Function at 0x100e4760
Capabilities:
Get common file path

Disassembly:
sub esp, 0x208
lea eax, [esp]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push edi
push 0x104
push eax
call esi
lea ecx, [esp + 0x10c]
push 0x104
push ecx
call esi
push 0x1014d1a8
push 0x101ab964
push 0x1014d198
push 0x101ab734
push 0x1014d188
push 0x101ab908
lea edi, [esp + 0x20]
or ecx, 0xffffffff
xor eax, eax
push 0x1014d174
push 0x101ab828
push 0x1014d164
repne scasb al, byte es:[edi]
push 0x101ab854
push 0x1014d154
push 0x101ab928
push 0x1014d148
mov eax, dword [0x1014d138]
push 0x101ab6e0
push 0x1014d12c
push 0x101ab840
not ecx
push 0x1014d120
dec ecx
push 0x101ab6d4
push 0x1014d114
push 0x101ab700
lea edx, [esp + ecx + 0x58]
push 0x1014d100
push 0x101ab9a4
push 0x1014d0f4
mov dword [edx], eax
mov eax, dword [0x1014d13c]
push 0x101ab778
push 0x1014d0e8
push 0x101ab8fc
mov dword [edx + 4], eax
mov eax, dword [0x1014d140]
push 0x1014d0dc
push 0x101ab968
push 0x1014d0cc
mov dword [edx + 8], eax
mov ax, word [0x1014d144]
push 0x101ab82c
push 0x1014d0c4
push 0x101ab8cc
mov word [edx + 0xc], ax
mov edx, dword [0x1014d0b8]
mov eax, dword [0x1014d0bc]
lea ecx, [esp + ecx + 0x18c]
push 0x1014d0ac
push 0x101ab8f8
push 0x1014d0a0
mov dword [ecx], edx
mov dx, word [0x1014d0c0]
push 0x101ab960
push 0x1014d090
push 0x101ab81c
mov dword [ecx + 4], eax
mov al, byte [0x1014d0c2]
push 0x1014d088
push 0x101ab8d0
push 0x1014d07c
mov word [ecx + 8], dx
push 0x101ab808
push 0x1014d070
push 0x101ab9a0
mov byte [ecx + 0xa], al
push 0x1014d064
push 0x101ab950
push 0x1014d054
push 0x101ab730
push 0x1014d048
push 0x101ab9c0
push 0x1014d034
push 0x101ab888
push 0x1014d020
push 0x101ab8c4
push 0x1014d010
push 0x101ab974
push 0x1014cffc
push 0x101ab714
push 0x1014cff0
push 0x101ab6f4
push 0x1014cfe0
push 0x101ab930
push 0x1014cfd4
push 0x101ab89c
push 0x1014cfc8
push 0x101ab8c0
push 0x1014cfbc
push 0x101ab8d8
push 0x1014cfac
push 0x101ab814
push 0x1014cf9c
push 0x101ab6ec
push 0x1014cf90
push 0x101ab7fc
push 0x1014cf80
push 0x101ab8c8
push 0x1014cf74
push 0x101ab940
push 0x1014cf68
push 0x101ab77c
push 0x1014cf58
push 0x101ab794
push 0x1014cf4c
push 0x101ab9b8
push 0x1014cf40
push 0x101ab79c
push 0x1014cf34
push 0x101ab7d8
push 0x1014cf28
push 0x101ab80c
push 0x1014cf1c
push 0x101ab6c8
push 0x1014cf10
push 0x101ab7f0
push 0x1014cf04
push 0x101ab934
push 0x1014cef4
push 0x101ab704
push 0x1014cee8
push 0x101ab800
push 0x1014cedc
push 0x101ab96c
push 0x1014cecc
push 0x101ab8a0
push 0x1014cebc
push 0x101ab898
push 0x1014ceac
push 0x101ab788
push 0x1014ce9c
push 0x101ab780
push 0x1014ce8c
push 0x101ab724
push 0x1014ce78
push 0x101ab980
push 0x1014ce68
push 0x101ab7a4
push 0x1014ce58
push 0x101ab894
push 0x1014ce4c
push 0x101ab774
push 0x1014ce44
push 0x101ab718
push 0x1014ce3c
push 0x101ab938
push 0x1014ce2c
push 0x101ab6dc
push 0x1014ce20
push 0x101ab958
push 0x1014ce10
push 0x101ab924
push 0x1014ce00
push 0x101ab8b0
push 0x1014cdf0
push 0x101ab6f8
push 0x1014cde4
push 0x101ab720
push 0x1014cdd8
push 0x101ab9ac
push 0x1014cdcc
push 0x101ab6f0
push 0x1014cdc0
push 0x101ab85c
push 0x1014cdb4
push 0x101ab738
push 0x1014cda8
push 0x101ab870
push 0x1014cd98
push 0x101ab790
push 0x1014cd88
push 0x101ab810
push 0x1014cd78
push 0x101ab72c
push 0x1014cd68
push 0x101ab844
push 0x1014cd58
push 0x101ab6cc
push 0x1014cd50
push 0x101ab90c
push 0x1014cd48
push 0x101ab8d4
push 0x1014cd40
push 0x101ab978
push 0x1014cd34
push 0x101ab784
push 0x1014cd28
push 0x101ab9a8
push 0x1014cd18
push 0x101ab71c
push 0x1014cd0c
push 0x101ab710
push 0x1014cd00
push 0x101ab93c
push 0x1014ccf4
push 0x101ab95c
push 0x1014ccec
push 0x101ab740
push 0x1014cce0
push 0x101ab904
push 0x1014ccd4
push 0x101ab97c
push 0x1014ccc0
push 0x101ab6d8
push 0x1014ccb0
push 0x101ab6e4
push 0x1014cca0
push 0x101ab73c
push 0x1014cc94
push 0x101ab7a8
push 0x1014cc88
push 0x101ab7a0
push 0x1014cc80
push 0x101ab7ac
push 0x1014cc74
push 0x101ab970
push 0x1014cc6c
push 0x101ab84c
push 0x1014cc64
push 0x101ab6e8
push 0x1014cc54
push 0x101ab78c
push 0x1014cc44
push 0x101ab9b4
push 0x1014cc38
push 0x101ab910
push 0x1014cc28
push 0x101ab728
push 0x1014cc1c
push 0x101ab91c
push 0x1014cc14
push 0x101ab8a8
push 0x1014cc08
push 0x101ab7f8
push 0x1014cbfc
push 0x101ab998
push 0x1014cbf0
push 0x101ab818
push 0x1014cbe0
push 0x101ab914
push 0x1014cbd0
push 0x101ab838
push 0x1014cbc0
push 0x101ab864
lea ecx, [esp + 0x380]
push 0x6f
push ecx
push 0x101ab9d8
call fcn.100e46f0
add esp, 0x384
test al, al
je 0x100e4d2a
push 0x1014cbb0
push 0x101ab7dc
push 0x1014cba4
push 0x101ab8e0
push 0x1014cb94
push 0x101ab918
push 0x1014cb80
push 0x101ab9bc
push 0x1014cb70
push 0x101ab8dc
push 0x1014cb68
push 0x101ab874
push 0x1014cb5c
push 0x101ab88c
push 0x1014cb50
push 0x101ab944
push 0x1014cb40
push 0x101ab92c
push 0x1014cb2c
push 0x101ab890
push 0x1014cb14
push 0x101ab83c
push 0x1014cb00
push 0x101ab9b0
push 0x1014caec
push 0x101ab99c
push 0x1014cae0
push 0x101ab7f4
push 0x1014cacc
push 0x101ab7d4
push 0x1014cabc
push 0x101ab750
lea edx, [esp + 0x18c]
push 0x10
push edx
push 0x101ab9dc
call fcn.100e46f0
add esp, 0x8c
test al, al
je 0x100e4d2a
pop edi
mov eax, 1
pop esi
add esp, 0x208
ret
push 0x1014caa8
xor esi, esi
call fcn.100e4d90
add esp, 4
mov eax, esi
pop edi
pop esi
add esp, 0x208
ret