Function at 0x10001f20
Capabilities:
Check if file exists
Get common file path
Print debug messages

Disassembly:
push 0xffffffffffffffff
push 0x1003a5d4
mov eax, dword fs:[0]
push eax
sub esp, 0x4f4
mov eax, dword [0x10047130]
xor eax, esp
mov dword [esp + 0x4f0], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x10047130]
xor eax, esp
push eax
lea eax, [esp + 0x508]
mov dword fs:[0], eax
mov eax, dword [esp + 0x51c]
mov edi, dword [esp + 0x518]
mov ebp, dword [esp + 0x520]
push str.wfchost.exe
mov dword [esp + 0x7c], ecx
xor ebx, ebx
mov dword [esp + 0x70], eax
mov eax, dword [esp + 0x530]
lea ecx, [esp + 0xa4]
push ebx
push ecx
mov dword [esp + 0x88], edi
mov dword [esp + 0x80], ebp
mov dword [esp + 0x8c], edx
mov dword [esp + 0x7c], eax
call fcn.100140d0
add esp, 0xc
mov dword [esp + 0x510], ebx
cmp dword [esp + 0xb8], 8
mov eax, dword [esp + 0xa4]
jae 0x10001fcf
lea eax, [esp + 0xa4]
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push eax
call esi
test eax, eax
jne 0x10002075
push 0x206
lea eax, [esp + 0x302]
xor edx, edx
push ebx
push eax
mov word [esp + 0x308], dx
call fcn.10027a00
add esp, 0xc
push 0x104
lea ecx, [esp + 0x300]
push ecx
mov ebx, str.wfchost.exe
call fcn.10011086
lea edx, [esp + 0x2fc]
push edx
call esi
test eax, eax
jne 0x10002040
cmp dword [esp + 0xb8], 8
jb 0x10002a52
mov eax, dword [esp + 0xa4]
push eax
jmp 0x10002a4a
lea eax, [esp + 0x2fc]
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10002050
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0x300]
lea esi, [esp + 0xa4]
call fcn.10005820
xor ebx, ebx
cmp ebp, ebx
jne 0x10002081
mov dword [esp + 0x74], 0x1003da0c
cmp edi, ebx
je 0x10002a38
cmp dword [esp + 0x6c], ebx
je 0x10002a38
and dword [esp + 0x5c], 0xfffffe00
mov dword [esp + 0x60], ebx
mov dword [esp + 0x64], ebx
mov dword [esp + 0x68], ebx
mov eax, edi
lea ecx, [esp + 0x38]
mov byte [esp + 0x510], 2
call fcn.100041f0
lea ecx, [esp + 0x38]
push ecx
lea edx, [esp + 0x20]
push edx
mov byte [esp + 0x518], 3
call fcn.10001c80
mov byte [esp + 0x518], 4
sub esp, 0x10
mov esi, esp
mov byte [esi + 8], 4
or dword [esi + 8], 0x100
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov edi, dword [eax + 0x14]
mov ebp, 0x10
mov dword [esp + 0x30], esp
cmp dword [eax + 0x18], ebp
jb 0x10002108
mov eax, dword [eax + 4]
jmp 0x1000210b
add eax, 4
push eax
call fcn.100188d5
add esp, 4
mov dword [esi], eax
push str.title
lea eax, [esp + 0x70]
push eax
mov ecx, 0x1003da35
mov byte [esp + 0x530], 5
call fcn.10019cdd
mov edi, eax
mov byte [esp + 0x528], 4
call fcn.1001909a
cmp dword [esp + 0x34], ebp
jb 0x10002154
mov ecx, dword [esp + 0x20]
push ecx
call fcn.100229a9
add esp, 4
mov byte [esp + 0x510], 2
cmp dword [esp + 0x50], 8
mov dword [esp + 0x34], 0xf
mov dword [esp + 0x30], ebx
mov byte [esp + 0x20], bl
jb 0x10002180
mov edx, dword [esp + 0x3c]
push edx
call fcn.100229a9
add esp, 4
mov eax, dword [esp + 0x6c]
lea ecx, [esp + 0x38]
call fcn.100041f0
lea eax, [esp + 0x38]
push eax
lea ecx, [esp + 0x20]
push ecx
mov byte [esp + 0x518], 6
call fcn.10001c80
mov byte [esp + 0x518], 7
sub esp, 0x10
mov esi, esp
mov byte [esi + 8], 4
or dword [esi + 8], 0x100
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov edi, dword [eax + 0x14]
mov dword [esp + 0x30], esp
cmp dword [eax + 0x18], ebp
jb 0x100021d6
mov eax, dword [eax + 4]
jmp 0x100021d9
add eax, 4
push eax
call fcn.100188d5
add esp, 4
mov dword [esi], eax
push str.content
lea edx, [esp + 0x70]
push edx
mov ecx, 0x1003da3f
mov byte [esp + 0x530], 8
call fcn.10019cdd
mov edi, eax
mov byte [esp + 0x528], 7
call fcn.1001909a
cmp dword [esp + 0x34], ebp
jb 0x10002222
mov eax, dword [esp + 0x20]
push eax
call fcn.100229a9
add esp, 4
mov byte [esp + 0x510], 2
cmp dword [esp + 0x50], 8
mov dword [esp + 0x34], 0xf
mov dword [esp + 0x30], ebx
mov byte [esp + 0x20], bl
jb 0x1000224e
mov ecx, dword [esp + 0x3c]
push ecx
call fcn.100229a9
add esp, 4
mov eax, dword [esp + 0x74]
lea ecx, [esp + 0x38]
call fcn.100041f0
lea edx, [esp + 0x38]
push edx
lea eax, [esp + 0x20]
push eax
mov byte [esp + 0x518], 9
call fcn.10001c80
mov byte [esp + 0x518], 0xa
sub esp, 0x10
mov esi, esp
mov byte [esi + 8], 4
or dword [esi + 8], 0x100
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov edi, dword [eax + 0x14]
mov dword [esp + 0x30], esp
cmp dword [eax + 0x18], ebp
jb 0x100022a4
mov eax, dword [eax + 4]
jmp 0x100022a7
add eax, 4
push eax
call fcn.100188d5
add esp, 4
mov dword [esi], eax
push str.btnText
lea ecx, [esp + 0x70]
push ecx
mov ecx, 0x1003da47
mov byte [esp + 0x530], 0xb
call fcn.10019cdd
mov edi, eax
mov byte [esp + 0x528], 0xa
call fcn.1001909a
cmp dword [esp + 0x34], ebp
jb 0x100022f0
mov edx, dword [esp + 0x20]
push edx
call fcn.100229a9
add esp, 4
mov byte [esp + 0x510], 2
cmp dword [esp + 0x50], 8
mov dword [esp + 0x34], 0xf
mov dword [esp + 0x30], ebx
mov byte [esp + 0x20], bl
jb 0x1000231c
mov eax, dword [esp + 0x3c]
push eax
call fcn.100229a9
add esp, 4
mov eax, str.rtmessage.png
lea ecx, [esp + 0x38]
call fcn.100041f0
lea ecx, [esp + 0x38]
push ecx
lea edx, [esp + 0x20]
push edx
mov byte [esp + 0x518], 0xc
call fcn.10001c80
mov byte [esp + 0x518], 0xd
sub esp, 0x10
mov esi, esp
mov byte [esi + 8], 4
or dword [esi + 8], 0x100
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov edi, dword [eax + 0x14]
mov dword [esp + 0x30], esp
cmp dword [eax + 0x18], ebp
jb 0x10002373
mov eax, dword [eax + 4]
jmp 0x10002376
add eax, 4
push eax
call fcn.100188d5
add esp, 4
mov dword [esi], eax
push str.icoName
lea eax, [esp + 0x70]
push eax
mov ecx, 0x1003da4f
mov byte [esp + 0x530], 0xe
call fcn.10019cdd
mov edi, eax
mov byte [esp + 0x528], 0xd
call fcn.1001909a
cmp dword [esp + 0x34], ebp
jb 0x100023bf
mov ecx, dword [esp + 0x20]
push ecx
call fcn.100229a9
add esp, 4
mov byte [esp + 0x510], 2
cmp dword [esp + 0x50], 8
mov dword [esp + 0x34], 0xf
mov dword [esp + 0x30], ebx
mov byte [esp + 0x20], bl
jb 0x100023eb
mov edx, dword [esp + 0x3c]
push edx
call fcn.100229a9
add esp, 4
cmp dword [esp + 0x78], ebx
je 0x10002493
mov eax, dword [esp + 0x78]
lea ecx, [esp + 0x38]
call fcn.100041f0
lea eax, [esp + 0x38]
push eax
lea ecx, [esp + 0x20]
push ecx
mov byte [esp + 0x518], 0xf
call fcn.10001c80
sub esp, 0x10
mov byte [esp + 0x528], 0x10
mov edx, eax
mov esi, esp
mov dword [esp + 0x30], esp
call fcn.10018e47
push 0x1003da50
lea edx, [esp + 0x70]
push edx
mov ecx, 0x1003da53
mov byte [esp + 0x530], 0x11
call fcn.10019cdd
mov edi, eax
mov byte [esp + 0x528], 0x10
call fcn.1001909a
cmp dword [esp + 0x34], ebp
jb 0x1000246f
mov eax, dword [esp + 0x20]
push eax
call fcn.100229a9
add esp, 4
cmp dword [esp + 0x50], 8
mov dword [esp + 0x34], 0xf
mov dword [esp + 0x30], ebx
mov byte [esp + 0x20], bl
jb 0x10002493
mov ecx, dword [esp + 0x3c]
push ecx
call fcn.100229a9
add esp, 4
sub esp, 0x18
mov ecx, esp
mov ebp, 0xfffffeff
xor eax, eax
mov byte [ecx + 8], 1
and dword [ecx + 8], ebp
cmp dword [esp + 0x53c], ebx
mov dword [esp + 0x30], esp
setne al
mov dword [ecx + 0xc], ebx
mov dword [ecx + 0x10], ebx
mov dword [ecx + 0x14], ebx
cdq
mov dword [ecx], eax
mov dword [ecx + 4], edx
push str.showNotAlert
lea edx, [esp + 0x70]
push edx
mov ecx, 0x1003da60
mov byte [esp + 0x530], 0x18
call fcn.10019cdd
mov edi, eax
mov byte [esp + 0x528], 2
call fcn.1001909a
mov eax, dword [esp + 0x528]
sub esp, 0x18
mov ecx, esp
cdq
mov byte [ecx + 8], 1
and dword [ecx + 8], ebp
mov dword [esp + 0x30], esp
mov dword [ecx + 0xc], ebx
mov dword [ecx + 0x10], ebx
mov dword [ecx + 0x14], ebx
mov dword [ecx], eax
mov dword [ecx + 4], edx
push str.runas
lea eax, [esp + 0x70]
push eax
mov ecx, 0x1003da69
mov byte [esp + 0x530], 0x19
call fcn.10019cdd
mov edi, eax
mov byte [esp + 0x528], 2
call fcn.1001909a
cmp dword [esp + 0x70], ebx
je 0x100025e8
mov eax, dword [esp + 0x70]
lea ecx, [esp + 0x38]
call fcn.100041f0
lea ecx, [esp + 0x38]
push ecx
lea edx, [esp + 0x20]
push edx
mov byte [esp + 0x518], 0x1a
call fcn.10001c80
sub esp, 0x10
mov byte [esp + 0x528], 0x1b
mov edx, eax
mov esi, esp
mov dword [esp + 0x30], esp
call fcn.10018e47
push str.singleton
lea eax, [esp + 0x70]
push eax
mov ecx, 0x1003da75
mov byte [esp + 0x530], 0x1c
call fcn.10019cdd
mov edi, eax
mov byte [esp + 0x528], 0x1b
call fcn.1001909a
cmp dword [esp + 0x34], 0x10
jb 0x100025c4
mov ecx, dword [esp + 0x20]
push ecx
call fcn.100229a9
add esp, 4
cmp dword [esp + 0x50], 8
mov dword [esp + 0x34], 0xf
mov dword [esp + 0x30], ebx
mov byte [esp + 0x20], bl
jb 0x100025e8
mov edx, dword [esp + 0x3c]
push edx
call fcn.100229a9
add esp, 4
sub esp, 0x18
mov eax, esp
mov byte [eax + 8], 1
and dword [eax + 8], ebp
mov dword [esp + 0x30], esp
mov dword [eax + 0xc], ebx
mov dword [eax + 0x10], ebx
mov dword [eax + 0x14], ebx
mov dword [eax], ebx
mov dword [eax + 4], ebx
push str.fullscreen
lea eax, [esp + 0x70]
push eax
mov ecx, 0x1003da82
mov byte [esp + 0x530], 0x1d
call fcn.10019cdd
mov edi, eax
mov byte [esp + 0x528], 2
call fcn.1001909a
sub esp, 0x18
mov eax, esp
mov byte [eax + 8], 1
and dword [eax + 8], ebp
mov dword [esp + 0x30], esp
mov dword [eax + 0xc], ebx
mov dword [eax + 0x10], ebx
mov dword [eax + 0x14], ebx
mov dword [eax], ebx
mov dword [eax + 4], ebx
push str.closeExpired
lea ecx, [esp + 0x70]
push ecx
mov ecx, 0x1003da90
mov byte [esp + 0x530], 0x1e
call fcn.10019cdd
mov edi, eax
mov byte [esp + 0x528], 2
call fcn.1001909a
lea esi, [esp + 0xd8]
call fcn.10006830
push 0x206
lea eax, [esp + 0xfa]
xor edx, edx
push ebx
mov byte [esp + 0x518], 0x1f
push eax
mov word [esp + 0x100], dx
call fcn.10027a00
add esp, 0xc
lea ecx, [esp + 0xf4]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea ecx, [esp + 0x38]
call fcn.100068b0
cmp dword [eax + 0x18], 8
jb 0x100026d5
mov eax, dword [eax + 4]
jmp 0x100026d8
add eax, 4
push eax
lea edx, [esp + 0xf8]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
mov edi, 8
cmp dword [esp + 0x50], edi
jb 0x100026ff
mov eax, dword [esp + 0x3c]
push eax
call fcn.100229a9
add esp, 4
lea ecx, [esp + 0x54]
push ecx
lea ecx, [esp + 0x20]
call fcn.1001a368
push eax
lea edx, [esp + 0xc0]
push edx
mov byte [esp + 0x518], 0x21
call fcn.10020ec5
add esp, 8
mov ebp, 0x10
mov byte [esp + 0x510], 0x23
cmp dword [esp + 0x34], ebp
jb 0x10002746
mov eax, dword [esp + 0x20]
push eax
call fcn.100229a9
add esp, 4
mov eax, dword [esp + 0xc0]
mov dword [esp + 0x34], 0xf
mov dword [esp + 0x30], ebx
mov byte [esp + 0x20], bl
cmp dword [esp + 0xd4], ebp
jae 0x1000276d
lea eax, [esp + 0xc0]
mov ecx, dword [esp + 0xd0]
push ecx
push eax
lea edx, [esp + 0xfc]
push edx
call fcn.10011139
call fcn.10011d0a
mov esi, eax
cmp esi, ebx
je 0x100027c4
push esi
push 4
lea eax, [esp + 0xfc]
push eax
call dword [sym.imp.ADVAPI32.dll_SetFileSecurityW]
mov eax, dword [esi + 0x18]
cmp eax, ebx
je 0x100027ad
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [esi + 0x14]
cmp eax, ebx
je 0x100027bb
push eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
push esi
call fcn.100229a9
add esp, 4
mov eax, dword [esp + 0xa4]
cmp dword [esp + 0xb8], edi
jae 0x100027db
lea eax, [esp + 0xa4]
lea ecx, [esp + 0xf4]
push ecx
push eax
push str.__ls___common__ls
lea esi, [esp + 0x90]
call fcn.100121cc
add esp, 0xc
push ebx
mov byte [esp + 0x514], 0x24
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [esp + 0x88]
cmp dword [esp + 0x9c], edi
jae 0x1000281e
lea eax, [esp + 0x88]
push eax
call fcn.100118d9
mov esi, eax
cmp esi, ebx
jne 0x1000286b
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 5
je 0x10002844
call esi
cmp eax, 0x522
jne 0x1000296b
mov eax, dword [esp + 0x88]
cmp dword [esp + 0x9c], edi
jae 0x1000285b
lea eax, [esp + 0x88]
push eax
call fcn.1001178c
mov esi, eax
cmp esi, ebx
je 0x1000296b
mov edi, dword [esp + 0x80]
cmp edi, ebx
je 0x10002896
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x1000288e
mov dword [edi], 0x3f2
jmp 0x10002896
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, 8
cmp dword [esp + 0x9c], edi
jb 0x100028bb
mov edx, dword [esp + 0x88]
push edx
call fcn.100229a9
add esp, 4
xor eax, eax
mov dword [esp + 0x9c], 7
mov dword [esp + 0x98], ebx
mov word [esp + 0x88], ax
cmp dword [esp + 0xd4], ebp
jb 0x100028f0
mov ecx, dword [esp + 0xc0]
push ecx
call fcn.100229a9
add esp, 4
mov esi, 0xf
mov dword [esp + 0xd4], esi
mov dword [esp + 0xd0], ebx
mov byte [esp + 0xc0], bl
cmp dword [esp + 0xf0], ebp
jb 0x10002923
mov edx, dword [esp + 0xdc]
push edx
call fcn.100229a9
add esp, 4
mov dword [esp + 0xf0], esi
lea esi, [esp + 0x54]
mov dword [esp + 0xec], ebx
mov byte [esp + 0xdc], bl
mov byte [esp + 0x510], bl
call fcn.10019017
cmp dword [esp + 0xb8], edi
jb 0x10002961
mov eax, dword [esp + 0xa4]
push eax
call fcn.100229a9
add esp, 4
mov eax, 1
jmp 0x10002a54
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push str.ShowClientNotify_failed:
call esi
mov ecx, dword [esp + 0x7c]
push ecx
call esi
cmp dword [esp + 0x9c], edi
jb 0x10002998
mov edx, dword [esp + 0x88]
push edx
call fcn.100229a9
add esp, 4
xor eax, eax
mov dword [esp + 0x9c], 7
mov dword [esp + 0x98], ebx
mov word [esp + 0x88], ax
cmp dword [esp + 0xd4], ebp
jb 0x100029cd
mov ecx, dword [esp + 0xc0]
push ecx
call fcn.100229a9
add esp, 4
mov esi, 0xf
mov dword [esp + 0xd4], esi
mov dword [esp + 0xd0], ebx
mov byte [esp + 0xc0], bl
cmp dword [esp + 0xf0], ebp
jb 0x10002a00
mov edx, dword [esp + 0xdc]
push edx
call fcn.100229a9
add esp, 4
mov dword [esp + 0xf0], esi
lea esi, [esp + 0x54]
mov dword [esp + 0xec], ebx
mov byte [esp + 0xdc], bl
mov byte [esp + 0x510], bl
call fcn.10019017
cmp dword [esp + 0xb8], edi
jb 0x10002a52
mov eax, dword [esp + 0xa4]
push eax
jmp 0x10002a4a
cmp dword [esp + 0xb8], 8
jb 0x10002a52
mov ecx, dword [esp + 0xa4]
push ecx
call fcn.100229a9
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x508]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x4f0]
xor ecx, esp
call fcn.1002259f
add esp, 0x500
ret