Function at 0x497ef7
Capabilities:
Get common file path

Disassembly:
push 0x14c
mov eax, 0x4d95c8
call fcn.004a185e
mov esi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x14c], ebx
mov dword [ebp - 0xf4], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0xf0], ebx
mov dword [ebp - 0xec], ebx
mov dword [ebp - 0xe8], ebx
mov dword [ebp - 0xf8], ebx
mov edi, dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
lea eax, [ebp - 0xf4]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 1
lea eax, [ebp - 0x20]
mov byte [ebp - 4], 4
push eax
mov dword [ebp - 0x20], ebx
mov word [ebp - 0x1c], 0x100
mov dword [ebp - 0x18], ebx
mov word [ebp - 0x14], 0x500
call edi
test eax, eax
jne 0x497f86
push 1
lea eax, [ebp - 0xe1]
mov ecx, esi
push eax
push 0x4e2398
call fcn.00404280
push 0x14
push ebx
jmp 0x498214
lea eax, [ebp - 0xf0]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea eax, [ebp - 0x18]
push eax
call edi
test eax, eax
je 0x497f69
lea eax, [ebp - 0xec]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x221
push 0x20
push 2
lea eax, [ebp - 0x18]
push eax
call edi
test eax, eax
je 0x497f69
push 0x40
lea eax, [ebp - 0x148]
push ebx
push eax
call fcn.004a2ef0
mov eax, dword [ebp - 0xec]
add esp, 0xc
mov dword [ebp - 0x12c], eax
xor edx, edx
mov eax, dword [ebp - 0xf0]
inc edx
mov dword [ebp - 0x10c], eax
lea eax, [ebp - 0xe8]
push 3
pop ecx
push 2
mov dword [ebp - 0x140], ecx
mov dword [ebp - 0x120], ecx
pop ecx
push eax
push ebx
lea eax, [ebp - 0x148]
mov dword [ebp - 0x148], 0x1200a9
push eax
push ecx
mov dword [ebp - 0x144], edx
mov dword [ebp - 0x13c], ebx
mov dword [ebp - 0x138], ebx
mov dword [ebp - 0x134], ebx
mov dword [ebp - 0x130], 5
mov dword [ebp - 0x128], 0x1f01ff
mov dword [ebp - 0x124], edx
mov dword [ebp - 0x11c], ebx
mov dword [ebp - 0x118], ebx
mov dword [ebp - 0x114], ebx
mov dword [ebp - 0x110], ecx
call dword [sym.imp.ADVAPI32.dll_SetEntriesInAclW]
test eax, eax
jne 0x497f69
push 0x14
call fcn.004a0ee0
mov edi, eax
pop ecx
test edi, edi
je 0x49808f
push 0x14
push ebx
call fcn.004a15b5
pop ecx
pop ecx
mov dword [ebp - 0xf8], edi
push 1
test edi, edi
je 0x497f6b
push edi
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
test eax, eax
jne 0x4980c4
lea eax, [ebp - 0xe1]
push 1
push eax
push 0x4e2398
mov ecx, esi
call fcn.00404280
jmp 0x498211
push ebx
push dword [ebp - 0xe8]
push 1
push edi
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
test eax, eax
lea eax, [ebp - 0xe1]
je 0x4980b0
push ebx
push eax
lea ecx, [ebp - 0x50]
mov dword [ebp - 0x108], 0xc
mov dword [ebp - 0x104], edi
mov dword [ebp - 0x100], ebx
mov dword [ebp - 0x50], 0x4e7a18
mov dword [ebp - 0x28], 0x4e86a8
call fcn.00404a90
mov ebx, 0x104
mov byte [ebp - 4], 5
push ebx
lea eax, [ebp - 0x158]
push eax
lea ecx, [ebp - 0x50]
call fcn.00409470
mov ecx, dword [eax]
mov byte [ebp - 4], 6
mov byte [eax + 4], 1
call fcn.00403f10
push dword [eax]
push ebx
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea ecx, [ebp - 0x158]
mov byte [ebp - 4], 5
call fcn.00409a90
lea eax, [ebp - 0xe0]
push eax
call fcn.00497dc9
push eax
lea eax, [ebp - 0xb0]
mov byte [ebp - 4], 7
push 0x4dd880
push eax
call fcn.0040c840
push 0x4dd83c
push eax
lea eax, [ebp - 0x80]
mov byte [ebp - 4], 8
push eax
call fcn.0040c970
add esp, 0x1c
push eax
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 9
call fcn.004033f0
lea ecx, [ebp - 0x80]
call fcn.00404c20
lea ecx, [ebp - 0xb0]
call fcn.00404c20
lea ecx, [ebp - 0xe0]
mov byte [ebp - 4], 5
call fcn.00404c20
lea eax, [ebp - 0x108]
push eax
sub esp, 0x30
lea eax, [ebp - 0x50]
mov ecx, esp
mov dword [ebp - 0xfc], ecx
push 0
push eax
mov dword [ecx], 0x4e7a18
mov dword [ecx + 0x28], 0x4e86a8
call fcn.00406fd0
call fcn.004962bf
add esp, 0x34
test eax, eax
jne 0x498200
push 1
lea eax, [ebp - 0xe1]
mov ecx, esi
push eax
push 0x4e2398
call fcn.00404280
jmp 0x498209
push esi
lea ecx, [ebp - 0x50]
call fcn.00438f00
lea ecx, [ebp - 0x50]
call fcn.00404c20
push 0x14
push edi
call fcn.004a15b5
pop ecx
pop ecx
lea ecx, [ebp - 0xe8]
call fcn.00495cf4
lea ecx, [ebp - 0xec]
call fcn.00495d0e
lea ecx, [ebp - 0xf0]
call fcn.00495d0e
lea ecx, [ebp - 0xf4]
call fcn.00495d0e
mov eax, esi
call fcn.004a1808
ret