Function at 0x970bb0
Capabilities:
Get common file path
Write file on windows

Disassembly:
sub esp, 0x338
mov eax, dword [0xb196ec]
xor eax, esp
mov dword [esp + 0x334], eax
push ebx
push ebp
push esi
push edi
xor ebx, ebx
push 0x103
lea eax, [esp + 0x2d]
push ebx
push eax
mov esi, ecx
mov byte [esp + 0x34], bl
call fcn.00a7ffb0
add esp, 0xc
push 0x103
lea ecx, [esp + 0x23d]
push ebx
push ecx
mov byte [esp + 0x244], bl
call fcn.00a7ffb0
add esp, 0xc
push 0x103
lea edx, [esp + 0x135]
push ebx
push edx
mov byte [esp + 0x13c], bl
call fcn.00a7ffb0
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x24], eax
cmp byte [str.C:PROGRA2eScanLogmwXface.log], bl
jne 0x970ca3
cmp byte [0xbfd870], bl
jne 0x970ca3
lea eax, [esp + 0x130]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcpyA]
test eax, eax
jne 0x970c63
push 0xaaa51c
lea ecx, [esp + 0x134]
push ecx
call ebp
push 0xbfd870
push ebx
push 0xae1ea8
lea edx, [esp + 0x13c]
push edx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
push 0x2e
push 0xbfd870
call fcn.00a7aa50
mov edi, eax
add esp, 8
cmp edi, ebx
je 0x970ca3
mov eax, 0xbfd870
call fcn.0094dd20
push str..LOG
push edi
call ebp
cmp dword [esp + 0x34c], ebx
je 0x970cb9
cmp dword [0xbd85fc], 4
jle 0x970e4c
cmp byte [esi], bl
je 0x970e4c
push 0x80
push 4
push 3
push 0xc0000000
mov edi, str.C:PROGRA2eScanLogmwXface.log
cmp byte [str.C:PROGRA2eScanLogmwXface.log], bl
jne 0x970ce1
mov edi, 0xbfd870
call fcn.0094db00
mov edi, eax
add esp, 0x10
mov dword [esp + 0x18], edi
cmp edi, 0xffffffff
je 0x970e4c
push 2
push ebx
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp byte [esi], 0xa
mov dword [esp + 0x1c], eax
mov ebp, esi
jne 0x970d43
lea ebp, [esi + 1]
mov eax, 0xaaa5d0
inc eax
cmp byte [eax], bl
jne 0x970d26
push ebx
lea ecx, [esp + 0x18]
push ecx
sub eax, 0xaaa5d0
push eax
push 0xaaa5d0
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp byte [ebp], bl
je 0x970e42
xor ebx, ebx
lea esi, [esp + 0x238]
call fcn.00985ed0
cmp byte [str.MSIPCSRV.EXE], bl
je 0x970db1
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
push edx
push eax
mov ecx, esi
push ecx
push str.MSIPCSRV.EXE
lea edx, [esp + 0x38]
push str.__s___s__04x__04x__
push edx
call fcn.00a78f30
add esp, 0x18
lea eax, [esp + 0x28]
cmp byte [esp + 0x28], bl
je 0x970d95
inc eax
cmp byte [eax], bl
jne 0x970d90
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea edx, [esp + 0x2c]
lea ecx, [esp + 0x18]
push ecx
sub eax, edx
push eax
mov eax, edx
push eax
push edi
call esi
jmp 0x970e03
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x1c]
push ecx
push edx
lea eax, [esp + 0x240]
push eax
lea ecx, [esp + 0x34]
push str._s__04x__04x__
push ecx
call fcn.00a78f30
add esp, 0x14
lea eax, [esp + 0x28]
cmp byte [esp + 0x28], bl
je 0x970de5
nop
inc eax
cmp byte [eax], bl
jne 0x970de0
push 0
lea ecx, [esp + 0x2c]
lea edx, [esp + 0x18]
push edx
sub eax, ecx
push eax
mov edx, ecx
push edx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, ebp
cmp byte [ebp], bl
je 0x970e15
lea ebx, [ebx]
inc eax
cmp byte [eax], bl
jne 0x970e10
push 0
lea ecx, [esp + 0x18]
push ecx
sub eax, ebp
push eax
push ebp
push edi
call esi
mov eax, 0xaaa5d0
inc eax
cmp byte [eax], bl
jne 0x970e28
push 0
lea edx, [esp + 0x18]
push edx
sub eax, 0xaaa5d0
push eax
push 0xaaa5d0
push edi
call esi
lea eax, [esp + 0x18]
push eax
call fcn.00985290
mov ecx, dword [esp + 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [esp + 0x344]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00a78f21
add esp, 0x338
ret