Function at 0x100f4c7
Capabilities:
Get common file path
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
inc esi
mov eax, edi
mov dword [ebp - 8], esi
call fcn.0100ef3c
test eax, eax
je 0x100f4fb
call fcn.0100eeb5
push esi
call fcn.0100dbec
and dword [ebp - 8], 0
jmp 0x100f91f
mov ebx, 0x101f5e0
push ebx
push 0x50
push edi
call fcn.0100ef62
test eax, eax
jne 0x100f519
push 0x100
push ebx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0x101f488
push 0x55
push edi
call fcn.0100ef62
push 0x101f278
push 0x4c
push edi
call fcn.0100ef62
push 0x101f380
push 0x47
push edi
call fcn.0100ef62
test eax, eax
je 0x100f54a
mov dword [0x101f5a0], esi
push esi
push 0x101f5b8
push 0x4b
push edi
call fcn.0100f3de
test eax, eax
je 0x100f563
or dword [0x101f5bc], 0xffffffff
xor ebx, ebx
cmp dword [0x101f5b8], ebx
jne 0x100f585
push esi
push 0x101f5bc
push 0x4e
push edi
call fcn.0100f3de
test eax, eax
je 0x100f585
mov dword [0x101c09c], esi
push esi
push 0x101f5b4
push 0x59
push edi
call fcn.0100f3de
test eax, eax
jne 0x100f5a1
mov dword [0x101f5b4], 0x7fffffff
push ebx
lea eax, [ebp - 4]
push eax
push 0x51
push edi
call fcn.0100f3de
test eax, eax
je 0x100f5b8
mov dword [0x101f588], esi
push ebx
lea eax, [ebp - 4]
push eax
push 0x5a
push edi
call fcn.0100f3de
test eax, eax
je 0x100f5cf
mov dword [0x101f58c], esi
push ebx
lea eax, [ebp - 4]
push eax
push 0x46
push edi
call fcn.0100f3de
test eax, eax
je 0x100f5e6
mov dword [0x101f590], esi
push esi
mov ebx, 0x101f5c4
push ebx
mov edi, 0x101f5c0
push edi
push 0x44
push dword [ebp + 8]
call fcn.0100f44f
test eax, eax
jne 0x100f609
mov dword [0x101ec80], esi
jmp 0x100f632
cmp dword [0x101f5c0], 0
jne 0x100f618
mov dword [0x101f5c0], esi
mov eax, dword [0x101f5c4]
test eax, eax
je 0x100f632
cmp dword [0x101f5c0], eax
jbe 0x100f632
mov eax, ebx
mov ecx, edi
call fcn.0100f23e
push esi
push 0x101f6e4
push 0x53
push dword [ebp + 8]
call fcn.0100f3de
test eax, eax
push 6
pop edi
je 0x100f65d
push dword [0x101f6e4]
push 0x10063a4
push edi
call fcn.0100c07e
add esp, 0xc
push esi
lea eax, [ebp - 4]
push eax
push 0x57
push dword [ebp + 8]
call fcn.0100f3de
test eax, eax
je 0x100f6da
mov eax, dword [ebp - 4]
dec eax
je 0x100f6c8
dec eax
je 0x100f714
dec eax
je 0x100f6d4
dec eax
dec eax
je 0x100f70b
dec eax
je 0x100f6fc
dec eax
je 0x100f6c1
call fcn.0100eeb5
push esi
call fcn.0100dbec
xor eax, eax
cmp dword [0x101c09c], eax
mov dword [ebp - 8], eax
jne 0x100f91f
push eax
push str.Suspender
push 0x1006364
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x100f91f
or byte [0x101f5b7], 0x80
mov dword [0x101f598], esi
mov dword [0x101f5a0], esi
mov dword [0x101f594], esi
push esi
push 0x101f5cc
mov ebx, 0x101f5c8
push ebx
push 0x52
push dword [ebp + 8]
call fcn.0100f44f
test eax, eax
jne 0x100f71c
mov dword [0x101ec88], esi
jmp 0x100f748
and dword [0x101c0a0], 0
mov dword [0x101f5a4], esi
jmp 0x100f6ce
and dword [0x101f5b4], 0
jmp 0x100f6ce
mov dword [0x101f59c], esi
jmp 0x100f6d4
cmp dword [0x101f5c8], 0
jne 0x100f72b
mov dword [0x101f5c8], esi
mov eax, dword [0x101f5cc]
test eax, eax
je 0x100f748
cmp dword [0x101f5c8], eax
jbe 0x100f748
mov eax, 0x101f5cc
mov ecx, ebx
call fcn.0100f23e
mov ebx, dword [ebp + 8]
push 0
push 0x101f5b0
push 0x45
push ebx
call fcn.0100f3de
test eax, eax
je 0x100f764
mov dword [0x101f5b0], esi
xor eax, eax
cmp dword [0x101f5b0], eax
setne al
push eax
push 0x1006344
push edi
call fcn.0100c07e
add esp, 0xc
push esi
push 0x101f5d0
push 0x48
push ebx
call fcn.0100f3de
push esi
push 0x101f5dc
push 0x54
push ebx
mov dword [0x101f5d0], 3
call fcn.0100f3de
test eax, eax
jne 0x100f7ae
and dword [0x101f5dc], eax
push 0
lea eax, [ebp - 4]
push eax
push 0x56
push ebx
call fcn.0100f3de
test eax, eax
je 0x100f7c6
mov dword [0x101f5ac], esi
push 0
lea eax, [ebp - 4]
push eax
push 0x43
push ebx
call fcn.0100f3de
test eax, eax
je 0x100f7de
mov dword [0x101f6e0], esi
push 0
lea eax, [ebp - 4]
push eax
push 0x4d
push ebx
call fcn.0100f3de
test eax, eax
je 0x100f7f7
and dword [0x101c09c], 0
cmp dword [0x101f6e0], 0
mov ebx, 0x10032f0
mov esi, 0x10032e8
mov eax, ebx
jne 0x100f80e
mov eax, esi
push eax
push 0x100631c
push edi
call fcn.0100c07e
add esp, 0xc
cmp dword [0x101f59c], 0
mov eax, ebx
jne 0x100f82a
mov eax, esi
push eax
push 0x10062f4
push edi
call fcn.0100c07e
add esp, 0xc
cmp dword [0x101f598], 0
je 0x100f844
mov esi, ebx
push esi
push 0x10062cc
push edi
call fcn.0100c07e
push dword [0x101f5c0]
push 0x10062a4
push edi
call fcn.0100c07e
push dword [0x101f5c4]
push 0x100627c
push edi
call fcn.0100c07e
push dword [0x101f5c8]
push 0x1006254
push edi
call fcn.0100c07e
push dword [0x101f5cc]
push 0x100622c
push edi
call fcn.0100c07e
push dword [0x101ec80]
push 0x1006204
push edi
call fcn.0100c07e
add esp, 0x48
push dword [0x101f5b8]
push 0x10061dc
push edi
call fcn.0100c07e
push dword [0x101f5bc]
push 0x10061b4
push edi
call fcn.0100c07e
push dword [0x101ec88]
push 0x100618c
push edi
call fcn.0100c07e
push dword [ebp + 8]
push 0x1006164
push edi
call fcn.0100c07e
push 0x101f5e0
push 0x100613c
push edi
call fcn.0100c07e
push 0x101f278
push 0x1006114
push edi
call fcn.0100c07e
add esp, 0x48
push 0x101f488
push 0x10060ec
push edi
call fcn.0100c07e
add esp, 0xc
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret 4