Function at 0x10014cbb
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov dword [ebp - 0x20], edx
mov byte [ebp - 4], cl
push ebx
push esi
push edi
test cl, cl
je 0x10014f2a
mov edi, dword [ebp + 0x20]
mov ebx, dword [ebp + 0x14]
push 0
pop esi
mov eax, dword [edi]
mov eax, dword [ebx]
mov eax, dword [edi]
mov eax, dword [edi]
mov eax, dword [ebx]
mov eax, dword [edi]
mov dword [edx], 0xffffffff
mov eax, dword [ebx]
add eax, dword [edi]
neg eax
sbb eax, eax
inc eax
cmp eax, dword [ebx]
jl 0x10014d03
cmp dword [edx], esi
je 0x10014d03
xor edx, edx
inc edx
jmp 0x10014d05
mov edx, esi
mov ecx, dword [ebp + 0x24]
mov eax, dword [edi]
push 4
mov dword [ecx], eax
mov eax, dword [ecx]
xor ecx, ecx
cmp eax, 3
setl cl
xor eax, eax
cmp edx, 0x7790
setg al
xor edx, edx
add ecx, eax
mov eax, dword [ebx]
cmp ecx, eax
mov ecx, dword [ebp + 0x1c]
pop eax
setg dl
cmp eax, edx
sbb eax, eax
neg eax
mov dword [ecx], eax
cmp dword [ecx], esi
je 0x10014d50
mov eax, dword [edi]
cmp dword [ecx], esi
je 0x10014d50
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebx]
mov dword [eax], ecx
jmp 0x10014f3c
mov dword [ebp - 0xc], 0x24380d33
mov dword [ebp - 0x1c], 0x224f
cmp dword [ebp - 0x1c], 0x837
jge 0x10014e5d
lea eax, [ebp - 0x10]
mov dword [ebp - 8], 1
push eax
push ecx
lea eax, [ebp - 0x14]
push eax
push ecx
lea eax, [ebp - 0x18]
mov ecx, 0x1007fd78
push eax
call fcn.1001dabc
pop ecx
mov ecx, eax
call fcn.1001dabc
pop ecx
mov ecx, eax
call fcn.1001dabc
cmp dword [ebp - 0x18], 1
mov dword [ebp - 0x1c], 1
jl 0x10014e5d
mov ebx, dword [ebp - 0x1c]
xor edi, edi
inc edi
cmp dword [ebp - 0x14], edi
jl 0x10014e4d
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0x10]
jne 0x10014dfc
push edi
push ecx
push ebx
mov ecx, 0x1007fc58
call fcn.1001ddcc
mov dl, 0x20
mov ecx, eax
call fcn.1001ff2b
pop ecx
mov ecx, eax
call fcn.1001ddcc
mov dl, 0x20
mov ecx, eax
call fcn.1001ff2b
mov dl, 0x4c
mov ecx, eax
call fcn.1001ff2b
push eax
call fcn.1001fef9
mov eax, dword [ebp - 8]
pop ecx
inc eax
mov dword [ebp - 8], eax
cmp eax, dword [ebp - 0x10]
jne 0x10014e3f
push edi
push ecx
push ebx
mov ecx, 0x1007fc58
call fcn.1001ddcc
mov dl, 0x20
mov ecx, eax
call fcn.1001ff2b
pop ecx
mov ecx, eax
call fcn.1001ddcc
mov dl, 0x20
mov ecx, eax
call fcn.1001ff2b
mov dl, 0x52
mov ecx, eax
call fcn.1001ff2b
push eax
call fcn.1001fef9
mov eax, dword [ebp - 8]
pop ecx
inc eax
inc edi
mov dword [ebp - 8], eax
cmp edi, dword [ebp - 0x14]
jle 0x10014dbd
inc ebx
cmp ebx, dword [ebp - 0x18]
jle 0x10014dae
mov edi, dword [ebp + 0x20]
mov ebx, dword [ebp + 0x14]
mov dword [ebp - 8], 0x4efc
cmp dword [ebp - 8], 0x5066
jle 0x10014ec5
mov ebx, esi
mov edi, esi
mov eax, ebx
lea ecx, [ebp - 0x38]
cdq
idiv edi
mov eax, edx
cdq
push edx
push eax
call fcn.10004d43
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10014e8d
mov eax, dword [eax]
push eax
call fcn.10047823
pop ecx
push esi
push 1
lea ecx, [ebp - 0x38]
call fcn.100031ae
inc edi
cmp edi, 0x6fd8
jl 0x10014e71
inc ebx
cmp ebx, 0x4193
jl 0x10014e6f
push esi
push 0x387
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
mov edi, dword [ebp + 0x20]
mov ebx, dword [ebp + 0x14]
mov dword [ebp - 0x1c], 0x231966ba
cmp dword [ebp - 8], 0x4c36
jge 0x10014ee0
push str.wunbzz_jfcdxufy_dwahmtwow_cgp_ezvglzf_opxmjt_iulhx_nvy_iceblto_oktgenyz_sewuyys_tvravupif
call fcn.10047823
pop ecx
cmp dword [ebp - 0xc], esi
jne 0x10014ef6
mov eax, dword [edi]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp + 0x18]
mov eax, dword [eax]
mov eax, dword [ebp + 0x24]
mov eax, dword [eax]
mov eax, dword [ebx]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp + 0x1c]
mov eax, dword [ecx]
mov eax, dword [ebp - 0x20]
mov eax, dword [eax]
mov eax, dword [ecx]
xor ecx, ecx
cmp eax, 0x6409
mov eax, dword [ebx]
sete cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setl dl
sub edx, eax
mov eax, dword [ebp + 8]
mov dword [eax], edx
jmp 0x10014f3c
xor esi, esi
push esi
push esi
push 0x195c
push esi
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret