Function at 0x101ef43
Capabilities:
Get common file path
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x4d8
mov eax, dword [0x10372d8]
push ebx
mov ebx, dword [ebp + 0xc]
and dword [ebx], 0
push esi
push edi
mov edi, dword [ebp + 8]
push 0x3a
push edi
mov dword [ebp - 4], eax
mov dword [ebp - 0x4cc], ebx
call dword [sym.imp.msvcrt.dll_wcschr]
test eax, eax
mov esi, dword [sym.imp.msvcrt.dll_wcsrchr]
pop ecx
pop ecx
jne 0x101f02c
mov ax, word [edi]
cmp ax, 0x5c
je 0x101f02c
cmp ax, 0x2f
je 0x101f02c
push 0x104
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x101efd2
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x101efc1
call esi
jmp 0x101f2e1
call esi
and eax, 0xffff
or eax, 0x80070000
jmp 0x101f2e1
cmp eax, 3
jne 0x101efdf
and word [ebp - 0x208], 0
lea eax, [ebp - 0x20c]
push 0x5c
push eax
call esi
test eax, eax
pop ecx
pop ecx
je 0x101eff4
and word [eax], 0
push edi
push 0x1002f84
lea eax, [ebp - 0x20c]
push eax
push 0x1002f74
lea eax, [ebp - 0x494]
push 0x144
push eax
call fcn.0100d577
add esp, 0x18
test eax, eax
jl 0x101f082
lea eax, [ebp - 0x494]
mov dword [ebp - 0x4c8], eax
jmp 0x101f032
mov dword [ebp - 0x4c8], edi
mov edi, dword [ebp - 0x4c8]
push 0x2e
push edi
mov dword [ebp - 0x4d0], 0x80004005
call esi
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x101f15e
push 0x1002f68
push esi
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
jne 0x101f15e
push esi
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
mov ecx, 0x104
sub ecx, eax
sub esi, edi
shl ecx, 1
sar esi, 1
cmp esi, ecx
jl 0x101f08c
mov eax, 0x80070057
jmp 0x101f2e1
mov eax, dword [0x1037380]
cmp dword [eax + 0x1c], 1
jne 0x101f0dc
test edi, edi
jne 0x101f09f
xor eax, eax
jmp 0x101f0c1
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea esi, [eax + eax + 2]
mov eax, esi
add eax, 3
and eax, 0xfffffffc
call fcn.010345f0
mov eax, esp
push esi
push edi
push eax
call fcn.0102eaca
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
jmp 0x101f0f5
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x101f158
push 0
lea eax, [ebp - 0x4d8]
push eax
push 4
lea eax, [ebp - 0x4d4]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x101f144
cmp dword [ebp - 0x4d8], 4
jne 0x101f144
cmp dword [ebp - 0x4d4], 0xabcdabc3
jne 0x101f144
and dword [ebp - 0x4d0], 0
mov esi, 0x100184c
lea edi, [ebp - 0x4c4]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x4d0], 0
jge 0x101f29f
mov ebx, dword [ebp - 0x4cc]
xor esi, esi
lea eax, [ebp - 0x4c4]
push eax
push dword [ebp - 0x4c8]
call dword [sym.imp.ole32.dll_GetClassFile]
test eax, eax
jge 0x101f195
cmp eax, 0x800401e6
jne 0x101f270
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
inc esi
cmp esi, 0xa
jb 0x101f160
jmp 0x101f288
push 4
pop ecx
lea edi, [ebp - 0x4a4]
lea esi, [ebp - 0x4c4]
xor edx, edx
mov dword [ebp - 0x4a4], 0xbb64df2f
mov word [ebp - 0x4a0], 0x88e4
mov word [ebp - 0x49e], 0x11d0
mov byte [ebp - 0x49c], 0x9e
mov byte [ebp - 0x49b], 0x87
mov byte [ebp - 0x49a], 0
mov byte [ebp - 0x499], 0xc0
mov byte [ebp - 0x498], 0x4f
mov byte [ebp - 0x497], 0xd7
mov byte [ebp - 0x496], 8
mov byte [ebp - 0x495], 0x1f
repe cmpsd dword [esi], dword es:[edi]
mov dword [ebp - 0x4b4], 0x1eaf7042
mov word [ebp - 0x4b0], 0x9f92
mov word [ebp - 0x4ae], 0x11d0
mov byte [ebp - 0x4ac], 0x89
mov byte [ebp - 0x4ab], 0xaa
mov byte [ebp - 0x4aa], 0
mov byte [ebp - 0x4a9], 0xa0
mov byte [ebp - 0x4a8], 0xc9
mov byte [ebp - 0x4a7], 5
mov byte [ebp - 0x4a6], 0x41
mov byte [ebp - 0x4a5], 0x29
jne 0x101f259
mov esi, 0x100181c
jmp 0x101f277
push 4
pop ecx
lea edi, [ebp - 0x4b4]
lea esi, [ebp - 0x4c4]
xor edx, edx
repe cmpsd dword [esi], dword es:[edi]
jne 0x101f281
jmp 0x101f272
xor eax, eax
mov esi, 0x100182c
lea edi, [ebp - 0x4c4]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
cmp eax, 0x800401e6
jne 0x101f299
mov esi, 0x100184c
lea edi, [ebp - 0x4c4]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
jmp 0x101f2a5
test eax, eax
jge 0x101f2a5
jmp 0x101f2e1
mov ebx, dword [ebp - 0x4cc]
push ebx
push 0x10017fc
push 1
push 0
lea eax, [ebp - 0x4c4]
push eax
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x101f2e1
mov eax, dword [ebx]
push dword [ebp - 0x4c8]
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
mov esi, eax
test esi, esi
jge 0x101f2df
mov eax, dword [ebx]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
and dword [ebx], 0
mov eax, esi
lea esp, [ebp - 0x4e4]
mov ecx, dword [ebp - 4]
call fcn.01034242
pop edi
pop esi
pop ebx
leave
ret 8