Function at 0x401020
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff2c
call sub.kernel32.dll_AreFileApisANSI
xchg dword [0x42201c], edi
sub esi, 0xb6
mov dword [0x4220a7], ebx
mov byte [0x42205f], 0xb6
mov dword [0x422078], eax
call sub.kernel32.dll_AreFileApisANSI
mov dword [0x422074], esi
add dword [0x422053], edx
mov word [0x4220fe], 0xeed9
mov dword [0x422067], eax
mov word [0x4220e2], 0x48e3
mov edx, 0x1db
mov dword [0x4220df], ecx
mov dword [0x422032], ebx
mov eax, 0x4015ac
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 8], eax
mov dword [ebp - 0x10], 0x169a0
xor eax, eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
push eax
lea eax, [ebp - 0x94]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_ObjectPrivilegeAuditAlarmA
test eax, eax
jne 0x4010e5
mov word [0x422066], 0x1832
mov word [0x422030], 0x74d0
mov ecx, 0x3b
mov dword [esp - 0x12], esi
mov dword [0x4220c0], eax
mov byte [ebp - 0x7d], 0
mov dword [esp - 0x20], ecx
mov dword [0x422019], 0x118ae
mov dword [esp - 8], ebx
cmp word [0x422018], 0
jl 0x401120
mov word [0x4220ae], 0x7ed2
mov dword [0x4220a8], ecx
mov dword [0x4220c7], 0x1224a
jmp 0x40113e
add dword [0x422079], ebx
mov dword [0x422088], edx
mov edi, dword [0x42201b]
dec dword [0x4220e1]
mov dword [0x42207e], ebx
mov eax, 0x4015b4
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x24], 0x11f26
mov dword [ebp - 0x28], 0xffffffff
mov eax, dword [ebp - 0x28]
push eax
lea eax, [ebp - 0xa8]
push eax
mov eax, dword [ebp - 0x24]
push eax
mov eax, dword [ebp - 0x20]
push eax
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_ObjectPrivilegeAuditAlarmA
inc byte [ebp - 0x7d]
cmp byte [ebp - 0x7d], 1
jne 0x4010e9
call sub.kernel32.dll_AreFileApisANSI
mov byte [0x422057], 0x94
test edx, edx
jne 0x4011a1
mov word [0x422014], 0xcdd2
jmp 0x4011a7
mov dword [0x422076], eax
mov dword [0x4220ed], ebx
mov dword [0x4220f5], edi
sub dword [0x4220a6], eax
mov dword [0x42205d], edi
dec ebx
cmp dword [0x422018], ecx
jne 0x4011f3
mov dword [0x42205a], edi
dec dword [0x422013]
mov dword [0x422043], esi
mov dword [0x422062], ebx
lea ecx, [0x4220d7]
mov dword [ecx + 0x20], 0x89
mov dword [0x422053], eax
mov dword [0x4220ea], 0x11f58
mov byte [0x42203b], 0xcf
mov dword [0x422083], 0x11cf4
mov dword [ebp - 0x2c], 2
mov eax, dword [0x423820]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
push eax
mov eax, dword [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetCurrentDirectoryW
test eax, eax
je 0x40124c
mov dword [0x42204e], esi
mov dword [0x422043], 0x148d5
mov edi, dword [esp + 0x24]
mov dword [esp - 4], edx
mov dword [0x422058], eax
mov dword [0x4220ef], edi
mov eax, 0x15b
mov dword [esp - 8], edx
mov dword [0x4220d9], esi
call sub.kernel32.dll_AreFileApisANSI
add eax, 0x4b
mov dword [0x4220f1], edx
mov dword [0x42203e], eax
mov dword [0x422061], 0x1611d
mov dword [0x4220d6], 0x1459d
mov eax, 0x4015c0
mov dword [ebp - 0x34], eax
xor eax, eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x40], 0x1995f
xor eax, eax
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
push eax
lea eax, [ebp - 0xbc]
push eax
mov eax, dword [ebp - 0x40]
push eax
mov eax, dword [ebp - 0x3c]
push eax
mov eax, dword [ebp - 0x38]
push eax
mov eax, dword [ebp - 0x34]
push eax
call sub.advapi32.dll_ObjectPrivilegeAuditAlarmA
mov byte [0x42201a], 0x14
mov dword [0x4220f5], edi
and edx, dword [0x4220e5]
mov dword [0x4220c0], esi
xchg dword [0x422100], eax
mov dword [ebp - 0x48], 0x18
mov eax, dword [0x423820]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
push eax
mov eax, dword [ebp - 0x48]
push eax
call sub.kernel32.dll_GetCurrentDirectoryW
test eax, eax
je 0x401313
mov dword [0x4220d2], 0x10cae
mov edx, eax
mov dword [0x422077], ebx
mov byte [ebp - 0x7d], 0
mov dword [ebp - 0x50], 0x1a30f
mov eax, dword [ebp - 0x50]
push eax
call sub.user32.dll_SetCaretBlinkTime
mov dword [esp - 0x28], eax
test ebx, ebx
jne 0x401336
mov eax, 0xe5
mov eax, edi
mov dword [0x4220c9], 0x11503
mov dword [0x4220ac], edx
mov dword [0x422092], 0x13466
mov dword [0x42205e], 0x13d20
mov ecx, dword [0x4220f4]
mov dword [0x422015], esi
add dword [0x4220e5], ebx
mov eax, ecx
inc byte [ebp - 0x7d]
cmp byte [ebp - 0x7d], 3
jne 0x401317
mov byte [0x42203f], 0x95
mov dword [0x422025], ecx
cmp eax, 0xffffffff
jle 0x4013b4
lea edi, [0x422020]
mov dword [edi + 8], 0x4b
mov dword [0x422035], 0x10313
mov dword [0x422060], esi
mov dword [0x4220c9], ebx
mov dword [0x4220e1], eax
jmp 0x4013dd
mov dword [0x422029], ebx
mov dword [0x422109], 0x10bc9
mov word [0x42207a], 0xb89
mov dword [0x42204c], ebx
mov dword [0x4220d6], 0x17a20
mov dword [0x4220ca], ebx
mov edx, 0x1ab
mov dword [ebp - 0x54], 0xc
mov eax, dword [0x423820]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x58]
push eax
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_GetCurrentDirectoryW
test eax, eax
jne 0x401424
and dword [0x4220b1], edi
mov dword [0x4220da], 0x150c0
xchg dword [0x42209d], eax
mov dword [0x42207b], ebx
mov dword [ebp - 0x5c], 0x33
mov eax, dword [0x423820]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x60]
push eax
mov eax, dword [ebp - 0x5c]
push eax
call sub.kernel32.dll_GetCurrentDirectoryW
test eax, eax
je 0x401457
mov dword [0x422073], ecx
mov byte [0x422102], 0x3b
mov dword [0x42208a], eax
xchg dword [0x4220b1], ecx
mov dword [esp - 0x1c], eax
lea ecx, [0x4220a1]
and dword [ecx], 0xd3
add esi, dword [0x4220b0]
mov dword [ebp - 0x68], 0xffffffff
mov dword [ebp - 0x6c], 0x1be82
mov dword [ebp - 0x70], 0x1c711
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0xd4]
push eax
mov eax, dword [ebp - 0x6c]
push eax
lea eax, [ebp - 0xc8]
push eax
mov eax, dword [ebp - 0x68]
push eax
mov eax, dword [ebp - 0x64]
push eax
call sub.advapi32.dll_AdjustTokenGroups
mov dword [0x422064], esi
cmp edi, 0xffffffff
je 0x4014c0
and dword [0x422076], esi
mov eax, dword [esp + 8]
mov byte [0x4220ce], 0xf5
mov word [0x4220a8], 0x3e7
and dword [0x422087], ebx
mov dword [0x4220ea], 0x12c22
mov dword [0x42204e], ecx
add edi, edx
cmp ebx, 0xffffffff
jle 0x4014f3
mov dword [0x4220fb], edi
mov ebx, edx
mov dword [0x42204c], ecx
mov dword [0x422032], edi
mov dword [0x42207c], edx
mov dword [ebp - 0x74], 0x26
mov eax, dword [0x423820]
mov dword [ebp - 0x78], eax
mov eax, dword [ebp - 0x78]
push eax
mov eax, dword [ebp - 0x74]
push eax
call sub.kernel32.dll_GetCurrentDirectoryW
test eax, eax
jne 0x401553
mov word [0x422086], 0x892
mov dword [0x42204f], edi
cmp dword [0x4220d3], 0
jle 0x40154a
mov dword [0x4220d6], ecx
add eax, 0xe9
mov word [0x422092], 0x79f1
and ecx, 0xa4
mov dword [0x422063], 0x14cf5
mov dword [0x422044], edx
mov dword [0x4220b2], edi
mov dword [0x422059], 0x17af3
mov dword [ebp - 0x7c], 0x16f25
mov eax, dword [ebp - 0x7c]
push eax
call sub.user32.dll_SetCaretBlinkTime
test eax, eax
jne 0x4015a5
inc byte [0x422022]
mov dword [0x422074], edi
and dword [0x4220b1], eax
mov dword [0x422013], ecx
mov esp, ebp
pop ebp
ret