Function at 0x1006c260
Capabilities:
Get common file path
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x18]
push esi
push edi
mov edi, dword [ebp + 0x10]
push 0
mov dword [ebp - 0x40c], edx
mov dword [ebp - 0x408], eax
call dword [sym.imp.ole32.dll_CoInitialize]
xor esi, esi
mov dword [0x100e2f00], 0
push esi
push 0x23
xorps xmm0, xmm0
push 0x100e3304
push esi
movdqa xmmword [0x100e2ed0], xmm0
movdqa xmmword [0x100e2ee0], xmm0
movdqa xmmword [0x100e2ef0], xmm0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
js 0x1006c309
mov esi, 0x100e3304
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x1006c2d5
sub esi, ecx
sar esi, 1
je 0x1006c309
cmp word [esi*2 + 0x100e3302], 0x5c
je 0x1006c309
mov eax, 0x5c
mov word [esi*2 + 0x100e3304], ax
inc esi
xor eax, eax
mov word [esi*2 + 0x100e3304], ax
mov eax, dword [ebp - 0x40c]
xorps xmm0, xmm0
push 0x400
push dword [ebp - 0x408]
mov dword [0x100e3b04], esi
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0
mov dword [0x100e3b1c], 0
movlpd qword [0x100e3b20], xmm0
mov dword [0x100e3b28], 0
mov dword [0x100e3b08], 1
mov dword [0x100e3b2c], 0
mov dword [0x100e3b30], eax
mov dword [0x100e3b34], 0
mov dword [0x100e3b38], 0
mov dword [0x100e3b44], 0
mov dword [0x100e3b50], 0
mov dword [0x100e3b60], 0
mov dword [0x100e3b64], 0
mov dword [0x100e3b68], 0
call esi
push 0x400
push edi
push dword [ebp - 0x40c]
call esi
push 0x400
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x1006c3e2
mov ecx, str._rundll32.exe
lea edx, [eax + eax]
sub edx, ecx
add edx, ebx
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [ecx + edx - 2], ax
test ax, ax
jne 0x1006c3d2
lea ecx, [ebp - 0x404]
sub ecx, edi
lea ebx, [ebx]
movzx eax, word [edi]
lea edi, [edi + 2]
mov word [edi + ecx - 2], ax
test ax, ax
jne 0x1006c3f0
lea eax, [ebp - 0x404]
push 0x5c
push eax
call fcn.1007b43d
mov esi, eax
add esp, 8
test esi, esi
je 0x1006c6f6
add esi, 2
mov ecx, str.hypertrm.exe
mov edx, esi
sub edx, ecx
jmp 0x1006c430
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [ecx + edx - 2], ax
test ax, ax
jne 0x1006c430
push 0x2e
push esi
call fcn.1007b43d
mov edx, eax
add esp, 8
test edx, edx
je 0x1006c6c3
mov ecx, 0x100c688c
sub edx, ecx
lea esp, [esp]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [ecx + edx], ax
test ax, ax
jne 0x1006c460
push 0
push 0x80
push 3
push 0
push 0
push SysReAllocString
lea eax, [ebp - 0x404]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x1006c6c3
push 0
lea eax, [ebp - 0x410]
push eax
push 0x400
lea eax, [ebp - 0x404]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x408]
mov dword [ebp - 0x408], 0x400
push eax
push 0x100e2f04
push 0xa
push str.12306
mov edx, 0x400
lea ecx, [ebp - 0x404]
call fcn.1005d0c0
movzx eax, word [0x100e2f04]
mov ecx, 0x100e2f34
mov word [0x100e3ba0], ax
add esp, 0x10
movzx eax, word [0x100e2f06]
mov word [0x100e3ba4], ax
movzx eax, byte [0x100e2f08]
lea edx, [ecx + 2]
mov dword [0x100e3ba8], eax
movzx eax, byte [0x100e2f09]
mov dword [0x100e3bac], eax
movzx eax, word [0x100e2f0a]
mov word [0x100e3bb0], ax
movzx eax, word [0x100e2f0c]
mov word [0x100e3bb4], ax
movzx eax, word [0x100e2f0e]
mov word [0x100e3bb8], ax
movzx eax, word [0x100e2f10]
mov word [0x100e3b7c], ax
movzx eax, word [0x100e2f12]
mov word [0x100e3b7e], ax
mov eax, dword [0x100e2f14]
mov dword [0x100e3b80], eax
mov eax, dword [0x100e2f18]
mov dword [0x100e3b84], eax
mov eax, dword [0x100e2f1c]
mov dword [0x100e3b88], eax
mov eax, dword [0x100e2f20]
mov dword [0x100e3b8c], eax
mov eax, dword [0x100e2f24]
mov dword [0x100e3b90], eax
mov eax, dword [0x100e2f28]
mov dword [0x100e3b94], eax
mov eax, dword [0x100e2f2c]
mov dword [0x100e3b98], eax
mov eax, dword [0x100e2f30]
mov dword [0x100e3b9c], eax
mov dword [0x100e3b78], 0x100e2f34
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1006c5c1
sub ecx, edx
sar ecx, 1
lea edx, [ecx*2 + 0x100e2f36]
mov ecx, edx
mov dword [0x100e3bbc], edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1006c5e2
sub ecx, esi
add edx, 2
sar ecx, 1
lea eax, [ecx + ecx]
add edx, eax
mov dword [0x100e3bc0], eax
mov ecx, edx
mov dword [0x100e3bc4], edx
lea esi, [ecx + 1]
lea esp, [esp]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1006c610
sub ecx, esi
add edx, ecx
mov ax, word [edx + 1]
add edx, 3
mov ecx, edx
mov word [0x100e3bc8], ax
mov dword [0x100e3bcc], edx
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1006c633
sub ecx, esi
inc ecx
add edx, ecx
mov ecx, edx
mov dword [0x100e3bd0], edx
lea esi, [ecx + 1]
lea ebx, [ebx]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1006c650
sub ecx, esi
inc edx
add edx, ecx
mov ecx, edx
mov dword [0x100e3bd4], edx
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1006c667
sub ecx, esi
inc edx
add edx, ecx
mov ecx, edx
mov dword [0x100e3bd8], edx
lea esi, [ecx + 1]
mov edi, edi
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1006c680
sub ecx, esi
mov esi, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x100e3be0
mov eax, dword [ecx + edx + 1]
mov dword [0x100e3bdc], eax
call esi
push 0x100e3bf8
call esi
push 0x100e3c10
call esi
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1007a730
mov esp, ebp
pop ebp
ret
push str.UniqueUDiskWather
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
test eax, eax
je 0x1006c6f6
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov eax, 2
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1007a730
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1007a730
mov esp, ebp
pop ebp
ret