Function at 0x10015ed
Capabilities:
Check os version
Get common file path
Set current directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x358
mov eax, dword [0x105b088]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
xor ebx, ebx
push ebx
push ebx
push 1
push ebx
mov dword [ebp - 0x328], eax
call dword [sym.imp.KERNEL32.dll_HeapSetInformation]
mov esi, dword [sym.imp.msvcrt.dll__wcsicmp]
push 0x1001914
push edi
call esi
neg eax
sbb al, al
inc al
push 0x10018fc
push edi
mov byte [ebp - 0x321], al
call esi
add esp, 0x10
test eax, eax
jne 0x101c7c8
mov eax, dword [0x105b0f8]
or eax, dword [0x105b0fc]
mov dword [ebp - 0x32c], ebx
jne 0x1001723
cmp byte [0x105b080], bl
jne 0x10016fd
lea eax, [ebp - 0x320]
push eax
mov dword [ebp - 0x320], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x100169c
cmp dword [ebp - 0x31c], 6
setb al
mov byte [0x105b081], al
cmp al, bl
jne 0x10016f6
push 0x1014e40
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edi, eax
cmp edi, ebx
je 0x1018871
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x1014e34
push edi
call esi
mov dword [0x105b098], eax
cmp eax, ebx
je 0x1018871
push 0x1014e24
push edi
call esi
mov dword [0x105b084], eax
cmp eax, ebx
je 0x101c7dc
push 0x1014e14
push edi
call esi
mov dword [0x105b09c], eax
cmp eax, ebx
je 0x101c7dc
mov byte [0x105b080], 1
cmp byte [0x105b081], bl
jne 0x101c7eb
push 0x105b0f8
push 0x105b6e0
push 0x1014eaf
push 0x1014e04
call dword [0x105b084]
mov edi, 0x10000
cmp dword [0x105b704], ebx
je 0x1001758
mov al, byte [0x105b708]
cmp byte [0x105b081], bl
jne 0x101c82d
cmp al, 4
jb 0x101887d
mov eax, dword [0x105b6f0]
and eax, edi
or eax, ebx
jne 0x101c847
cmp byte [ebp - 0x321], bl
jne 0x101c884
push ebx
push 0x1001914
call dword [sym.imp.KERNEL32.dll_RegisterApplicationRestart]
mov esi, 0x104
push esi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, ebx
je 0x1001798
cmp eax, esi
jae 0x1001798
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
push ebx
call dword [sym.imp.ole32.dll_OleInitialize]
push ebx
push 8
pop esi
push esi
push ebx
push 3
push 2
push ebx
push ebx
push 0xffffffffffffffff
push 0x1001930
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
call fcn.0101508d
test al, al
jne 0x101c8b7
lea eax, [ebp - 0x33c]
push eax
mov dword [ebp - 0x33c], esi
mov dword [ebp - 0x338], 0x24
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
push 0x1001920
push dword [ebp - 0x328]
mov esi, 0x105b128
push 0x105bb08
mov ecx, esi
call fcn.01015f79
push 5
push 4
mov ecx, esi
call fcn.01015be4
test eax, eax
jl 0x1001813
call dword [sym.imp.ole32.dll_CoResumeClassObjects]
call fcn.01014d5e
test al, al
jne 0x101c98d
lea ecx, [ebp - 0x2c4]
call fcn.0101693d
lea ecx, [ebp - 0x2c4]
call fcn.01014011
test eax, eax
je 0x101c9f1
cmp byte [ebp - 0x321], bl
jne 0x101c9ba
push 0x6d
push dword [0x105b718]
call dword [sym.imp.USER32.dll_LoadAcceleratorsW]
mov esi, dword [sym.imp.USER32.dll_GetMessageW]
push ebx
push ebx
mov dword [ebp - 0x328], eax
push ebx
lea eax, [ebp - 0x358]
push eax
call esi
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x32c], eax
je 0x10187c0
cmp eax, 0xffffffff
je 0x10018d4
lea eax, [ebp - 0x358]
push eax
push dword [ebp - 0x328]
push dword [ebp - 0x2c0]
call dword [sym.imp.USER32.dll_TranslateAcceleratorW]
test eax, eax
jne 0x10018d4
lea eax, [ebp - 0x358]
push eax
lea ecx, [ebp - 0x2c4]
call fcn.010019c9
test eax, eax
jne 0x10018d4
lea eax, [ebp - 0x358]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x358]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push ebx
push ebx
push ebx
lea eax, [ebp - 0x358]
push eax
call esi
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x32c], eax
je 0x10187c0
mov eax, dword [ebp - 0x32c]
jmp 0x1001882
lea ecx, [ebp - 0x2c4]
call fcn.0101896b
mov eax, dword [0x105b0a8]
cmp eax, ebx
jne 0x101ca17
cmp dword [0x105b704], ebx
je 0x1018808
mov al, byte [0x105b708]
cmp byte [0x105b081], bl
jne 0x101ca35
cmp al, 4
jb 0x101888a
mov eax, dword [0x105b6f0]
and eax, edi
or eax, ebx
jne 0x101ca4f
cmp byte [0x105b080], bl
je 0x1018841
mov esi, dword [0x105b0f8]
mov eax, dword [0x105b0fc]
mov ecx, esi
or ecx, eax
je 0x1018841
cmp byte [0x105b081], bl
jne 0x101ca8c
push eax
push esi
call dword [0x105b09c]
mov dword [0x105b0f8], ebx
mov dword [0x105b0fc], ebx
mov esi, 0x105b128
mov ecx, esi
call fcn.01018752
mov ecx, esi
call fcn.0101889c
call dword [sym.imp.ole32.dll_OleUninitialize]
mov eax, dword [ebp - 0x32c]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01001945
leave
ret 0x10
mov byte [0x105b081], 1
jmp 0x10016f6
cmp al, bl
je 0x1001749
jmp 0x1001758
cmp al, bl
je 0x10187f9
jmp 0x1018808
cmp byte [ebp - 0x321], bl
jne 0x100164b
or eax, 0xffffffff
jmp 0x1018860
mov dword [0x105b084], 0x1027443
jmp 0x1018871
mov ecx, 0x105b6e0
push ecx
push ebx
mov eax, ecx
cdq
push ebx
mov dword [0x105b0fc], edx
lea edx, [ebp - 0x334]
push edx
push 1
mov dword [0x105b0f8], eax
mov eax, 0x1014e04
push eax
push ecx
push 0x10273d1
mov dword [ebp - 0x334], eax
mov dword [ebp - 0x330], ebx
call dword [sym.imp.ADVAPI32.dll_RegisterTraceGuidsW]
jmp 0x1001723
cmp al, 4
jae 0x101c839
cmp al, bl
jne 0x1001758
test dword [0x105b700], edi
je 0x1001758
jmp 0x101c864
mov eax, dword [0x105b6f8]
mov ecx, eax
and ecx, edi
cmp ecx, eax
jne 0x1001758
cmp ebx, dword [0x105b6fc]
jne 0x1001758
push 0x101fb34
push 0x101cab0
push dword [0x105b0fc]
push dword [0x105b0f8]
call fcn.01027bd1
jmp 0x1001758
push 4
call fcn.01003860
pop ecx
cmp eax, ebx
je 0x101c899
mov ecx, eax
call fcn.0103837f
jmp 0x101c89b
xor eax, eax
cmp eax, ebx
je 0x1001764
mov ecx, eax
call fcn.010386e4
test al, al
jne 0x1001764
jmp 0x101c7d4
lea eax, [ebp - 0x32c]
push eax
push 0x101cae0
push 1
push ebx
push 0x101caf0
mov dword [ebp - 0x32c], ebx
call dword [sym.imp.ole32.dll_CoCreateInstance]
cmp eax, ebx
jl 0x101c907
mov esi, dword [ebp - 0x32c]
push 0x1012484
lea ecx, [ebp - 0x328]
call fcn.010095cb
push dword [eax]
mov ecx, dword [esi]
push esi
call dword [ecx + 0xc]
push dword [ebp - 0x328]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
jmp 0x101c976
cmp dword [0x105b704], ebx
je 0x101c976
mov cl, byte [0x105b708]
cmp byte [0x105b081], bl
je 0x101c926
cmp cl, 2
jae 0x101c95a
cmp cl, bl
jmp 0x101c958
cmp cl, 2
jae 0x101c92f
cmp cl, bl
jne 0x101c976
mov edx, dword [0x105b6f4]
mov esi, 0x80000000
and edx, esi
xor ecx, ecx
or ecx, edx
je 0x101c976
mov edx, dword [0x105b6fc]
mov ecx, edx
and ecx, esi
xor esi, esi
cmp esi, dword [0x105b6f8]
jne 0x101c976
cmp ecx, edx
jne 0x101c976
push eax
push 0x101fb64
push 0x101cad0
push dword [0x105b0fc]
push dword [0x105b0f8]
call fcn.01008628
mov eax, dword [ebp - 0x32c]
cmp eax, ebx
je 0x101c986
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
xor eax, eax
jmp 0x1018860
push ebx
push 0xfffd
push 1
push 0xdb
push 0xda
push 0x67
push dword [ebp - 0x328]
push ebx
call dword [sym.imp.COMCTL32.dll_Ordinal_344]
or dword [ebp - 0x32c], 0xffffffff
jmp 0x10187cb
push ecx
mov ecx, esp
mov dword [ebp - 0x328], esp
push 0x1012484
call fcn.010095cb
push ebx
lea ecx, [ebp - 0x2c4]
call fcn.0100f75f
push ebx
push ebx
push 0x700
push dword [ebp - 0x2c0]
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x100184a
lea ecx, [ebp - 0x328]
call fcn.01027c68
lea ecx, [ebp - 0x328]
call fcn.01027cdd
lea ecx, [ebp - 0x328]
call fcn.01027c76
jmp 0x10187c0
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push dword [0x105b0a8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x105b0a8], ebx
jmp 0x10187d8
cmp al, 4
jae 0x101ca41
cmp al, bl
jne 0x1018808
test dword [0x105b700], edi
je 0x1018808
jmp 0x101ca6c
mov eax, dword [0x105b6f8]
mov ecx, eax
and ecx, edi
cmp ecx, eax
jne 0x1018808
cmp ebx, dword [0x105b6fc]
jne 0x1018808
push 0x101fb44
push 0x101cac0
push dword [0x105b0fc]
push dword [0x105b0f8]
call fcn.01027bd1
jmp 0x1018808
push dword [esi + 4]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_UnregisterTraceGuids]
mov dword [esi + 0x20], ebx
mov byte [esi + 0x28], bl
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi], ebx
mov dword [esi + 4], ebx
jmp 0x1018835