Function at 0x1000a7c6
Capabilities:
Accept command line arguments
Get common file path

Disassembly:
push ebp
sub esp, 0x844
lea ebp, [esp - 4]
mov eax, dword [0x10274398]
xor eax, ebp
mov dword [ebp + 0x844], eax
push 0x18
mov eax, 0x101ecbc5
call fcn.101d1901
mov eax, dword [ebp + 0x850]
push str.InstallInfo:Init
lea ecx, [ebp]
mov dword [ebp - 0x10], eax
call fcn.100010f3
and dword [ebp - 4], 0
call sym.AhnIEx.dll_AhnIEx_IsWinNT
mov dword [ebp - 0x18], eax
call sym.AhnIEx.dll_AhnIEx_IsWow64Process
mov dword [ebp - 0x14], eax
mov eax, dword [0x102757a4]
shr eax, 1
and eax, 1
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x24]
push 0
push eax
call sym.AhnIEx.dll_AhnIEx_GetOS2
pop ecx
pop ecx
mov ebx, eax
call sym.AhnIEx.dll_AhnIEx_IsWorkstation
test eax, eax
mov eax, 0x101f2e88
jne 0x1000a843
mov eax, str.Server
push eax
push dword [ebp - 0x24]
movzx eax, bl
push eax
shr ebx, 8
push ebx
push str._d._d_SP_d___s_
mov edi, 0x400
lea eax, [ebp + 0x44]
push edi
push eax
call fcn.1001d140
lea eax, [ebp + 0x44]
push eax
push 0x101f2e50
call fcn.101d135a
add esp, 0x24
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor edx, edx
lea ecx, [edi - 0x18]
div ecx
xor edx, edx
mov esi, 0xe10
push 0x3c
mov ecx, eax
div esi
mov ebx, eax
mov esi, edx
mov eax, ecx
pop ecx
xor edx, edx
div ecx
mov eax, esi
push edx
xor edx, edx
div ecx
push eax
push ebx
push str.Tick_d:_02d:_02d
push 3
call fcn.101d1209
lea eax, [ebp + 0x44]
push edi
push eax
call fcn.100180c3
lea eax, [ebp + 0x44]
push eax
call fcn.100166b9
add esp, 0x20
lea eax, [ebp + 0x44]
push eax
mov ebx, str.WinDir
mov esi, 0x10275d40
push ebx
mov ecx, esi
call fcn.100172ee
test eax, eax
jne 0x1000a919
or dword [ebp - 4], 0xffffffff
lea eax, [ebp + 4]
push eax
mov dword [ebp], vtable.CLogFunc.0
call fcn.101d12b4
pop ecx
push 8
pop eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x844]
xor ecx, ebp
call fcn.101d14d7
add ebp, 0x848
leave
ret
lea eax, [ebp + 0x44]
push eax
push ebx
call fcn.101d135a
pop ecx
pop ecx
push edi
lea eax, [ebp + 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [ebp + 0x44]
push eax
call fcn.100166b9
pop ecx
lea eax, [ebp + 0x44]
push eax
mov ebx, str.WinSysDir
push ebx
mov ecx, esi
call fcn.100172ee
test eax, eax
je 0x1000a8de
lea eax, [ebp + 0x44]
push eax
push ebx
call fcn.101d135a
lea eax, [ebp + 0x44]
push edi
push eax
call fcn.10018802
add esp, 0x10
mov ecx, esi
test eax, eax
je 0x1000a9ac
lea eax, [ebp + 0x44]
push eax
mov ebx, str.WinSysWow64Dir
push ebx
call fcn.100172ee
test eax, eax
je 0x1000a8de
lea eax, [ebp + 0x44]
push eax
push ebx
call fcn.101d135a
pop ecx
pop ecx
push 1
lea eax, [ebp + 0x44]
push edi
push eax
call fcn.10018115
add esp, 0xc
test eax, eax
jne 0x1000a9e2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x1000a9c6
push ebx
call fcn.10017295
push eax
push str.WinSysWow64Dir
mov ecx, esi
call fcn.100172ee
test eax, eax
jne 0x1000a98f
push 8
pop esi
or dword [ebp - 4], 0xffffffff
lea eax, [ebp + 4]
push eax
mov dword [ebp], vtable.CLogFunc.0
call fcn.101d12b4
pop ecx
mov eax, esi
jmp 0x1000a8f6
lea eax, [ebp + 0x44]
push eax
call fcn.100166b9
pop ecx
lea eax, [ebp + 0x44]
push eax
mov ebx, str.ProgramFiles64Dir
push ebx
mov ecx, esi
call fcn.100172ee
test eax, eax
je 0x1000a9c3
cmp dword [ebp - 0x14], 0
je 0x1000aa13
lea eax, [ebp + 0x44]
push eax
push ebx
call fcn.101d135a
pop ecx
pop ecx
push 0
lea eax, [ebp + 0x44]
push edi
push eax
call fcn.10018115
add esp, 0xc
test eax, eax
je 0x1000a9a2
lea eax, [ebp + 0x44]
push eax
call fcn.100166b9
pop ecx
lea eax, [ebp + 0x44]
push eax
mov ebx, str.ProgramFilesx86Dir
push ebx
mov ecx, esi
call fcn.100172ee
test eax, eax
je 0x1000a9c3
cmp dword [ebp - 0x14], 0
je 0x1000aa5f
lea eax, [ebp + 0x44]
push eax
push ebx
call fcn.101d135a
pop ecx
pop ecx
xor eax, eax
cmp dword [ebp - 0x20], eax
setne al
push eax
mov dword [ebp - 0x1c], eax
lea eax, [ebp + 0x44]
push edi
push eax
call fcn.10018115
add esp, 0xc
test eax, eax
je 0x1000a9a2
lea eax, [ebp + 0x44]
push eax
call fcn.100166b9
pop ecx
lea eax, [ebp + 0x44]
push eax
mov ebx, str.ProgramFilesDir
push ebx
mov ecx, esi
call fcn.100172ee
test eax, eax
je 0x1000a9c3
lea eax, [ebp + 0x44]
push eax
push ebx
call fcn.101d135a
push 1
lea eax, [ebp + 0x44]
push edi
push eax
call fcn.1001820e
add esp, 0x14
test eax, eax
je 0x1000a9a2
lea eax, [ebp + 0x44]
push eax
call fcn.100166b9
pop ecx
lea eax, [ebp + 0x44]
push eax
mov ebx, str.CommonFiles64Dir
push ebx
mov ecx, esi
call fcn.100172ee
test eax, eax
je 0x1000a9c3
cmp dword [ebp - 0x14], 0
je 0x1000aaf9
lea eax, [ebp + 0x44]
push eax
push ebx
call fcn.101d135a
pop ecx
pop ecx
push 0
lea eax, [ebp + 0x44]
push edi
push eax
call fcn.1001820e
add esp, 0xc
test eax, eax
je 0x1000a9a2
lea eax, [ebp + 0x44]
push eax
call fcn.100166b9
pop ecx
lea eax, [ebp + 0x44]
push eax
mov ebx, str.CommonFilesx86Dir
push ebx
mov ecx, esi
call fcn.100172ee
test eax, eax
je 0x1000a9c3
cmp dword [ebp - 0x14], 0
je 0x1000ab45
lea eax, [ebp + 0x44]
push eax
push ebx
call fcn.101d135a
pop ecx
pop ecx
push dword [ebp - 0x1c]
lea eax, [ebp + 0x44]
push edi
push eax
call fcn.1001820e
add esp, 0xc
test eax, eax
je 0x1000a9a2
lea eax, [ebp + 0x44]
push eax
call fcn.100166b9
pop ecx
lea eax, [ebp + 0x44]
push eax
mov ebx, str.CommonFilesDir
push ebx
mov ecx, esi
call fcn.100172ee
test eax, eax
je 0x1000a9c3
lea eax, [ebp + 0x44]
push eax
push ebx
call fcn.101d135a
mov eax, dword [ebp - 0x10]
pop ecx
pop ecx
test eax, eax
je 0x1000ab99
cmp word [eax], 0
jne 0x1000abb4
lea eax, [ebp + 0x44]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp + 0x44]
push eax
call fcn.100166b9
lea eax, [ebp + 0x44]
pop ecx
mov dword [ebp - 0x10], eax
push dword [ebp - 0x10]
mov ebx, str.TempDir
push ebx
mov ecx, esi
call fcn.100172ee
test eax, eax
je 0x1000a9c3
push dword [ebp - 0x10]
push ebx
call fcn.101d135a
test byte [0x102757a4], 0x10
mov ebx, dword [ebp - 0x18]
pop ecx
pop ecx
jne 0x1000ac55
lea eax, [ebp + 0x44]
push eax
mov eax, ebx
neg eax
sbb eax, eax
and eax, 9
add eax, 0x10
push eax
call fcn.10016201
pop ecx
pop ecx
test eax, eax
je 0x1000ac23
test byte [0x102757a4], 0x80
je 0x1000a9a8
push eax
push str.Desktop
push str._sErr__x
push 2
call fcn.101d1209
add esp, 0x10
jmp 0x1000ac55
lea eax, [ebp + 0x44]
push eax
call fcn.100166b9
pop ecx
lea eax, [ebp + 0x44]
push eax
push str.Desktop
mov ecx, esi
call fcn.100172ee
test eax, eax
je 0x1000a9c3
lea eax, [ebp + 0x44]
push eax
push str.Desktop
call fcn.101d135a
pop ecx
pop ecx
test byte [0x102757a4], 0x20
jne 0x1000acd3
lea eax, [ebp + 0x44]
push eax
mov eax, ebx
neg eax
sbb eax, eax
and eax, 0xb
add eax, 0xb
push eax
call fcn.10016201
pop ecx
pop ecx
test eax, eax
je 0x1000aca1
test dword [0x102757a4], 0x100
je 0x1000a9a8
push eax
push str.StartMenu
push str._sErr__x
push 2
call fcn.101d1209
add esp, 0x10
jmp 0x1000acd3
lea eax, [ebp + 0x44]
push eax
call fcn.100166b9
pop ecx
lea eax, [ebp + 0x44]
push eax
push str.StartMenu
mov ecx, esi
call fcn.100172ee
test eax, eax
je 0x1000a9c3
lea eax, [ebp + 0x44]
push eax
push str.StartMenu
call fcn.101d135a
pop ecx
pop ecx
test byte [0x102757a4], 0x40
jne 0x1000ad4b
neg ebx
sbb ebx, ebx
and ebx, 0x15
lea eax, [ebp + 0x44]
inc ebx
push eax
inc ebx
push ebx
call fcn.10016201
pop ecx
pop ecx
test eax, eax
je 0x1000ad1c
test dword [0x102757a4], 0x200
je 0x1000a9a8
push eax
push str.Programs
push str._sErr__x
push 2
call fcn.101d1209
add esp, 0x10
jmp 0x1000ad4b
lea eax, [ebp + 0x44]
push eax
call fcn.100166b9
pop ecx
lea eax, [ebp + 0x44]
push eax
mov ebx, str.Programs
push ebx
mov ecx, esi
call fcn.100172ee
test eax, eax
je 0x1000a9c3
lea eax, [ebp + 0x44]
push eax
push ebx
call fcn.101d135a
pop ecx
pop ecx
lea eax, [ebp + 0x44]
push edi
push eax
call fcn.10018880
pop ecx
pop ecx
test eax, eax
jne 0x1000ad65
mov esi, 0x80004005
jmp 0x1000a9c6
lea eax, [ebp + 0x44]
push eax
call fcn.100166b9
pop ecx
lea eax, [ebp + 0x44]
push eax
mov ebx, str.CommonAppData
push ebx
mov ecx, esi
call fcn.100172ee
test eax, eax
je 0x1000a9c3
lea eax, [ebp + 0x44]
push eax
push ebx
call fcn.101d135a
pop ecx
pop ecx
test dword [0x102757a4], edi
jne 0x1000adfd
lea eax, [ebp + 0x44]
push edi
push eax
call fcn.1001894e
pop ecx
pop ecx
test eax, eax
jne 0x1000adce
test dword [0x102757a4], 0x2000
je 0x1000ad5b
push str.AppData
push str._sErr
push 2
call fcn.101d1209
add esp, 0xc
jmp 0x1000adfd
lea eax, [ebp + 0x44]
push eax
call fcn.100166b9
pop ecx
lea eax, [ebp + 0x44]
push eax
mov ebx, str.AppData
push ebx
mov ecx, esi
call fcn.100172ee
test eax, eax
je 0x1000a9c3
lea eax, [ebp + 0x44]
push eax
push ebx
call fcn.101d135a
pop ecx
pop ecx
test dword [0x102757a4], 0x800
jne 0x1000ae6e
lea eax, [ebp + 0x44]
push edi
push eax
call fcn.10018a0d
pop ecx
pop ecx
test eax, eax
jne 0x1000ae3f
test dword [0x102757a4], 0x4000
je 0x1000ad5b
push str.LocalAppData
push str._sErr
push 2
call fcn.101d1209
add esp, 0xc
jmp 0x1000ae6e
lea eax, [ebp + 0x44]
push eax
call fcn.100166b9
pop ecx
lea eax, [ebp + 0x44]
push eax
mov ebx, str.LocalAppData
push ebx
mov ecx, esi
call fcn.100172ee
test eax, eax
je 0x1000a9c3
lea eax, [ebp + 0x44]
push eax
push ebx
call fcn.101d135a
pop ecx
pop ecx
push 0
push 0x200000
call sym.AhnIEx.dll_AhnIEx_IsWinNTOrLater
pop ecx
pop ecx
test eax, eax
je 0x1000aef8
test dword [0x102757a4], 0x1000
jne 0x1000aef8
push edi
lea eax, [ebp + 0x44]
push eax
push 0x1026b154
call fcn.100162e8
add esp, 0xc
test eax, eax
jge 0x1000aec9
test dword [0x102757a4], 0x8000
je 0x1000a9a8
push eax
push str.LocalAppDataLow
push str._sErr__x
push 2
call fcn.101d1209
add esp, 0x10
jmp 0x1000aef8
lea eax, [ebp + 0x44]
push eax
call fcn.100166b9
pop ecx
lea eax, [ebp + 0x44]
push eax
mov ebx, str.LocalAppDataLow
push ebx
mov ecx, esi
call fcn.100172ee
test eax, eax
je 0x1000a9c3
lea eax, [ebp + 0x44]
push eax
push ebx
call fcn.101d135a
pop ecx
pop ecx
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push edi
lea eax, [ebp + 0x44]
push eax
push dword [0x102757a0]
call ebx
lea eax, [ebp + 0x44]
push 0x5c
push eax
call fcn.101d1bcf
pop ecx
pop ecx
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp + 0x44]
push eax
push str.PluginDir
mov ecx, esi
call fcn.100172ee
test eax, eax
je 0x1000a9c3
lea eax, [ebp + 0x44]
push eax
push str.PluginDir
call fcn.101d135a
pop ecx
pop ecx
push edi
lea eax, [ebp + 0x44]
push eax
push 0
call ebx
lea eax, [ebp + 0x44]
push 0x5c
push eax
call fcn.101d1bcf
pop ecx
pop ecx
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp + 0x44]
push eax
mov ebx, str.ExeDir
push ebx
mov ecx, esi
call fcn.100172ee
test eax, eax
je 0x1000a9c3
lea eax, [ebp + 0x44]
push eax
push ebx
call fcn.101d135a
pop ecx
pop ecx
mov ebx, str.SecFile
push ebx
mov ecx, esi
call fcn.10017295
test eax, eax
jne 0x1000afbc
push str._ExeDir_AhnSec.dat
lea eax, [ebp + 0x44]
push edi
push eax
call fcn.1000a481
add esp, 0xc
lea eax, [ebp + 0x44]
push eax
push ebx
mov ecx, esi
call fcn.100172ee
test eax, eax
je 0x1000a9c3
push ebx
call fcn.1000a6f3
push eax
push ebx
call fcn.101d135a
add esp, 0xc
mov ebx, str.IniFile
push ebx
mov ecx, esi
call fcn.10017295
test eax, eax
jne 0x1000b003
push str._ExeDir_AhnSec.ini
lea eax, [ebp + 0x44]
push edi
push eax
call fcn.1000a481
add esp, 0xc
lea eax, [ebp + 0x44]
push eax
push ebx
mov ecx, esi
call fcn.100172ee
test eax, eax
je 0x1000a9c3
push ebx
call fcn.1000a6f3
push eax
push ebx
call fcn.101d135a
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
cmp word [eax], 0x22
push 0x20
pop ecx
jne 0x1000b027
push 0x22
inc eax
pop ecx
inc eax
push ecx
push eax
call fcn.101d1ba9
pop ecx
pop ecx
test eax, eax
je 0x1000b067
inc eax
inc eax
cmp word [eax], 0x20
mov dword [ebp - 0x10], eax
jne 0x1000b04a
inc eax
inc eax
cmp word [eax], 0x20
je 0x1000b03f
mov dword [ebp - 0x10], eax
push dword [ebp - 0x10]
mov ebx, str.CmdLine
push ebx
mov ecx, esi
call fcn.100172ee
test eax, eax
je 0x1000a9c3
push dword [ebp - 0x10]
jmp 0x1000b086
push 0x101eeb08
mov ebx, str.CmdLine
push ebx
mov ecx, esi
call fcn.100172ee
test eax, eax
je 0x1000a9c3
push 0x101eeb08
push ebx
call fcn.101d135a
pop ecx
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
and dword [ebp - 0x10], 0
mov ebx, eax
push edi
lea eax, [ebp + 0x44]
push eax
push ebx
call fcn.100142e4
mov esi, eax
add esp, 0xc
cmp esi, 0xffffffff
je 0x1000b0e9
cmp word [ebp + 0x44], 0
je 0x1000b0d8
lea eax, [ebp + 0x44]
push eax
push esi
push ebx
push str.Parent__u__u__s
push 3
call fcn.101d1209
add esp, 0x14
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x40
mov ebx, esi
jl 0x1000b09a
jmp 0x1000b0e9
push esi
push ebx
push str.Parent__u__u
push 3
call fcn.101d1209
add esp, 0x10
xor eax, eax
cmp dword [ebp - 0x20], eax
je 0x1000b0fc
cmp dword [ebp - 0x14], eax
je 0x1000b0fc
push eax
call fcn.100147d3
pop ecx
xor esi, esi
jmp 0x1000a9c6