Function at 0x1008a7a0
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101e9286
mov eax, dword fs:[0]
push eax
sub esp, 0x860
mov eax, dword [0x102683e0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x834], edx
mov esi, ecx
xor edi, edi
xor eax, eax
test esi, esi
je 0x1008ab74
mov word [esi], ax
mov dword [ebp - 0x840], eax
mov dword [ebp - 0x83c], eax
mov dword [ebp - 0x838], eax
push 0x20219
push str.SOFTWARElemonz
push SysReAllocStringLen
lea ecx, [ebp - 0x840]
mov dword [ebp - 4], eax
call fcn.10078480
test eax, eax
jne 0x1008a84e
mov eax, dword [ebp - 0x834]
lea ecx, [ebp - 0x840]
dec eax
mov dword [ebp - 0x82c], eax
lea eax, [ebp - 0x82c]
push eax
push esi
push str.AppData
call fcn.10078370
test eax, eax
jne 0x1008a84e
mov edi, dword [ebp - 0x82c]
test edi, edi
jne 0x1008ab3f
xor eax, eax
mov dword [ebp - 0x814], 7
mov dword [ebp - 0x818], 0
mov word [ebp - 0x828], ax
mov byte [ebp - 4], 1
call fcn.10007070
cmp eax, 6
jae 0x1008a89a
push esi
push 0
push 0
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x1008a8f5
push esi
lea ecx, [ebp - 0x828]
call fcn.100032d0
jmp 0x1008a8f5
push str.SHGetKnownFolderPath
push str.shell32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1008a8f5
lea ecx, [ebp - 0x82c]
mov dword [ebp - 0x82c], 0
push ecx
push 0
push 0x8000
push 0x1020ec5c
call eax
test eax, eax
jne 0x1008a8f5
push dword [ebp - 0x82c]
lea ecx, [ebp - 0x828]
call fcn.100032d0
push dword [ebp - 0x82c]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov ecx, dword [ebp - 0x818]
test ecx, ecx
je 0x1008ab24
cmp dword [ebp - 0x814], 8
lea eax, [ebp - 0x828]
cmovae eax, dword [ebp - 0x828]
cmp word [eax + ecx*2 - 2], 0x2f
je 0x1008a93c
lea ecx, [ebp - 0x828]
call fcn.1007cf10
cmp word [eax], 0x5c
je 0x1008a93c
push ecx
lea ecx, [ebp - 0x828]
call fcn.1008bf90
push str.lemonz_
lea ecx, [ebp - 0x828]
call fcn.10003320
mov ecx, dword [ebp - 0x818]
lea eax, [ecx + 1]
cmp eax, dword [ebp - 0x834]
ja 0x1008a983
cmp dword [ebp - 0x814], 8
lea edi, [ecx*2 + 2]
lea eax, [ebp - 0x828]
cmovae eax, dword [ebp - 0x828]
push edi
push eax
push esi
call fcn.101a1180
add esp, 0xc
sub esp, 8
push 0xf023f
sub esp, 8
push str.SOFTWARElemonz
push ecx
lea ecx, [ebp - 0x840]
call fcn.100788c0
test eax, eax
jne 0x1008ab24
cmp dword [ebp - 0x814], 8
lea eax, [ebp - 0x828]
push ecx
cmovae eax, dword [ebp - 0x828]
lea ecx, [ebp - 0x840]
push eax
push str.AppData
call fcn.10078550
call fcn.10007070
cmp eax, 6
jb 0x1008ab24
lea eax, [ebp - 0x82c]
mov dword [ebp - 0x848], 0x800
push eax
push str.S_1_15_2_1
mov dword [ebp - 0x82c], 0
call dword [sym.imp.ADVAPI32.dll_ConvertStringSidToSidW]
cmp dword [ebp - 0x82c], 0
je 0x1008ab24
lea eax, [ebp - 0x848]
push eax
lea eax, [ebp - 0x810]
push eax
push 4
push dword [ebp - 0x840]
call dword [sym.imp.ADVAPI32.dll_RegGetKeySecurity]
test eax, eax
jne 0x1008ab24
mov dword [ebp - 0x84c], eax
mov dword [ebp - 0x844], eax
mov dword [ebp - 0x830], eax
lea eax, [ebp - 0x844]
push eax
lea eax, [ebp - 0x830]
push eax
lea eax, [ebp - 0x84c]
push eax
lea eax, [ebp - 0x810]
push eax
call dword [sym.imp.ADVAPI32.dll_GetSecurityDescriptorDacl]
mov eax, dword [ebp - 0x82c]
xorps xmm0, xmm0
mov dword [ebp - 0x850], 0
mov dword [ebp - 0x850], eax
lea eax, [ebp - 0x830]
push eax
push dword [ebp - 0x830]
lea eax, [ebp - 0x86c]
movq qword [ebp - 0x858], xmm0
push eax
movdqu xmmword [ebp - 0x868], xmm0
push 1
mov dword [ebp - 0x86c], 0x10000000
mov dword [ebp - 0x868], 2
mov dword [ebp - 0x864], 3
mov dword [ebp - 0x858], 0
mov dword [ebp - 0x854], 5
call dword [sym.imp.ADVAPI32.dll_SetEntriesInAclW]
push 1
lea eax, [ebp - 0x810]
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
push 0
push dword [ebp - 0x830]
lea eax, [ebp - 0x810]
push 1
push eax
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
lea eax, [ebp - 0x810]
push eax
push 4
push dword [ebp - 0x840]
call dword [sym.imp.ADVAPI32.dll_RegSetKeySecurity]
push dword [ebp - 0x82c]
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp - 0x814], 8
jb 0x1008ab3b
push dword [ebp - 0x828]
call fcn.101a02f0
add esp, 4
test edi, edi
je 0x1008ab5c
cmp edi, dword [ebp - 0x834]
ja 0x1008ab5c
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1008ab61
push esi
push eax
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
jmp 0x1008ab61
xor eax, eax
mov word [esi], ax
mov eax, dword [ebp - 0x840]
test eax, eax
je 0x1008ab72
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.101a0193
mov esp, ebp
pop ebp
ret