Function at 0x100e3670
Capabilities:
Get common file path

Disassembly:
sub esp, 0x208
lea eax, [esp]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push edi
push 0x104
push eax
call esi
lea ecx, [esp + 0x10c]
push 0x104
push ecx
call esi
push 0x1014c1a8
push 0x101aa96c
push 0x1014c198
push 0x101aa73c
push 0x1014c188
push 0x101aa910
lea edi, [esp + 0x20]
or ecx, 0xffffffff
xor eax, eax
push 0x1014c174
push 0x101aa830
push 0x1014c164
repne scasb al, byte es:[edi]
push 0x101aa85c
push 0x1014c154
push 0x101aa930
push 0x1014c148
mov eax, dword [0x1014c138]
push 0x101aa6e8
push 0x1014c12c
push 0x101aa848
not ecx
push 0x1014c120
dec ecx
push 0x101aa6dc
push 0x1014c114
push 0x101aa708
lea edx, [esp + ecx + 0x58]
push 0x1014c100
push 0x101aa9ac
push 0x1014c0f4
mov dword [edx], eax
mov eax, dword [0x1014c13c]
push 0x101aa780
push 0x1014c0e8
push 0x101aa904
mov dword [edx + 4], eax
mov eax, dword [0x1014c140]
push 0x1014c0dc
push 0x101aa970
push 0x1014c0cc
mov dword [edx + 8], eax
mov ax, word [0x1014c144]
push 0x101aa834
push 0x1014c0c4
push 0x101aa8d4
mov word [edx + 0xc], ax
mov edx, dword [0x1014c0b8]
mov eax, dword [0x1014c0bc]
lea ecx, [esp + ecx + 0x18c]
push 0x1014c0ac
push 0x101aa900
push 0x1014c0a0
mov dword [ecx], edx
mov dx, word [0x1014c0c0]
push 0x101aa968
push 0x1014c090
push 0x101aa824
mov dword [ecx + 4], eax
mov al, byte [0x1014c0c2]
push 0x1014c088
push 0x101aa8d8
push 0x1014c07c
mov word [ecx + 8], dx
push 0x101aa810
push 0x1014c070
push 0x101aa9a8
mov byte [ecx + 0xa], al
push 0x1014c064
push 0x101aa958
push 0x1014c054
push 0x101aa738
push 0x1014c048
push 0x101aa9c8
push 0x1014c034
push 0x101aa890
push 0x1014c020
push 0x101aa8cc
push 0x1014c010
push 0x101aa97c
push 0x1014bffc
push 0x101aa71c
push 0x1014bff0
push 0x101aa6fc
push 0x1014bfe0
push 0x101aa938
push 0x1014bfd4
push 0x101aa8a4
push 0x1014bfc8
push 0x101aa8c8
push 0x1014bfbc
push 0x101aa8e0
push 0x1014bfac
push 0x101aa81c
push 0x1014bf9c
push 0x101aa6f4
push 0x1014bf90
push 0x101aa804
push 0x1014bf80
push 0x101aa8d0
push 0x1014bf74
push 0x101aa948
push 0x1014bf68
push 0x101aa784
push 0x1014bf58
push 0x101aa79c
push 0x1014bf4c
push 0x101aa9c0
push 0x1014bf40
push 0x101aa7a4
push 0x1014bf34
push 0x101aa7e0
push 0x1014bf28
push 0x101aa814
push 0x1014bf1c
push 0x101aa6d0
push 0x1014bf10
push 0x101aa7f8
push 0x1014bf04
push 0x101aa93c
push 0x1014bef4
push 0x101aa70c
push 0x1014bee8
push 0x101aa808
push 0x1014bedc
push 0x101aa974
push 0x1014becc
push 0x101aa8a8
push 0x1014bebc
push 0x101aa8a0
push 0x1014beac
push 0x101aa790
push 0x1014be9c
push 0x101aa788
push 0x1014be8c
push 0x101aa72c
push 0x1014be78
push 0x101aa988
push 0x1014be68
push 0x101aa7ac
push 0x1014be58
push 0x101aa89c
push 0x1014be4c
push 0x101aa77c
push 0x1014be44
push 0x101aa720
push 0x1014be3c
push 0x101aa940
push 0x1014be2c
push 0x101aa6e4
push 0x1014be20
push 0x101aa960
push 0x1014be10
push 0x101aa92c
push 0x1014be00
push 0x101aa8b8
push 0x1014bdf0
push 0x101aa700
push 0x1014bde4
push 0x101aa728
push 0x1014bdd8
push 0x101aa9b4
push 0x1014bdcc
push 0x101aa6f8
push 0x1014bdc0
push 0x101aa864
push 0x1014bdb4
push 0x101aa740
push 0x1014bda8
push 0x101aa878
push 0x1014bd98
push 0x101aa798
push 0x1014bd88
push 0x101aa818
push 0x1014bd78
push 0x101aa734
push 0x1014bd68
push 0x101aa84c
push 0x1014bd58
push 0x101aa6d4
push 0x1014bd50
push 0x101aa914
push 0x1014bd48
push 0x101aa8dc
push 0x1014bd40
push 0x101aa980
push 0x1014bd34
push 0x101aa78c
push 0x1014bd28
push 0x101aa9b0
push 0x1014bd18
push 0x101aa724
push 0x1014bd0c
push 0x101aa718
push 0x1014bd00
push 0x101aa944
push 0x1014bcf4
push 0x101aa964
push 0x1014bcec
push 0x101aa748
push 0x1014bce0
push 0x101aa90c
push 0x1014bcd4
push 0x101aa984
push 0x1014bcc0
push 0x101aa6e0
push 0x1014bcb0
push 0x101aa6ec
push 0x1014bca0
push 0x101aa744
push 0x1014bc94
push 0x101aa7b0
push 0x1014bc88
push 0x101aa7a8
push 0x1014bc80
push 0x101aa7b4
push 0x1014bc74
push 0x101aa978
push 0x1014bc6c
push 0x101aa854
push 0x1014bc64
push 0x101aa6f0
push 0x1014bc54
push 0x101aa794
push 0x1014bc44
push 0x101aa9bc
push 0x1014bc38
push 0x101aa918
push 0x1014bc28
push 0x101aa730
push 0x1014bc1c
push 0x101aa924
push 0x1014bc14
push 0x101aa8b0
push 0x1014bc08
push 0x101aa800
push 0x1014bbfc
push 0x101aa9a0
push 0x1014bbf0
push 0x101aa820
push 0x1014bbe0
push 0x101aa91c
push 0x1014bbd0
push 0x101aa840
push 0x1014bbc0
push 0x101aa86c
lea ecx, [esp + 0x380]
push 0x6f
push ecx
push 0x101aa9e0
call fcn.100e3600
add esp, 0x384
test al, al
je 0x100e3c3a
push 0x1014bbb0
push 0x101aa7e4
push 0x1014bba4
push 0x101aa8e8
push 0x1014bb94
push 0x101aa920
push 0x1014bb80
push 0x101aa9c4
push 0x1014bb70
push 0x101aa8e4
push 0x1014bb68
push 0x101aa87c
push 0x1014bb5c
push 0x101aa894
push 0x1014bb50
push 0x101aa94c
push 0x1014bb40
push 0x101aa934
push 0x1014bb2c
push 0x101aa898
push 0x1014bb14
push 0x101aa844
push 0x1014bb00
push 0x101aa9b8
push 0x1014baec
push 0x101aa9a4
push 0x1014bae0
push 0x101aa7fc
push 0x1014bacc
push 0x101aa7dc
push 0x1014babc
push 0x101aa758
lea edx, [esp + 0x18c]
push 0x10
push edx
push 0x101aa9e4
call fcn.100e3600
add esp, 0x8c
test al, al
je 0x100e3c3a
pop edi
mov eax, 1
pop esi
add esp, 0x208
ret
push 0x1014baa8
xor esi, esi
call fcn.100e3ca0
add esp, 4
mov eax, esi
pop edi
pop esi
add esp, 0x208
ret