Function at 0x101086c0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x650
mov eax, dword [0x102519c8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, ecx
mov dword [ebp - 0x644], ebx
mov dword [ebp - 0x64c], edi
push dword [edi]
call dword [sym.imp.SHLWAPI.dll_PathIsRootW]
test eax, eax
je 0x1010870b
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101f99c6
mov esp, ebp
pop ebp
ret 8
lea eax, [ebp - 0x650]
push eax
call fcn.100db670
mov eax, dword [ebp - 0x650]
add esp, 4
add eax, 0xfffffff0
push 1
push ecx
mov esi, esp
push eax
call fcn.10002a60
add eax, 0x10
mov dword [esi], eax
mov esi, esp
mov eax, dword [edi]
sub eax, 0x10
push eax
call fcn.10002a60
add esp, 4
add eax, 0x10
mov ecx, ebx
mov dword [esi], eax
call fcn.10107610
test eax, eax
je 0x1010875d
mov esi, 1
jmp 0x10108bd4
lea eax, [ebp - 0x634]
push eax
call fcn.101078a0
mov ecx, dword [ebp - 0x634]
lea edx, [ebp - 0x634]
add esp, 4
cmp dword [ebp - 0x620], 8
jb 0x10108783
mov edx, ecx
lea esi, [ebp - 0x634]
jb 0x1010878d
mov esi, ecx
mov eax, dword [ebp - 0x624]
lea eax, [esi + eax*2]
lea esi, [ebp - 0x634]
jb 0x101087a0
mov esi, ecx
mov ecx, eax
xor edi, edi
sub ecx, esi
inc ecx
shr ecx, 1
cmp eax, esi
sbb eax, eax
not eax
and eax, ecx
mov dword [ebp - 0x648], eax
je 0x101087e8
sub edx, esi
mov ebx, eax
mov dword [ebp - 0x638], edx
movzx eax, word [esi]
push eax
call sub.msvcrt.dll_towlower
mov ecx, dword [ebp - 0x638]
lea esi, [esi + 2]
inc edi
add esp, 4
mov word [ecx + esi - 2], ax
cmp edi, ebx
jne 0x101087c3
mov ebx, dword [ebp - 0x644]
lea eax, [ebp - 0x634]
push 0x10214db8
push eax
call fcn.101073c0
add esp, 8
test al, al
jne 0x10108bc7
lea eax, [ebp - 0x634]
push str.service
push eax
call fcn.101073c0
add esp, 8
test al, al
jne 0x10108bc7
push 0x208
lea eax, [ebp - 0x61c]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x61c]
push 0
push 0x28
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x10108b5a
lea eax, [ebp - 0x648]
push str._SystemRoot_
push eax
call fcn.10008d60
push 0x208
lea eax, [ebp - 0x414]
push 0
push eax
call sub.msvcrt.dll_memset
mov esi, dword [ebp - 0x648]
lea ecx, [ebp - 0x414]
mov eax, ecx
add esp, 0x14
mov edx, 0x104
sub esi, eax
lea ecx, [ecx]
lea eax, [edx + 0x7ffffefa]
test eax, eax
je 0x101088b0
movzx eax, word [esi + ecx]
test ax, ax
je 0x101088b0
mov word [ecx], ax
add ecx, 2
sub edx, 1
jne 0x10108890
jmp 0x101088b4
test edx, edx
jne 0x101088b7
sub ecx, 2
mov edi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
xor eax, eax
mov word [ecx], ax
lea eax, [ebp - 0x414]
push str...Documents_and_Settings
push eax
call edi
lea eax, [ebp - 0x61c]
push eax
lea ecx, [ebp - 0x640]
call fcn.10002490
push 0x10202944
lea ecx, [ebp - 0x640]
call fcn.100dea80
push 0x10202940
lea ecx, [ebp - 0x63c]
call fcn.10002490
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x63c]
neg eax
sbb eax, eax
and eax, 0xfffffdf8
add eax, 0x4dc
add eax, ebx
push eax
call fcn.10008170
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call sub.msvcrt.dll_memset
mov esi, dword [ebp - 0x63c]
lea ecx, [ebp - 0x20c]
mov eax, ecx
add esp, 0xc
mov edx, 0x104
sub esi, eax
lea esp, [esp]
lea eax, [edx + 0x7ffffefa]
test eax, eax
je 0x10108970
movzx eax, word [esi + ecx]
test ax, ax
je 0x10108970
mov word [ecx], ax
add ecx, 2
sub edx, 1
jne 0x10108950
jmp 0x10108974
test edx, edx
jne 0x10108977
sub ecx, 2
xor eax, eax
mov word [ecx], ax
lea ecx, [ebp - 0x638]
push 0x9c40
call fcn.10002490
push dword [eax]
lea eax, [ebp - 0x20c]
push eax
call edi
lea ecx, [ebp - 0x638]
call fcn.10007e10
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x644]
call fcn.10002490
mov esi, dword [ebp - 0x640]
push 0x5c
push esi
call sub.msvcrt.dll_wcsrchr
mov edi, eax
add esp, 8
test edi, edi
je 0x10108a65
sub edi, esi
sar edi, 1
test edi, edi
jle 0x10108a65
cmp edi, dword [esi - 0xc]
jl 0x101089f7
add esi, 0xfffffff0
push esi
call fcn.10002a60
add esp, 4
add eax, 0x10
mov dword [ebp - 0x638], eax
jmp 0x10108a42
mov ecx, dword [esi - 0x10]
test ecx, ecx
je 0x10108a07
mov eax, dword [ecx]
call dword [eax + 0x10]
test eax, eax
jne 0x10108a13
call fcn.10002d70
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x10]
mov edx, dword [eax]
mov ecx, eax
push 2
push edi
call dword [edx]
test eax, eax
je 0x10108c3a
add eax, 0x10
xor ecx, ecx
push edi
push esi
push edi
mov dword [eax - 0xc], edi
push eax
mov dword [ebp - 0x638], eax
mov word [eax + edi*2], cx
call fcn.10008010
add esp, 0x10
lea eax, [ebp - 0x638]
push eax
lea ecx, [ebp - 0x640]
call fcn.10002790
lea ecx, [ebp - 0x638]
call fcn.10007e10
mov esi, dword [ebp - 0x640]
push 0
push ecx
add esi, 0xfffffff0
mov edi, esp
push esi
call fcn.10002a60
mov esi, dword [ebp - 0x64c]
add eax, 0x10
mov ecx, esp
mov dword [edi], eax
push esi
call fcn.1001b810
mov ecx, ebx
call fcn.10107610
test eax, eax
jne 0x10108ab5
push eax
push ecx
lea eax, [ebp - 0x414]
mov ecx, esp
push eax
call fcn.10002490
push ecx
mov ecx, esp
push esi
call fcn.1001b810
mov ecx, ebx
call fcn.10107610
test eax, eax
je 0x10108b2e
mov ecx, esi
call fcn.10109170
lea ecx, [ebp - 0x63c]
call fcn.10109170
lea ecx, [ebp - 0x644]
call fcn.10109170
mov eax, dword [ebp - 0x63c]
test eax, eax
je 0x10108af8
mov ecx, dword [esi]
cmp dword [ecx - 0xc], 0
jl 0x10108af8
push eax
push ecx
call sub.msvcrt.dll_wcsstr
add esp, 8
test eax, eax
je 0x10108af8
sub eax, dword [esi]
sar eax, 1
je 0x10108b2e
mov eax, dword [ebp - 0x644]
test eax, eax
je 0x10108c07
mov ecx, dword [esi]
cmp dword [ecx - 0xc], 0
jl 0x10108c07
push eax
push ecx
call sub.msvcrt.dll_wcsstr
add esp, 8
test eax, eax
je 0x10108c07
sub eax, dword [esi]
sar eax, 1
jne 0x10108c07
lea ecx, [ebp - 0x644]
call fcn.10007e10
lea ecx, [ebp - 0x63c]
call fcn.10007e10
lea ecx, [ebp - 0x640]
call fcn.10007e10
lea ecx, [ebp - 0x648]
call fcn.10007e10
mov eax, dword [ebx + 0xc4]
xor edi, edi
mov ecx, dword [ebx + 0xc0]
sub eax, ecx
sar eax, 2
test eax, eax
je 0x10108bc7
mov eax, dword [ecx + edi*4]
push 0
push ecx
sub eax, 0x10
mov esi, esp
push eax
call fcn.10002a60
add eax, 0x10
mov dword [esi], eax
mov esi, esp
mov eax, dword [ebp - 0x64c]
mov eax, dword [eax]
sub eax, 0x10
push eax
call fcn.10002a60
add esp, 4
add eax, 0x10
mov ecx, ebx
mov dword [esi], eax
call fcn.10107610
test eax, eax
jne 0x10108c33
mov eax, dword [ebx + 0xc4]
inc edi
mov ecx, dword [ebx + 0xc0]
sub eax, ecx
sar eax, 2
cmp edi, eax
jb 0x10108b71
xor esi, esi
lea ecx, [ebp - 0x634]
call fcn.10005250
mov edi, dword [ebp - 0x650]
or eax, 0xffffffff
add edi, 0xfffffff0
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x10108bf2
mov ecx, dword [edi]
push edi
mov edx, dword [ecx]
call dword [edx + 4]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.101f99c6
mov esp, ebp
pop ebp
ret 8
lea ecx, [ebp - 0x644]
call fcn.10007e10
lea ecx, [ebp - 0x63c]
call fcn.10007e10
lea ecx, [ebp - 0x640]
call fcn.10007e10
lea ecx, [ebp - 0x648]
call fcn.10007e10
mov esi, 1
jmp 0x10108bc9
call fcn.10003970
int3