Function at 0x1017fa30
Capabilities:
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x834
mov eax, dword [0x102519c8]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, ecx
mov eax, dword [edi + 8]
test eax, eax
je 0x1017fa66
cmp dword [edi], 0
je 0x1017fa66
mov eax, 1
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101f99c6
mov esp, ebp
pop ebp
ret
push ebx
mov ebx, dword [sym.imp.SHLWAPI.dll_PathAppendW]
push esi
test eax, eax
jne 0x1017fbdc
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
push dword [0x10257d10]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push str...deepscan_
lea eax, [ebp - 0x20c]
push eax
call ebx
push str.360Quarant.dll
lea eax, [ebp - 0x20c]
push eax
call ebx
call fcn.10003180
mov esi, dword [eax + 0x154]
test esi, esi
je 0x1017fad6
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0xe
call fcn.10003680
add esp, 4
test eax, eax
je 0x1017faef
lea ecx, [ebp - 0x20c]
push ecx
call eax
jmp 0x1017fafc
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 0x818], eax
test esi, esi
je 0x1017fb0d
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [ebp - 0x818]
cmp eax, 0xffffffff
je 0x1017fd9c
test al, 0x10
jne 0x1017fd9c
lea eax, [ebp - 0x20c]
push 1
push eax
call fcn.10034be0
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
add esp, 8
test eax, eax
jne 0x1017fb43
xor eax, eax
jmp 0x1017fb4c
lea eax, [ebp - 0x20c]
push eax
call esi
push 0x208
mov dword [edi + 8], eax
lea eax, [ebp - 0x414]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x414]
push 0x104
push eax
push dword [0x10257d10]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push str...deepscan_
lea eax, [ebp - 0x414]
push eax
call ebx
push str.360Quarantplugin.dll
lea eax, [ebp - 0x414]
push eax
call ebx
lea eax, [ebp - 0x414]
push eax
call fcn.1000aa00
add esp, 4
test eax, eax
je 0x1017fd9c
lea eax, [ebp - 0x414]
push 1
push eax
call fcn.10034be0
add esp, 8
test eax, eax
je 0x1017fbce
lea eax, [ebp - 0x414]
push eax
call esi
mov dword [edi + 0xc], eax
mov eax, dword [edi + 8]
test eax, eax
je 0x1017fd9c
cmp dword [edi + 0xc], 0
je 0x1017fd9c
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.CreateQuarantObject
push eax
call esi
push str.CreateQuarantObject
push dword [edi + 0xc]
mov dword [edi], eax
call esi
mov dword [edi + 4], eax
mov ecx, edi
lea eax, [edi + 0x10]
push eax
push 0x1021b810
mov dword [ebp - 0x824], eax
call fcn.1017de00
cmp dword [edi + 0x10], 0
je 0x1017fd7e
mov eax, dword [0x1025b448]
cmp dword [eax - 0xc], 0
jne 0x1017fca1
push 0x400
lea eax, [ebp - 0x814]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x814]
push 0
push 0x1a
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x1017fd9c
push str.360Quarant
lea eax, [ebp - 0x814]
push eax
call ebx
test eax, eax
je 0x1017fd9c
lea ecx, [ebp - 0x814]
lea edx, [ecx + 2]
mov edi, edi
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1017fc80
sub ecx, edx
lea eax, [ebp - 0x814]
sar ecx, 1
push ecx
push eax
mov ecx, 0x1025b448
call fcn.10003740
mov eax, dword [0x1025b44c]
cmp dword [eax - 0xc], 0
jne 0x1017fcc6
xor esi, esi
mov dword [ebp - 0x820], 1
mov dword [ebp - 0x818], esi
mov dword [ebp - 0x81c], esi
jmp 0x1017fcf4
push eax
lea ecx, [ebp - 0x828]
call fcn.10122170
mov esi, dword [ebp - 0x828]
mov dword [ebp - 0x820], 0
mov dword [ebp - 0x81c], 2
mov eax, dword [eax]
mov dword [ebp - 0x818], eax
push dword [0x1025b47c]
lea ecx, [ebp - 0x834]
call fcn.10122170
push dword [0x1025bac4]
lea ecx, [ebp - 0x830]
mov ebx, dword [eax]
call fcn.10122170
push dword [0x1025b448]
lea ecx, [ebp - 0x82c]
mov edi, dword [eax]
call fcn.10122170
push dword [ebp - 0x818]
mov ecx, dword [ebp - 0x824]
push ebx
push edi
push dword [eax]
mov ecx, dword [ecx]
push ecx
mov edx, dword [ecx]
call dword [edx + 0xc]
push dword [ebp - 0x82c]
mov edi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
call edi
push dword [ebp - 0x830]
call edi
push dword [ebp - 0x834]
call edi
cmp dword [ebp - 0x81c], 0
je 0x1017fd72
push dword [ebp - 0x828]
call edi
cmp dword [ebp - 0x820], 0
je 0x1017fd7e
push esi
call edi
mov ecx, dword [ebp - 0x824]
xor eax, eax
pop esi
pop ebx
pop edi
cmp dword [ecx], eax
setne al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101f99c6
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop esi
pop ebx
xor ecx, ebp
pop edi
call fcn.101f99c6
mov esp, ebp
pop ebp
ret