Function at 0xf01cb60
Capabilities:
Get common file path
Terminate process

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
xor ebx, ebx
push ebx
push 4
lea eax, [ebp + 0xc]
push eax
push 0x13
mov dword [ebp - 4], ebx
mov dword [ebp + 0xc], ebx
mov dword [0xf20882c], 0xf0b0538
mov dword [0xf208830], 0xf0b0bf4
mov dword [0xf208828], 0xf0b07f4
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ntdll.dll_NtQueryInformationProcess]
cmp dword [ebp + 0xc], ebx
push ebx
jne 0xf01cbb6
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov esi, dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push ebx
call esi
cmp eax, ebx
mov dword [0xf0bd828], eax
jne 0xf01cbf0
push 0xf00240c
push 1
push 1
call fcn.0f03d89e
call fcn.0f0a8180
jmp 0xf01cbeb
push 0xf001a8a
push 3
push 7
call fcn.0f03d89e
mov eax, dword [0xf0bd828]
inc eax
push eax
call fcn.0f009d40
cmp eax, ebx
pop ecx
mov dword [0xf0bd824], eax
je 0xf01cbdd
mov ecx, dword [0xf0bd828]
inc ecx
push ecx
push eax
call esi
cmp eax, ebx
mov dword [0xf0bd828], eax
jne 0xf01cc28
push 0xf0023f0
push 1
push 1
call fcn.0f03d89e
call fcn.0f0a8180
push dword [0xf0bd824]
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.ntdll.dll_RtlInitAnsiString]
push 1
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.ntdll.dll_RtlAnsiStringToUnicodeString]
test eax, eax
jge 0xf01cc5f
push 0xf0023d4
push 1
push 1
call fcn.0f03d89e
call fcn.0f0a8180
mov eax, dword [ebp - 0x14]
mov dword [0xf0bd82c], eax
mov eax, dword [ebp + 8]
dec eax
cmp eax, ebx
jle 0xf01cd59
mov dword [ebp + 8], eax
jmp 0xf01cc7b
mov edi, dword [ebp - 8]
add edi, 4
mov esi, dword [edi]
mov al, byte [esi]
cmp al, 0x2d
mov dword [ebp - 8], edi
je 0xf01cc91
cmp al, 0x2f
jne 0xf01cd50
inc esi
mov al, byte [esi]
cmp al, 0x45
jne 0xf01ccfa
mov eax, str.EyeStrain
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0xf01cca0
sub eax, edx
mov edi, eax
push edi
push str.EyeStrain
push esi
call fcn.0f09aed0
add esp, 0xc
test eax, eax
jne 0xf01cd50
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0xf01ccc7
sub eax, edx
lea ecx, [edi + 2]
cmp eax, ecx
jne 0xf01cd50
push 0x10
push ebx
add edi, esi
push edi
call fcn.0f00e210
add esp, 0xc
cmp ax, 0xfe
mov word [0xf0c2624], ax
jbe 0xf01cd50
mov word [0xf0c2624], bx
jmp 0xf01cd50
movsx eax, al
push eax
call fcn.0f015a40
cmp eax, 0x77
pop ecx
jne 0xf01cd2a
xor edi, edi
inc edi
mov dword [0xf0bd814], edi
movsx eax, byte [esi + 1]
push eax
call fcn.0f015a40
cmp eax, 0x73
pop ecx
jne 0xf01cd50
mov dword [sym.ntvdm.exe_fSeparateWow], edi
jmp 0xf01cd50
mov al, byte [esi]
cmp al, 0x6f
jne 0xf01cd38
mov dword [0xf0b0308], ebx
jmp 0xf01cd50
inc esi
cmp al, 0x69
jne 0xf01cd50
cmp byte [esi], bl
je 0xf01cd50
push 0x10
push ebx
push esi
call fcn.0f00e210
add esp, 0xc
mov dword [ebp - 4], eax
dec dword [ebp + 8]
jne 0xf01cc78
cmp word [0xf0c2624], bx
jne 0xf01cd90
push str.EyeStrain
call fcn.0f01dc27
cmp eax, ebx
pop ecx
je 0xf01cd90
push 0x10
push ebx
push eax
call fcn.0f00e210
add esp, 0xc
cmp ax, 0xfe
mov word [0xf0c2624], ax
jbe 0xf01cd90
mov word [0xf0c2624], bx
mov ecx, dword [ebp - 4]
cmp ecx, ebx
mov eax, dword [0xf0bd814]
je 0xf01cdb6
cmp eax, ebx
je 0xf01cdb0
cmp dword [sym.ntvdm.exe_fSeparateWow], ebx
jne 0xf01cdb0
mov dword [0xf0bd820], ecx
jmp 0xf01cdb6
mov dword [0xf0bd81c], ecx
cmp eax, ebx
je 0xf01cdcc
push 0x4e20
call sub.USER32.dll_ShowStartGlass
mov dword [0xf0b0308], ebx
jmp 0xf01cdd9
cmp dword [0xf0b0308], ebx
je 0xf01cdd9
call fcn.0f022ab2
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 2
push ebx
push ebx
push 0xf22a720
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
call fcn.0f010c8b
call fcn.0f007806
call fcn.0f00dda6
call fcn.0f010cde
pop edi
pop esi
pop ebx
leave
ret 8