Function at 0x10114390
Capabilities:
Get common file path
Impersonate user

Disassembly:
sub esp, 0x24c
mov eax, dword [0x10170024]
xor eax, esp
mov dword [esp + 0x244], eax
mov eax, dword [esp + 0x254]
push ebx
push ebp
mov ebp, dword [esp + 0x258]
push esi
push edi
xor ebx, ebx
push 0x206
lea edx, [esp + 0x4e]
push ebx
push edx
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], ecx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov word [esp + 0x54], bx
call sub.MSVCR80.dll_memset
add esp, 0xc
push str.netapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
xor eax, eax
cmp esi, ebx
setne al
mov edi, eax
test edi, edi
jne 0x10114432
push 0x1dd
call fcn.10113800
add esp, 4
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call sub.Comn.dll_GetObjectLog
mov ecx, dword [eax]
mov edx, dword [ecx + 0xc]
push esi
push ebx
push str.hModule___NULL
push str._s_return_code:_0x_08X___s.
push eax
call edx
add esp, 0x14
jmp 0x10114639
push str.NetUserGetInfo
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
xor ecx, ecx
test eax, eax
setne cl
mov dword [esp + 0x18], eax
mov edi, ecx
test edi, edi
jne 0x10114487
push 0x1e0
call fcn.10113800
add esp, 4
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call sub.Comn.dll_GetObjectLog
mov edx, dword [eax]
push esi
push ebx
push str.pNetUserGetInfo___NULL
push str._s_return_code:_0x_08X___s.
push eax
mov eax, dword [edx + 0xc]
call eax
add esp, 0x14
jmp 0x10114639
push str.NetApiBufferFree
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test edi, edi
mov dword [esp + 0x1c], eax
jne 0x101144d3
push 0x1e2
call fcn.10113800
add esp, 4
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call sub.Comn.dll_GetObjectLog
mov ecx, dword [eax]
mov edx, dword [ecx + 0xc]
push esi
push ebx
push str.pNetUserGetInfo___NULL
push str._s_return_code:_0x_08X___s.
push eax
call edx
add esp, 0x14
jmp 0x10114639
mov eax, dword [ebp]
push eax
call dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
mov edi, eax
test edi, edi
jne 0x1011450b
push 0x1e4
call fcn.10113800
add esp, 4
push eax
push str.ImpersonateLoggedOnUser_hToken_
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call fcn.100016d0
add esp, 8
jmp 0x10114639
mov esi, dword [esp + 0x20]
lea ecx, [esp + 0x14]
push ecx
push 3
push esi
push 0
call dword [esp + 0x28]
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov edi, eax
test edi, edi
jne 0x1011453e
push 0x1e6
call fcn.10113800
add esp, 4
push eax
push str.RevertToSelf__
jmp 0x101144f6
mov ecx, dword [ebp]
mov edi, dword [sym.imp.USERENV.dll_GetUserProfileDirectoryW]
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x4c]
push eax
push ecx
call edi
test eax, eax
jne 0x10114592
mov edx, dword [esp + 0x10]
lea eax, [edx + edx + 2]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edx, dword [ebp]
lea ecx, [esp + 0x10]
push ecx
mov ebx, eax
push ebx
push edx
call edi
mov edi, eax
test edi, edi
jne 0x10114592
push 0x1eb
call fcn.10113800
add esp, 4
push eax
push str.GetUserProfileDirectory_hToken__szwProfilePath__dwLength_
jmp 0x10114603
xor eax, eax
test ebx, ebx
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x28], 0x20
mov dword [esp + 0x2c], 1
mov dword [esp + 0x30], esi
mov ecx, dword [eax + 0x68]
mov dword [esp + 0x34], ecx
je 0x101145db
mov dword [esp + 0x38], ebx
mov eax, dword [ebp]
lea edx, [esp + 0x28]
push edx
push eax
call dword [sym.imp.USERENV.dll_LoadUserProfileW]
mov edi, eax
test edi, edi
jne 0x10114615
push 0x1f6
call fcn.10113800
add esp, 4
push eax
push str.LoadUserProfile_hToken__profileinfo_
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call fcn.100016d0
add esp, 8
jmp 0x1011461f
mov ecx, dword [esp + 0x44]
mov edx, dword [esp + 0x24]
mov dword [edx], ecx
test ebx, ebx
je 0x10114639
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x10114639
mov ecx, dword [esp + 0x14]
push ecx
call eax
mov ecx, dword [esp + 0x254]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1012d370
add esp, 0x24c
ret 8