0x100e2f30]
mov dword [0x100e43a4], eax
mov dword [0x100e4380], 0x100e2f34
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1006c7e1
sub ecx, edx
sar ecx, 1
lea edx, [ecx*2 + 0x100e2f36]
mov ecx, edx
mov dword [0x100e43c4], edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1006c802
sub ecx, esi
add edx, 2
sar ecx, 1
lea eax, [ecx + ecx]
add edx, eax
mov dword [0x100e43c8], eax
mov ecx, edx
mov dword [0x100e43cc], edx
lea esi, [ecx + 1]
lea esp, [esp]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1006c830
sub ecx, esi
add edx, ecx
mov ax, word [edx + 1]
add edx, 3
mov ecx, edx
mov word [0x100e43d0], ax
mov dword [0x100e43d4], edx
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1006c853
sub ecx, esi
inc ecx
add edx, ecx
mov ecx, edx
mov dword [0x100e43d8], edx
lea esi, [ecx + 1]
lea ebx, [ebx]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1006c870
sub ecx, esi
inc edx
add edx, ecx
mov ecx, edx
mov dword [0x100e43dc], edx
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1006c887
sub ecx, esi
inc edx
add edx, ecx
mov ecx, edx
mov dword [0x100e43e0], edx
lea esi, [ecx + 1]
mov edi, edi
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1006c8a0
sub ecx, esi
inc edx
add edx, ecx
mov ecx, edx
mov dword [0x100e43e4], edx
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1006c8b7
sub ecx, esi
mov esi, dword [sym.imp.KERNEL32.DLL_InitializeCriticalSection]
push 0x100e43ec
mov eax, dword [ecx + edx + 1]
mov dword [0x100e43e8], eax
call esi
push 0x100e4404
call esi
push 0x100e441c
call esi
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1007aa10
mov esp, ebp
pop ebp
ret
push str.UniqueUDiskWather
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.DLL_OpenMutexW]
test eax, eax
je 0x1006c92d
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop edi
pop esi
mov eax, 2
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1007aa10
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1007aa10
mov esp, ebp
pop ebp
ret