Function at 0x4930ed
Capabilities:
Get common file path

Disassembly:
push 0x14c
mov eax, 0x4d22b5
call fcn.0049cba1
mov esi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x14c], ebx
mov dword [ebp - 0xf4], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0xf0], ebx
mov dword [ebp - 0xec], ebx
mov dword [ebp - 0xe8], ebx
mov dword [ebp - 0xf8], ebx
mov edi, dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
lea eax, [ebp - 0xf4]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 1
lea eax, [ebp - 0x20]
mov byte [ebp - 4], 4
push eax
mov dword [ebp - 0x20], ebx
mov word [ebp - 0x1c], 0x100
mov dword [ebp - 0x18], ebx
mov word [ebp - 0x14], 0x500
call edi
test eax, eax
jne 0x49317c
push 1
lea eax, [ebp - 0xe1]
mov ecx, esi
push eax
push 0x4db368
call fcn.00404240
push 0x14
push ebx
jmp 0x49340a
lea eax, [ebp - 0xf0]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea eax, [ebp - 0x18]
push eax
call edi
test eax, eax
je 0x49315f
lea eax, [ebp - 0xec]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x221
push 0x20
push 2
lea eax, [ebp - 0x18]
push eax
call edi
test eax, eax
je 0x49315f
push 0x40
lea eax, [ebp - 0x148]
push ebx
push eax
call fcn.0049e210
mov eax, dword [ebp - 0xec]
add esp, 0xc
mov dword [ebp - 0x12c], eax
xor edx, edx
mov eax, dword [ebp - 0xf0]
inc edx
mov dword [ebp - 0x10c], eax
lea eax, [ebp - 0xe8]
push 3
pop ecx
push 2
mov dword [ebp - 0x140], ecx
mov dword [ebp - 0x120], ecx
pop ecx
push eax
push ebx
lea eax, [ebp - 0x148]
mov dword [ebp - 0x148], 0x1200a9
push eax
push ecx
mov dword [ebp - 0x144], edx
mov dword [ebp - 0x13c], ebx
mov dword [ebp - 0x138], ebx
mov dword [ebp - 0x134], ebx
mov dword [ebp - 0x130], 5
mov dword [ebp - 0x128], 0x1f01ff
mov dword [ebp - 0x124], edx
mov dword [ebp - 0x11c], ebx
mov dword [ebp - 0x118], ebx
mov dword [ebp - 0x114], ebx
mov dword [ebp - 0x110], ecx
call dword [sym.imp.ADVAPI32.dll_SetEntriesInAclW]
test eax, eax
jne 0x49315f
push 0x14
call fcn.0049c24e
mov edi, eax
pop ecx
test edi, edi
je 0x493285
push 0x14
push ebx
call fcn.0049c240
pop ecx
pop ecx
mov dword [ebp - 0xf8], edi
push 1
test edi, edi
je 0x493161
push edi
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
test eax, eax
jne 0x4932ba
lea eax, [ebp - 0xe1]
push 1
push eax
push 0x4db368
mov ecx, esi
call fcn.00404240
jmp 0x493407
push ebx
push dword [ebp - 0xe8]
push 1
push edi
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
test eax, eax
lea eax, [ebp - 0xe1]
je 0x4932a6
push ebx
push eax
lea ecx, [ebp - 0x50]
mov dword [ebp - 0x108], 0xc
mov dword [ebp - 0x104], edi
mov dword [ebp - 0x100], ebx
mov dword [ebp - 0x50], 0x4e1680
mov dword [ebp - 0x28], 0x4e1670
call fcn.00404a50
mov ebx, 0x104
mov byte [ebp - 4], 5
push ebx
lea eax, [ebp - 0x158]
push eax
lea ecx, [ebp - 0x50]
call fcn.00409430
mov ecx, dword [eax]
mov byte [ebp - 4], 6
mov byte [eax + 4], 1
call fcn.00403ed0
push dword [eax]
push ebx
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea ecx, [ebp - 0x158]
mov byte [ebp - 4], 5
call fcn.00409a50
lea eax, [ebp - 0xe0]
push eax
call fcn.00492fbf
push eax
lea eax, [ebp - 0xb0]
mov byte [ebp - 4], 7
push 0x4d6860
push eax
call fcn.0040c800
push 0x4d681c
push eax
lea eax, [ebp - 0x80]
mov byte [ebp - 4], 8
push eax
call fcn.0040c930
add esp, 0x1c
push eax
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 9
call fcn.004033b0
lea ecx, [ebp - 0x80]
call fcn.00404be0
lea ecx, [ebp - 0xb0]
call fcn.00404be0
lea ecx, [ebp - 0xe0]
mov byte [ebp - 4], 5
call fcn.00404be0
lea eax, [ebp - 0x108]
push eax
sub esp, 0x30
lea eax, [ebp - 0x50]
mov ecx, esp
mov dword [ebp - 0xfc], ecx
push 0
push eax
mov dword [ecx], 0x4e1680
mov dword [ecx + 0x28], 0x4e1670
call fcn.00406f90
call fcn.004914b5
add esp, 0x34
test eax, eax
jne 0x4933f6
push 1
lea eax, [ebp - 0xe1]
mov ecx, esi
push eax
push 0x4db368
call fcn.00404240
jmp 0x4933ff
push esi
lea ecx, [ebp - 0x50]
call fcn.00436830
lea ecx, [ebp - 0x50]
call fcn.00404be0
push 0x14
push edi
call fcn.0049c240
pop ecx
pop ecx
lea ecx, [ebp - 0xe8]
call fcn.00490eea
lea ecx, [ebp - 0xec]
call fcn.00490f04
lea ecx, [ebp - 0xf0]
call fcn.00490f04
lea ecx, [ebp - 0xf4]
call fcn.00490f04
mov eax, esi
call fcn.0049cb4b
ret