Function at 0x10069bb0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x370
mov eax, dword [0x1017455c]
xor eax, esp
mov dword [esp + 0x36c], eax
push ebx
push esi
push edi
xor ebx, ebx
push 0x103
lea eax, [esp + 0x271]
push ebx
push eax
mov byte [esp + 0x278], bl
call fcn.10116880
push 0x103
lea ecx, [esp + 0x175]
push ebx
push ecx
mov byte [esp + 0x17c], bl
call fcn.10116880
push 0x103
lea edx, [esp + 0x79]
push ebx
push edx
mov byte [esp + 0x80], bl
call fcn.10116880
mov eax, 0x1014874c
mov dword [esp + 0x34], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x54], eax
mov dword [esp + 0x60], eax
mov dword [esp + 0x68], eax
mov eax, 0x1013f817
add esp, 0x24
cmp dword [0x1017e8ec], 0xffffffff
mov dword [esp + 0xc], str._Copyright__c__1993_2006_Microsoft_Corp.
mov dword [esp + 0x14], str._This_is_a_sample_HOSTS_file_used_by_Microsoft_TCP_IP_for_Windows.
mov dword [esp + 0x1c], str._This_file_contains_the_mappings_of_IP_addresses_to_host_names._Each
mov dword [esp + 0x20], str._entry_should_be_kept_on_an_individual_line._The_IP_address_should
mov dword [esp + 0x24], str._be_placed_in_the_first_column_followed_by_the_corresponding_host_name.
mov dword [esp + 0x28], str._The_IP_address_and_the_host_name_should_be_separated_by_at_least_one
mov dword [esp + 0x2c], str._space.
mov dword [esp + 0x34], str._Additionally__comments__such_as_these__may_be_inserted_on_individual
mov dword [esp + 0x38], str._lines_or_following_the_machine_name_denoted_by_a__symbol.
mov dword [esp + 0x40], str._For_example:
mov dword [esp + 0x48], str.______102.54.94.97_____rhino.acme.com___________source_server
mov dword [esp + 0x4c], str._______38.25.63.10_____x.acme.com_______________x_client_host
mov dword [esp + 0x50], eax
mov dword [esp + 0x54], str.127.0.0.1_______localhost
mov dword [esp + 0x58], eax
jne 0x10069cc6
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x1017e8ec
xor edx, edx
xor ecx, ecx
call fcn.10050110
add esp, 0x20
push 0x104
lea eax, [esp + 0x168]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea esi, [esp + 0x164]
call fcn.10049c80
lea ecx, [esp + 0x26c]
push 0x104
push ecx
call fcn.10042f40
add esp, 8
lea esi, [esp + 0x26c]
call fcn.10049c80
cmp dword [0x1017e8ec], ebx
je 0x10069d56
lea edx, [esp + 0x164]
push edx
lea eax, [esp + 0x60]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
cmp byte [esp + 0x5c], bl
je 0x10069d4f
lea eax, [esp + 0x5c]
inc eax
cmp byte [eax], bl
jne 0x10069d31
lea ecx, [esp + 0x5c]
sub eax, ecx
je 0x10069d4f
cmp byte [esp + eax + 0x5b], 0x5c
je 0x10069d4f
push 0x10149ea8
mov edx, ecx
push edx
call esi
push str.driversetchosts
jmp 0x10069da3
lea ecx, [esp + 0x26c]
push ecx
lea edx, [esp + 0x60]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
cmp byte [esp + 0x5c], bl
je 0x10069d9e
lea eax, [esp + 0x5c]
lea esp, [esp]
inc eax
cmp byte [eax], bl
jne 0x10069d80
lea ecx, [esp + 0x5c]
sub eax, ecx
je 0x10069d9e
cmp byte [esp + eax + 0x5b], 0x5c
je 0x10069d9e
push 0x10149ea8
mov edx, ecx
push edx
call esi
push str.hosts
lea eax, [esp + 0x60]
push eax
call esi
lea ecx, [esp + 0x5c]
push 0x1014a614
push ecx
call fcn.1010ebfe
mov edi, eax
add esp, 8
cmp edi, ebx
je 0x10069e03
xor esi, esi
mov edx, dword [esp + esi*4 + 0xc]
push edx
push 0x1014a618
push edi
call fcn.10110652
inc esi
add esp, 0xc
cmp esi, 0x14
jl 0x10069dc4
push edi
call fcn.1010f263
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x36c]
xor ecx, esp
call fcn.1010d699
add esp, 0x370
ret
mov ecx, dword [esp + 0x378]
pop edi
pop esi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.1010d699
add esp, 0x370
ret