Function at 0x100f2af0
Capabilities:
Check if file exists
Check mutex on windows
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x55c
mov eax, dword [0x10222354]
xor eax, ebp
mov dword [ebp - 0xc], eax
push esi
mov dword [ebp - 0x540], 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.10105450
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], 0
je 0x100f3428
lea ecx, [ebp - 0x274]
call fcn.1000b9c0
mov dx, word [0x101ccf7c]
mov word [ebp - 0x480], dx
push 0x1fe
push 0
lea eax, [ebp - 0x47e]
push eax
call fcn.10166680
add esp, 0xc
mov dword [ebp - 0x270], pe_nt_image_headers32
lea ecx, [ebp - 0x270]
push ecx
lea edx, [ebp - 0x480]
push edx
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x100f2b8b
lea eax, [ebp - 0x480]
push eax
lea ecx, [ebp - 0x274]
call fcn.1000baa0
lea ecx, [ebp - 0x26c]
call fcn.1000b9c0
lea ecx, [ebp - 0x274]
call fcn.10007fa0
push eax
mov ecx, dword [str.Global_s_deskbar]
push ecx
lea edx, [ebp - 0x26c]
push edx
call fcn.1000adf0
add esp, 0xc
mov dword [ebp - 0x27c], 0
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea ecx, [ebp - 0x26c]
call fcn.10007f90
push eax
push 1
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
mov dword [ebp - 0x27c], eax
cmp dword [ebp - 0x27c], 0
jne 0x100f2c19
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x100f2c19
lea ecx, [ebp - 0x26c]
call fcn.10007f90
push eax
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [ebp - 0x27c], eax
mov eax, dword [0x10228cb4]
add eax, 1
mov dword [0x10228cb4], eax
call fcn.10105090
movzx ecx, byte [0x10224a58]
test ecx, ecx
jne 0x100f2dbd
push str._mutex0
lea edx, [ebp - 0x274]
push edx
push 0x101ccf90
push 0x10224a04
push 0x101ccf94
lea eax, [ebp - 0x4cc]
push eax
call fcn.1001e050
add esp, 0xc
push eax
lea ecx, [ebp - 0x4d0]
push ecx
call fcn.1008d070
add esp, 0xc
push eax
lea edx, [ebp - 0x4d4]
push edx
call fcn.10007ea0
add esp, 0xc
push eax
lea eax, [ebp - 0x484]
push eax
call fcn.1008d070
add esp, 0xc
lea ecx, [ebp - 0x4d4]
call fcn.1000ba80
lea ecx, [ebp - 0x4d0]
call fcn.1000ba80
lea ecx, [ebp - 0x4cc]
call fcn.1000ba80
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea ecx, [ebp - 0x484]
call fcn.10007f90
push eax
push 1
push 1
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x88], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x100f2db2
lea ecx, [ebp - 0x484]
call fcn.10007f90
push eax
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov edx, dword [ebp + 8]
mov dword [edx + 0x88], eax
push 0
push ecx
mov eax, esp
mov dword [ebp - 0x4d8], esp
push 1
push eax
call fcn.100de0f0
add esp, 8
call fcn.10102b90
add esp, 8
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x5e4], 1
call fcn.100e10e0
push ecx
mov ecx, esp
mov dword [ebp - 0x4dc], esp
push 0x101ccfa4
call fcn.1000ba00
push ecx
mov esi, esp
mov dword [ebp - 0x4e0], esp
push ecx
mov ecx, esp
mov dword [ebp - 0x4e4], esp
push 0x101ccfa8
call fcn.1000ba00
push ecx
mov ecx, esp
mov dword [ebp - 0x4e8], esp
push 0x101ccfac
call fcn.1000ba00
push ecx
mov ecx, esp
mov dword [ebp - 0x4ec], esp
push 0x101ccfb0
call fcn.1000ba00
push esi
call fcn.100dd430
add esp, 0xc
mov ecx, esp
mov dword [ebp - 0x4f0], esp
push str.additional_xml
call fcn.1000ba00
call fcn.100dd780
add esp, 0xc
lea ecx, [ebp - 0x484]
call fcn.1000ba80
lea ecx, [ebp - 0x278]
call fcn.10105940
mov edx, dword [ebp + 8]
mov dword [edx + 0x5ac], 0
lea ecx, [ebp - 0x278]
call fcn.10105990
push eax
push 0x101e8df0
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ecx]
call eax
test eax, eax
jl 0x100f2e26
lea ecx, [ebp - 0x278]
call fcn.101059a0
mov dword [ebp - 0x544], eax
mov ecx, dword [ebp + 8]
add ecx, 0x5ac
push ecx
mov edx, dword [ebp - 0x544]
push edx
mov eax, dword [ebp - 0x544]
mov ecx, dword [eax]
mov edx, dword [ecx + 0xc]
call edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x5ac]
push ecx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x100f2e70
mov dword [ebp - 0x4f4], 0x80004005
lea ecx, [ebp - 0x278]
call fcn.10104b90
lea ecx, [ebp - 0x26c]
call fcn.1000ba80
lea ecx, [ebp - 0x274]
call fcn.1000ba80
mov eax, dword [ebp - 0x4f4]
jmp 0x100f35b7
mov edx, dword [ebp + 0xc]
push edx
lea ecx, [ebp - 8]
call fcn.100d97b0
mov eax, dword [ebp + 8]
cmp dword [eax + 0x5b4], 0
je 0x100f2e95
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x5b4], 0
lea ecx, [ebp - 8]
call fcn.100c4710
mov dword [ebp - 0x548], eax
mov edx, dword [ebp + 8]
add edx, 0x5b4
push edx
push 0x101e8f50
push 0x101e8f40
mov eax, dword [ebp - 0x548]
push eax
mov ecx, dword [ebp - 0x548]
mov edx, dword [ecx]
mov eax, dword [edx + 0xc]
call eax
test eax, eax
jge 0x100f2fca
mov ecx, dword [ebp + 8]
add ecx, 0x5b4
push ecx
push 0x101e8f50
push 1
push 0
push 0x101e8f80
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jge 0x100f2f38
mov dword [ebp - 0x4f8], 0x80004005
lea ecx, [ebp - 8]
call fcn.100d9610
lea ecx, [ebp - 0x278]
call fcn.10104b90
lea ecx, [ebp - 0x26c]
call fcn.1000ba80
lea ecx, [ebp - 0x274]
call fcn.1000ba80
mov eax, dword [ebp - 0x4f8]
jmp 0x100f35b7
mov edx, dword [ebp + 8]
mov byte [edx + 0x5cc], 1
push 0x101cd000
lea ecx, [ebp - 0x4fc]
call fcn.10007b00
push eax
lea ecx, [ebp - 0x4a8]
call fcn.1001d870
lea ecx, [ebp - 0x4fc]
call fcn.10009fb0
lea ecx, [ebp - 0x498]
call fcn.10016fb0
lea eax, [ebp - 0x498]
push eax
lea ecx, [ebp - 0x498]
push ecx
lea edx, [ebp - 0x498]
push edx
lea eax, [ebp - 0x498]
push eax
lea ecx, [ebp - 0x4a8]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x5b4]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x5b4]
mov eax, dword [eax]
push edx
mov ecx, dword [eax + 0xd0]
call ecx
lea ecx, [ebp - 0x498]
call fcn.10016fd0
lea ecx, [ebp - 0x4a8]
call fcn.10016fd0
mov dx, word [0x101cd018]
mov word [ebp - 0x268], dx
push 0x256
push 0
lea eax, [ebp - 0x266]
push eax
call fcn.10166680
add esp, 0xc
push 0x12c
lea ecx, [ebp - 0x268]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x5ac]
push eax
call dword [sym.imp.USER32.dll_GetClassNameW]
push str.ReBarWindow32
lea ecx, [ebp - 0x268]
push ecx
call fcn.10166776
add esp, 8
test eax, eax
je 0x100f3149
push 0x101cd038
push ecx
mov ecx, esp
mov dword [ebp - 0x504], esp
push 0x101cd03c
call fcn.1000ba00
push ecx
mov ecx, esp
mov dword [ebp - 0x508], esp
push 0x101cd040
call fcn.1000ba00
push ecx
mov ecx, esp
mov dword [ebp - 0x50c], esp
push 0x101cd044
call fcn.1000ba00
lea edx, [ebp - 0x510]
push edx
call fcn.100dd430
add esp, 0x10
or dword [ebp - 0x540], 1
push eax
call fcn.10007f70
add esp, 8
movzx eax, al
test eax, eax
je 0x100f30b0
mov ecx, dword [str.Internet_Explorer_Server]
push ecx
lea edx, [ebp - 0x268]
push edx
call fcn.10166776
add esp, 8
test eax, eax
jne 0x100f30b0
mov dword [ebp - 0x54c], 1
jmp 0x100f30ba
mov dword [ebp - 0x54c], 0
mov al, byte [ebp - 0x54c]
mov byte [ebp - 0x4fd], al
mov ecx, dword [ebp - 0x540]
and ecx, 1
je 0x100f30e3
and dword [ebp - 0x540], 0xfffffffe
lea ecx, [ebp - 0x510]
call fcn.1000ba80
movzx edx, byte [ebp - 0x4fd]
test edx, edx
je 0x100f310b
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x5b4]
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x5b4]
mov ecx, dword [ecx]
push eax
mov edx, dword [ecx + 0x80]
call edx
mov dword [ebp - 0x514], 0
lea ecx, [ebp - 8]
call fcn.100d9610
lea ecx, [ebp - 0x278]
call fcn.10104b90
lea ecx, [ebp - 0x26c]
call fcn.1000ba80
lea ecx, [ebp - 0x274]
call fcn.1000ba80
mov eax, dword [ebp - 0x514]
jmp 0x100f35b7
mov ecx, dword [ebp + 8]
add ecx, 0x5b0
call fcn.100d3f60
lea ecx, [ebp - 8]
call fcn.100c4710
mov dword [ebp - 0x550], eax
mov ecx, dword [ebp + 8]
add ecx, 0x5b0
call fcn.100c48e0
push eax
push 0x101e8f50
push 0x101e8f40
mov eax, dword [ebp - 0x550]
push eax
mov ecx, dword [ebp - 0x550]
mov edx, dword [ecx]
mov eax, dword [edx + 0xc]
call eax
test eax, eax
jge 0x100f32a4
mov ecx, dword [ebp + 8]
add ecx, 0x5b0
call fcn.100c48e0
push eax
push 0x101e8f50
push 1
push 0
push 0x101e8f80
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jge 0x100f3204
mov dword [ebp - 0x518], 0x80004005
lea ecx, [ebp - 8]
call fcn.100d9610
lea ecx, [ebp - 0x278]
call fcn.10104b90
lea ecx, [ebp - 0x26c]
call fcn.1000ba80
lea ecx, [ebp - 0x274]
call fcn.1000ba80
mov eax, dword [ebp - 0x518]
jmp 0x100f35b7
mov ecx, dword [ebp + 8]
mov byte [ecx + 0x5cc], 1
push 0x101cd05c
lea ecx, [ebp - 0x51c]
call fcn.10007b00
push eax
lea ecx, [ebp - 0x4c8]
call fcn.1001d870
lea ecx, [ebp - 0x51c]
call fcn.10009fb0
lea ecx, [ebp - 0x4b8]
call fcn.10016fb0
mov ecx, dword [ebp + 8]
add ecx, 0x5b0
call fcn.10018010
mov dword [ebp - 0x554], eax
lea edx, [ebp - 0x4b8]
push edx
lea eax, [ebp - 0x4b8]
push eax
lea ecx, [ebp - 0x4b8]
push ecx
lea edx, [ebp - 0x4b8]
push edx
lea eax, [ebp - 0x4c8]
push eax
mov ecx, dword [ebp - 0x554]
push ecx
mov edx, dword [ebp - 0x554]
mov eax, dword [edx]
mov ecx, dword [eax + 0xd0]
call ecx
lea ecx, [ebp - 0x4b8]
call fcn.10016fd0
lea ecx, [ebp - 0x4c8]
call fcn.10016fd0
mov ecx, dword [ebp + 8]
add ecx, 0xc4
call fcn.10105920
push eax
push 0x101edff0
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [eax]
call edx
test eax, eax
jge 0x100f3307
mov dword [ebp - 0x520], 0x80004005
lea ecx, [ebp - 8]
call fcn.100d9610
lea ecx, [ebp - 0x278]
call fcn.10104b90
lea ecx, [ebp - 0x26c]
call fcn.1000ba80
lea ecx, [ebp - 0x274]
call fcn.1000ba80
mov eax, dword [ebp - 0x520]
jmp 0x100f35b7
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x5b4]
push ecx
mov ecx, dword [ebp + 8]
add ecx, 0x14
call fcn.10105510
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jge 0x100f3363
mov dword [ebp - 0x524], 0x80004005
lea ecx, [ebp - 8]
call fcn.100d9610
lea ecx, [ebp - 0x278]
call fcn.10104b90
lea ecx, [ebp - 0x26c]
call fcn.1000ba80
lea ecx, [ebp - 0x274]
call fcn.1000ba80
mov eax, dword [ebp - 0x524]
jmp 0x100f35b7
mov ecx, dword [ebp + 8]
sub ecx, 4
call fcn.100f17a0
test eax, eax
jne 0x100f33b0
mov dword [ebp - 0x528], 0x80004005
lea ecx, [ebp - 8]
call fcn.100d9610
lea ecx, [ebp - 0x278]
call fcn.10104b90
lea ecx, [ebp - 0x26c]
call fcn.1000ba80
lea ecx, [ebp - 0x274]
call fcn.1000ba80
mov eax, dword [ebp - 0x528]
jmp 0x100f35b7
mov edx, dword [ebp + 8]
add edx, 0xcc
je 0x100f33cb
mov eax, dword [ebp + 8]
add eax, 0x18c
mov dword [ebp - 0x558], eax
jmp 0x100f33d5
mov dword [ebp - 0x558], 0
mov ecx, dword [ebp - 0x558]
push ecx
mov ecx, dword [ebp + 8]
add ecx, 0x190
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x190]
mov edx, dword [eax + 0x5c]
call edx
push eax
call dword [sym.imp.ole32.dll_RegisterDragDrop]
lea ecx, [ebp - 8]
call fcn.100d9610
lea ecx, [ebp - 0x278]
call fcn.10104b90
lea ecx, [ebp - 0x26c]
call fcn.1000ba80
lea ecx, [ebp - 0x274]
call fcn.1000ba80
jmp 0x100f35b5
mov ecx, dword [ebp + 8]
add ecx, 0xcc
call fcn.1012d670
mov eax, dword [ebp + 8]
cmp dword [eax + 0x5e8], 0
je 0x100f3492
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x5e8]
mov dword [ebp - 0x530], edx
mov eax, dword [ebp - 0x530]
mov dword [ebp - 0x52c], eax
cmp dword [ebp - 0x52c], 0
je 0x100f347b
push 1
mov ecx, dword [ebp - 0x52c]
call fcn.10104bb0
mov dword [ebp - 0x55c], eax
jmp 0x100f3485
mov dword [ebp - 0x55c], 0
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x5e8], 0
mov ecx, dword [ebp + 8]
add ecx, 0xc4
call fcn.10105910
test eax, eax
je 0x100f34b4
push 0
mov ecx, dword [ebp + 8]
add ecx, 0xc4
call fcn.101058d0
mov edx, dword [ebp + 8]
cmp dword [edx + 0x5b4], 0
jne 0x100f34c7
xor eax, eax
jmp 0x100f35b7
mov eax, dword [ebp + 8]
cmp dword [eax + 0x5b4], 0
je 0x100f34ed
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x5b4]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x5b4]
mov edx, dword [edx]
push ecx
mov eax, dword [edx + 8]
call eax
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x5b4], 0
mov ecx, dword [ebp + 8]
add ecx, 0x5b0
call fcn.10018000
test eax, eax
je 0x100f351a
mov ecx, dword [ebp + 8]
add ecx, 0x5b0
call fcn.100d3f60
mov byte [0x10228007], 0
mov edx, dword [0x10228cb4]
sub edx, 1
mov dword [0x10228cb4], edx
jne 0x100f3599
movzx eax, byte [0x10224a58]
test eax, eax
jne 0x100f3599
push 0
push 1
push ecx
mov ecx, esp
mov dword [ebp - 0x534], esp
push 0
push ecx
call fcn.100de0f0
add esp, 8
call fcn.100a3700
add esp, 0xc
push ecx
mov esi, esp
mov dword [ebp - 0x538], esp
push 0x101cd074
push 0
lea edx, [ebp - 0x53c]
push edx
call fcn.100de0f0
add esp, 8
push eax
push esi
call fcn.1008d070
add esp, 0xc
call fcn.100a3970
add esp, 4
lea ecx, [ebp - 0x53c]
call fcn.1000ba80
mov eax, dword [ebp + 8]
cmp dword [eax + 0x88], 0
je 0x100f35b5
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x88]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop esi
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.10165d18
mov esp, ebp
pop ebp
ret 8