Function at 0x418630
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffecc
mov dword [ebp - 4], 0x23
mov eax, dword [0x423820]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_GetCurrentDirectoryW
and dword [0x4220ce], ecx
sub edi, 0xaf
mov dword [0x422088], ecx
mov dword [esp - 0x18], ebx
mov byte [0x422057], 0x94
test edx, edx
jne 0x418681
mov word [0x422014], 0xcdd2
jmp 0x418687
mov dword [0x422076], eax
mov dword [0x4220ed], ebx
mov byte [0x4220ac], 0x22
mov dword [0x42205e], ecx
mov dword [0x422092], 0x146e1
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], 0x15ff0
mov dword [ebp - 0x18], 0x1123d
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0xac]
push eax
mov eax, dword [ebp - 0x14]
push eax
lea eax, [ebp - 0xa0]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_AdjustTokenGroups
test eax, eax
jne 0x41870a
add esi, dword [0x4220c3]
mov dword [0x4220b4], ebx
cmp ah, byte [ebp - 0x28]
jne 0x418701
and dword [0x42207f], eax
mov dword [0x42202b], esi
mov dword [0x422061], edi
mov dword [0x42205a], eax
sub esi, 0x58
add dword [0x4220ec], edx
mov dword [0x422066], 0x17159
mov dword [0x422012], ebx
mov edx, 0x159
mov byte [ebp - 0x91], 0
mov dword [0x422085], ecx
mov dword [0x4220b4], esi
mov dword [esp - 0x10], ebx
test edx, edx
je 0x418757
mov dword [0x422088], eax
mov word [0x422016], 0xc6c7
mov edx, dword [0x422097]
jmp 0x418767
mov dword [esp - 0x12], ecx
mov dword [0x42209e], eax
xchg dword [0x422063], ebx
mov dword [ebp - 0x1c], 0x1ec0c
mov eax, dword [ebp - 0x1c]
push eax
call sub.user32.dll_SetCaretBlinkTime
test eax, eax
jne 0x418794
mov byte [0x4220a9], 0x5b
xchg dword [esp - 0x28], ecx
mov ecx, esi
xchg dword [0x4220f8], edx
mov dword [0x42201d], ebx
mov byte [0x4220c7], 5
lea esi, [0x42208b]
mov dword [esi], edi
mov dword [0x422036], 0x133d4
xchg dword [esp - 0x20], edx
inc byte [ebp - 0x91]
cmp byte [ebp - 0x91], 1
jne 0x41872c
mov byte [ebp - 0x91], 0
mov dword [0x42207a], esi
mov dword [0x42202b], ecx
sub esi, 0x70
add dword [0x422086], ecx
call sub.kernel32.dll_AreFileApisANSI
call fcn.0041aec8
inc byte [ebp - 0x91]
cmp byte [ebp - 0x91], 2
jne 0x4187cb
mov dword [0x4220d0], edx
mov dword [esp - 0x1c], edi
mov dword [0x422043], eax
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x28], 0x1f3db
mov dword [ebp - 0x2c], 0x1fa07
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0xc4]
push eax
mov eax, dword [ebp - 0x28]
push eax
lea eax, [ebp - 0xb8]
push eax
mov eax, dword [ebp - 0x24]
push eax
mov eax, dword [ebp - 0x20]
push eax
call sub.advapi32.dll_AdjustTokenGroups
mov dword [0x422097], esi
mov dword [0x4220e7], eax
mov word [0x422018], 0x1980
mov dword [0x422061], esi
xchg dword [0x422083], eax
mov dword [0x4220cb], ebx
mov dword [0x422046], edi
xor eax, eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x38], 0x1220f
mov dword [ebp - 0x3c], 0x13e30
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0xdc]
push eax
mov eax, dword [ebp - 0x38]
push eax
lea eax, [ebp - 0xd0]
push eax
mov eax, dword [ebp - 0x34]
push eax
mov eax, dword [ebp - 0x30]
push eax
call sub.advapi32.dll_AdjustTokenGroups
test eax, eax
jne 0x4188bd
mov eax, 0xef
xchg dword [0x42207f], edi
mov dword [0x422022], 0x11aff
mov byte [0x422057], 0x94
test edx, edx
jne 0x4188d3
mov word [0x422014], 0xcdd2
jmp 0x4188d9
mov dword [0x422076], eax
mov dword [0x4220ed], ebx
call fcn.00401020
dec edi
add dword [0x42201f], ebx
add eax, 0x7c
mov byte [0x4220af], 0x9d
mov dword [0x422069], edx
mov eax, 0x418bb4
mov dword [ebp - 0x40], eax
xor eax, eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x4c], 0x17e67
xor eax, eax
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
push eax
lea eax, [ebp - 0xf0]
push eax
mov eax, dword [ebp - 0x4c]
push eax
mov eax, dword [ebp - 0x48]
push eax
mov eax, dword [ebp - 0x44]
push eax
mov eax, dword [ebp - 0x40]
push eax
call sub.advapi32.dll_ObjectPrivilegeAuditAlarmA
test eax, eax
je 0x41896d
lea eax, [0x422022]
sub dword [eax], edx
mov dword [0x4220fc], eax
cmp byte [0x42201c], 0
jge 0x418965
mov word [0x42203f], 0x340c
xchg dword [0x4220b3], ecx
mov byte [0x4220f7], 0x85
sub esi, dword [0x42201b]
mov eax, edi
call fcn.004015d0
mov byte [0x422019], 0x57
xchg dword [0x422039], ecx
mov dword [0x4220e7], 0x1290f
mov dword [ebp - 0x58], 0xffffffff
mov dword [ebp - 0x5c], 0x1a792
mov dword [ebp - 0x60], 0x1c95a
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x108]
push eax
mov eax, dword [ebp - 0x5c]
push eax
lea eax, [ebp - 0xfc]
push eax
mov eax, dword [ebp - 0x58]
push eax
mov eax, dword [ebp - 0x54]
push eax
call sub.advapi32.dll_AdjustTokenGroups
test eax, eax
jne 0x4189fb
mov dword [0x422023], ecx
cmp byte [0x4220e9], 0
jne 0x4189e6
mov dword [0x422075], edx
mov dword [0x422108], ecx
mov dword [0x4220ea], eax
mov dword [0x422013], ecx
mov dword [0x4220f5], esi
mov word [0x4220ec], 0xa13b
mov byte [ebp - 0x91], 0
mov dword [ebp - 0x68], 0xffffffff
mov dword [ebp - 0x6c], 0x1b117
mov dword [ebp - 0x70], 0x1e74c
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x120]
push eax
mov eax, dword [ebp - 0x6c]
push eax
lea eax, [ebp - 0x114]
push eax
mov eax, dword [ebp - 0x68]
push eax
mov eax, dword [ebp - 0x64]
push eax
call sub.advapi32.dll_AdjustTokenGroups
test eax, eax
je 0x418a5e
mov dword [0x422061], esi
mov word [0x42202c], 0x3b5b
mov dword [esp - 0x24], eax
mov byte [0x4220eb], 0xe6
mov dword [0x422105], ecx
inc byte [ebp - 0x91]
cmp byte [ebp - 0x91], 1
jne 0x418a02
mov byte [0x422057], 0x94
test edx, edx
jne 0x418a83
mov word [0x422014], 0xcdd2
jmp 0x418a89
mov dword [0x422076], eax
mov dword [0x4220ed], ebx
call fcn.00401c7c
mov eax, 0x418bbc
mov dword [ebp - 0x74], eax
xor eax, eax
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x80], 0x10514
mov dword [ebp - 0x84], 0xffffffff
mov eax, dword [ebp - 0x84]
push eax
lea eax, [ebp - 0x134]
push eax
mov eax, dword [ebp - 0x80]
push eax
mov eax, dword [ebp - 0x7c]
push eax
mov eax, dword [ebp - 0x78]
push eax
mov eax, dword [ebp - 0x74]
push eax
call sub.advapi32.dll_ObjectPrivilegeAuditAlarmA
test eax, eax
jne 0x418af6
mov dword [0x42201f], eax
mov byte [0x4220ac], 0x14
mov dword [0x422055], 0x128ca
xchg dword [0x4220ae], ebx
mov edi, 0x5b
mov dword [0x4220f1], ebx
xchg dword [0x4220ac], edi
mov ebx, ecx
cmp ecx, 0xffffffff
jle 0x418b27
mov dword [0x42204d], edx
add dword [0x4220a1], eax
lea esi, [0x4220c5]
mov dword [esi + 0x1c], 0x20
mov esi, ecx
mov dword [ebp - 0x88], 0x29
mov eax, dword [0x423820]
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 0x8c]
push eax
mov eax, dword [ebp - 0x88]
push eax
call sub.kernel32.dll_GetCurrentDirectoryW
test eax, eax
jne 0x418b73
mov ecx, esi
mov dword [0x4220d0], edi
mov dword [0x42204a], 0x1316f
mov dword [0x42204b], edi
mov ebx, dword [0x422011]
xchg dword [0x4220fe], edx
xchg dword [0x42205b], ecx
mov byte [0x422088], 0xf1
mov dword [ebp - 0x90], 0x10abf
mov eax, dword [ebp - 0x90]
push eax
call sub.user32.dll_SetCaretBlinkTime
test eax, eax
jne 0x418baf
and ecx, 0x34
and dword [0x422069], edi
mov edx, 0xec
dec eax
mov esp, ebp
pop ebp
ret