Function at 0x1001b785
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa0
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x1001b80e
mov eax, dword [ebp + 8]
mov dword [ebp - 0x70], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x78], eax
mov eax, dword [ebp - 0x64]
movzx eax, byte [eax]
test eax, eax
je 0x1001b7c1
push 0x134a
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
jmp 0x1001b809
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x80], eax
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x74], eax
mov eax, dword [ebp - 0x20]
mov dword [eax], 0
jmp 0x1001b7ef
mov eax, dword [ebp - 0x20]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x20]
mov dword [ecx], eax
mov eax, dword [ebp - 0x20]
cmp dword [eax], 2
jge 0x1001b809
mov eax, dword [ebp - 0x20]
push dword [eax]
mov ecx, dword [ebp - 0x74]
call fcn.10010682
or dword [eax], 0xffffffff
jmp 0x1001b7e4
jmp 0x1001bb3c
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x68], eax
mov dword [ebp - 4], 0x69ad59e5
mov dword [ebp - 0xc], 0xffffffff
mov dword [ebp - 0x18], 0xb1b0cadf
mov dword [ebp - 8], 0xfffffffa
mov dword [ebp - 0x1c], 0xf5cbf793
mov dword [ebp - 0x24], 0
jmp 0x1001b84d
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 3
jge 0x1001b863
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xa0], 0
jmp 0x1001b846
mov eax, dword [ebp - 4]
mov dword [ebp - 0x84], eax
cmp dword [ebp - 4], 0
je 0x1001b899
cmp dword [ebp - 4], 0xef70
jne 0x1001b884
mov dword [ebp - 0x34], 1
jmp 0x1001b888
and dword [ebp - 0x34], 0
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0x34]
je 0x1001b899
mov dword [ebp - 0x60], 1
jmp 0x1001b89d
and dword [ebp - 0x60], 0
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x1001b8c0
or eax, 0xffffffff
je 0x1001b8c0
mov eax, 0x6d0811fc
test eax, eax
je 0x1001b8c0
mov dword [ebp - 0x4c], 1
jmp 0x1001b8c4
and dword [ebp - 0x4c], 0
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x18], eax
imul eax, dword [ebp - 0x18], 0xf9d6
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x94], eax
mov eax, 0x56ce
sub eax, dword [ebp - 4]
cmp eax, 7
jge 0x1001b8f3
mov dword [ebp - 0x3c], 1
jmp 0x1001b8f7
and dword [ebp - 0x3c], 0
cmp dword [ebp - 0x3c], 5
je 0x1001b901
cmp dword [ebp - 8], 0
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 4]
cmp eax, dword [ebp - 4]
jle 0x1001b915
mov dword [ebp - 0x5c], 1
jmp 0x1001b919
and dword [ebp - 0x5c], 0
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0x5c]
cmp eax, dword [ebp - 0x1c]
jg 0x1001b92d
mov dword [ebp - 0x44], 1
jmp 0x1001b931
and dword [ebp - 0x44], 0
cmp dword [ebp - 0x44], 0
jne 0x1001b940
mov dword [ebp - 0x54], 1
jmp 0x1001b944
and dword [ebp - 0x54], 0
mov eax, dword [ebp - 4]
cmp dword [ebp - 0x54], eax
je 0x1001b955
mov dword [ebp - 0x2c], 1
jmp 0x1001b959
and dword [ebp - 0x2c], 0
mov eax, dword [ebp - 4]
cmp dword [ebp - 0x2c], eax
jg 0x1001b96a
mov dword [ebp - 0x38], 1
jmp 0x1001b96e
and dword [ebp - 0x38], 0
cmp dword [ebp - 0x38], 1
jl 0x1001b97d
mov dword [ebp - 0x40], 1
jmp 0x1001b981
and dword [ebp - 0x40], 0
mov eax, dword [ebp - 4]
cmp dword [ebp - 0x40], eax
jge 0x1001b994
or eax, 0xffffffff
jne 0x1001b994
and dword [ebp - 0x48], 0
jmp 0x1001b99b
mov dword [ebp - 0x48], 1
mov eax, dword [ebp - 4]
sub eax, dword [ebp - 0x48]
je 0x1001b9b3
mov dword [ebp - 0x50], 0xfffffffd
mov eax, dword [ebp - 0x50]
dec eax
mov dword [ebp - 0x50], eax
jmp 0x1001b9ea
mov dword [ebp - 0x28], 0
jmp 0x1001b9c3
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 2
jge 0x1001b9d9
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x90], 0
jmp 0x1001b9bc
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x90], 0x1cd1ac8c
mov dword [ebp - 0xc], 0xfffffff6
jmp 0x1001b9fa
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xf
jg 0x1001bb27
mov dword [ebp - 0x14], 0x9f94ad8a
mov eax, dword [ebp - 8]
mov dword [ebp - 0x88], eax
mov dword [ebp - 0x14], 0xabed997
cmp dword [ebp - 0x14], 9
jbe 0x1001ba5b
mov eax, dword [ebp - 0x14]
neg eax
cmp eax, dword [ebp - 0x14]
jge 0x1001ba37
cmp dword [ebp - 0x18], 0
jne 0x1001ba37
and dword [ebp - 0x58], 0
jmp 0x1001ba3e
mov dword [ebp - 0x58], 1
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x18], eax
jle 0x1001ba52
cmp dword [ebp - 0x14], 0
je 0x1001ba5b
mov dword [ebp - 0x30], 1
jmp 0x1001ba5f
and dword [ebp - 0x30], 0
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x30]
je 0x1001ba9c
mov dword [ebp - 8], 2
jmp 0x1001ba77
mov eax, dword [ebp - 8]
dec eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jl 0x1001ba9a
mov byte [ebp - 0xf], 0
movzx eax, byte [ebp - 0xf]
test eax, eax
je 0x1001ba98
push 0
push 0xa2d
push 0
call dword [sym.imp.ADVAPI32.dll_ControlService]
jmp 0x1001ba70
jmp 0x1001bb10
mov byte [ebp - 0xe], 0
movzx eax, byte [ebp - 0xe]
test eax, eax
je 0x1001badc
push 0
push 0x247b
push 0xc51
push 0x255d
push 0x130f
push 0xae4
push 0x14e2
push 0x961
push 0x1ed0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov dword [ebp - 0x1c], 0
jmp 0x1001baec
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jg 0x1001bb10
mov byte [ebp - 0xd], 0
movzx eax, byte [ebp - 0xd]
test eax, eax
je 0x1001bb0e
push 0x2573
push 0x1024
call dword [sym.imp.USER32.dll_GetWindowLongA]
jmp 0x1001bae5
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xa0], 0
je 0x1001bb22
jmp 0x1001bb27
jmp 0x1001b9f3
push 0
push 0x2c0c
push dword [ebp - 0x68]
push dword [ebp - 0x6c]
call fcn.100164d0
add esp, 0x10
mov esp, ebp
pop ebp
ret