Function at 0x1000d470
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x4e4]
sub esp, 0x4e4
push 0xffffffffffffffff
push 0x1003834d
mov eax, dword fs:[0]
push eax
sub esp, 0x238
mov eax, dword [0x1004f100]
xor eax, ebp
mov dword [ebp + 0x4e0], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0x4ec]
xor ebx, ebx
push 0x18c
lea ecx, [ebp - 0x240]
push ebx
push ecx
mov dword [ebp - 0x28], eax
mov edi, str.Microsoft_Windows_TerminalServices_LocalSessionManager_4Operational.evtx
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x244], ebx
call fcn.100285e0
add esp, 0xc
push str.QueryEvent_...
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x18], ebx
call fcn.1001af90
mov ecx, eax
call fcn.1001b3f0
push 0x190
lea edx, [ebp - 0x244]
push ebx
push edx
mov dword [ebp - 4], ebx
call fcn.100285e0
push 0x206
lea ecx, [ebp + 0xd2]
xor eax, eax
push ebx
push ecx
mov word [ebp + 0xd0], ax
call fcn.100285e0
add esp, 0x1c
push 0x104
lea edx, [ebp + 0xd0]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov eax, 0x104
lea ecx, [ebp + 0xd0]
xor esi, esi
mov edx, eax
mov edi, edi
cmp eax, ebx
je 0x1000d55f
cmp word [ecx], bx
je 0x1000d5a5
add ecx, 2
dec eax
jmp 0x1000d550
mov esi, 0x80070057
xor edx, edx
cmp esi, ebx
jl 0x1000d587
mov ecx, 0x104
sub ecx, edx
push str.winevtLogs_
lea edx, [ebp + edx*2 + 0xd0]
mov eax, 0x7fffffff
call fcn.10014100
mov eax, 0x104
lea ecx, [ebp + 0xd0]
xor esi, esi
mov edx, eax
cmp eax, ebx
je 0x1000d5ad
cmp word [ecx], bx
je 0x1000d5f8
add ecx, 2
dec eax
jmp 0x1000d596
cmp esi, ebx
jl 0x1000d564
sub edx, eax
jmp 0x1000d566
mov esi, 0x80070057
xor eax, eax
cmp esi, ebx
jl 0x1000d5d1
mov ecx, 0x104
sub ecx, eax
lea edx, [ebp + eax*2 + 0xd0]
push edi
mov eax, 0x7fffffff
call fcn.10014100
push str.Wow64DisableWow64FsRedirection
push str.kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
cmp eax, ebx
je 0x1000d602
lea ecx, [ebp - 0x2c]
push ecx
call eax
mov esi, eax
jmp 0x1000d607
cmp esi, ebx
jl 0x1000d5b2
sub edx, eax
mov eax, edx
jmp 0x1000d5b4
mov esi, 1
mov eax, dword [ebp - 0x5c]
push 0x202
push 0
lea edx, [ebp + 0xd0]
push edx
push eax
mov dword [ebp - 0x30], esi
call sub.wevtapi.dll_EvtQuery
mov ebx, eax
mov dword [ebp - 0x60], ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x14], eax
test esi, esi
je 0x1000d657
mov esi, dword [ebp - 0x2c]
push str.Wow64RevertWow64FsRedirection
push str.kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call edi
test eax, eax
je 0x1000d650
push esi
call eax
mov dword [ebp - 0x30], 0
test ebx, ebx
jne 0x1000d68b
call fcn.1001af90
mov esi, dword [ebp - 0x14]
push esi
lea ecx, [ebp + 0xd0]
push ecx
push str.EvtQuery_failed_Path:_s_Error:_08x
mov ecx, eax
call fcn.1001b3f0
add esp, 0xc
push 0x10049464
lea edx, [ebp - 0x6c]
push edx
mov dword [ebp - 0x6c], esi
call fcn.10028c35
lea eax, [ebp - 0x24]
push eax
push 0
push 0
lea ecx, [ebp - 0x244]
push ecx
push 0x64
push ebx
mov dword [ebp - 0x24], 0
call sub.wevtapi.dll_EvtNext
test eax, eax
jne 0x1000d6e2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call fcn.1001af90
push esi
lea edx, [ebp + 0xd0]
push edx
push str.EvtNext_failed_Path:_s_Error:_08x
mov ecx, eax
call fcn.1001b3f0
add esp, 0xc
push 0x10049464
lea eax, [ebp - 0x68]
push eax
mov dword [ebp - 0x68], esi
call fcn.10028c35
call fcn.1001af90
mov ecx, dword [ebp - 0x24]
push ecx
push str.QueryEvent_Count:_d
mov ecx, eax
call fcn.1001b3f0
xor ecx, ecx
mov eax, 0x1000
add esp, 8
mov dword [ebp - 0x64], eax
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1002651c
mov esi, eax
add esp, 4
xor eax, eax
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x1c], eax
cmp eax, dword [ebp - 0x24]
jae 0x1000ddce
mov ebx, dword [ebp + eax*4 - 0x244]
mov eax, dword [ebp - 0x64]
add eax, eax
mov dword [ebp - 0x20], eax
test esi, esi
jne 0x1000d75e
push 8
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0x10049464
lea eax, [ebp - 0x74]
push eax
mov dword [ebp - 0x74], 8
call fcn.10028c35
test eax, eax
je 0x1000d76e
push eax
push 0
push esi
call fcn.100285e0
add esp, 0xc
mov edx, dword [ebp - 0x20]
push 0
lea ecx, [ebp - 0x20]
push ecx
push esi
push edx
push 1
push ebx
push 0
call sub.wevtapi.dll_EvtRender
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov dword [ebp - 0x14], edi
test esi, esi
jne 0x1000d864
cmp edi, 0x7a
jne 0x1000d832
mov esi, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
add esi, esi
push eax
mov dword [ebp - 0x64], esi
call fcn.1002716e
xor ecx, ecx
mov eax, esi
mov edx, 2
mul edx
seto cl
mov dword [ebp - 0x18], 0
neg ecx
or ecx, eax
push ecx
call fcn.1002651c
mov edi, eax
add esp, 8
mov dword [ebp - 0x18], edi
test edi, edi
jne 0x1000d7fa
push 8
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0x10049464
lea eax, [ebp - 0x70]
push eax
mov dword [ebp - 0x70], 8
call fcn.10028c35
add esi, esi
je 0x1000d80a
push esi
push 0
push edi
call fcn.100285e0
add esp, 0xc
push 0
lea ecx, [ebp - 0x20]
push ecx
push edi
mov eax, esi
push eax
push 1
push ebx
push 0
mov dword [ebp - 0x20], eax
call sub.wevtapi.dll_EvtRender
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x14], eax
test esi, esi
jne 0x1000d864
mov edi, eax
call fcn.1001af90
mov edx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x1c]
push edi
push edx
push ecx
lea edx, [ebp + 0xd0]
push edx
push str.EvtRender_failed_Path:_s_Index:_d___d_Error:_08x
mov ecx, eax
call fcn.1001b3f0
mov esi, dword [ebp - 0x18]
add esp, 0x14
inc dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
jmp 0x1000d725
lea eax, [ebp]
push eax
call fcn.100058a0
xor ebx, ebx
xor ecx, ecx
mov edi, 7
xor edx, edx
mov dword [ebp + 0xc8], edi
mov dword [ebp + 0xc4], ebx
mov word [ebp + 0xb4], cx
mov byte [ebp + 0x94], 1
mov byte [ebp + 0x95], 1
mov byte [ebp + 0x9e], cl
mov dword [ebp + 0x98], 0x10051414
mov dword [ebp + 0xa0], ebx
mov byte [ebp + 0xa4], cl
mov dword [ebp + 0xa8], ebx
mov dword [ebp + 0xac], ebx
mov word [ebp + 0x9c], dx
mov dword [ebp + 0xcc], ebx
mov esi, dword [ebp - 0x18]
lea eax, [ebp + 0x94]
push eax
push esi
lea ecx, [ebp]
mov byte [ebp - 4], 2
call fcn.100221d0
cmp eax, ebx
jne 0x1000d936
call fcn.1001af90
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x1c]
push esi
push ecx
push edx
push str.Index:_d___d_xml.error:_s
mov ecx, eax
call fcn.1001b3f0
add esp, 0x10
cmp dword [ebp + 0xc8], 8
jb 0x1000d91e
mov eax, dword [ebp + 0xb4]
push eax
call fcn.100269ba
add esp, 4
xor ecx, ecx
lea edx, [ebp]
mov dword [ebp + 0xc8], edi
mov word [ebp + 0xb4], cx
push edx
jmp 0x1000ddb1
xor eax, eax
mov dword [ebp + 0x90], edi
mov dword [ebp + 0x8c], ebx
mov word [ebp + 0x7c], ax
lea ecx, [ebp - 0x94]
push ecx
mov byte [ebp - 4], 3
call fcn.1000f920
push str.System
lea esi, [ebp]
mov byte [ebp - 4], 4
call fcn.10022a70
mov esi, eax
cmp esi, ebx
je 0x1000dac1
push str.EventID
call fcn.10022a70
push str.TimeCreated
mov edi, eax
call fcn.10022a70
mov dword [ebp - 0x58], eax
cmp edi, ebx
je 0x1000da27
push 0x206
lea eax, [ebp + 0x2da]
xor edx, edx
push ebx
push eax
mov word [ebp + 0x2d8], dx
call fcn.100285e0
add edi, 0x20
add esp, 0xc
cmp dword [edi + 0x18], 8
jb 0x1000d9c0
mov eax, dword [edi + 4]
jmp 0x1000d9c3
lea eax, [edi + 4]
push eax
push str.EventID
push str._r_n_tName:_s_value:_s_
lea ecx, [ebp + 0x2d8]
push 0x103
push ecx
call fcn.10001f00
add esp, 0x14
lea edx, [ebp + 0x78]
push edx
lea edx, [ebp + 0x2d8]
call fcn.10005120
mov edx, str.EventID
lea esi, [ebp - 0x54]
call fcn.10003d20
mov eax, esi
push eax
lea ecx, [ebp - 0x94]
push ecx
mov byte [ebp - 4], 5
call fcn.1000ec30
push 0xffffffffffffffff
push ebx
push edi
mov ecx, eax
call fcn.10001b50
mov ecx, esi
mov byte [ebp - 4], 4
call fcn.100019f0
cmp dword [ebp - 0x58], ebx
je 0x1000dac1
mov ebx, dword [ebp - 0x58]
mov eax, str.SystemTime
call fcn.10022960
mov edi, eax
test edi, edi
je 0x1000dabf
xor edx, edx
push 0x206
push edx
lea eax, [ebp + 0x2da]
push eax
mov word [ebp + 0x2d8], dx
call fcn.100285e0
push edi
push str.TimeCreated
push str._r_n_tName:_s_value:_s_
lea ecx, [ebp + 0x2d8]
push 0x103
push ecx
call fcn.10001f00
add esp, 0x20
lea edx, [ebp + 0x78]
push edx
lea edx, [ebp + 0x2d8]
call fcn.10005120
mov edx, str.TimeCreated
lea esi, [ebp - 0x54]
call fcn.10003d20
mov eax, esi
push eax
lea ecx, [ebp - 0x94]
push ecx
mov byte [ebp - 4], 6
call fcn.1000ec30
push edi
mov ecx, eax
call fcn.10001a20
mov ecx, esi
mov byte [ebp - 4], 4
call fcn.100019f0
xor ebx, ebx
push str.UserData
lea esi, [ebp]
call fcn.10022a70
cmp eax, ebx
je 0x1000db8e
push str.EventXML
mov esi, eax
call fcn.10022a70
mov esi, eax
test esi, esi
je 0x1000db8e
push str.Session
call fcn.10022a70
push str.Reason
mov edi, eax
call fcn.10022a70
mov ebx, eax
test edi, edi
je 0x1000db42
mov edx, str.Session
lea esi, [ebp - 0x54]
call fcn.10003d20
mov edx, esi
push edx
lea eax, [ebp - 0x94]
push eax
mov byte [ebp - 4], 7
call fcn.1000ec30
push 0xffffffffffffffff
push 0
add edi, 0x20
push edi
mov ecx, eax
call fcn.10001b50
mov ecx, esi
mov byte [ebp - 4], 4
call fcn.100019f0
test ebx, ebx
je 0x1000db80
mov edx, str.Session
lea esi, [ebp - 0x54]
call fcn.10003d20
mov ecx, esi
push ecx
lea edx, [ebp - 0x94]
push edx
mov byte [ebp - 4], 8
call fcn.1000ec30
push 0xffffffffffffffff
push 0
add ebx, 0x20
push ebx
mov ecx, eax
call fcn.10001b50
mov ecx, esi
mov byte [ebp - 4], 4
call fcn.100019f0
mov edi, dword [ebp - 0x28]
lea ebx, [ebp - 0x94]
call fcn.1000ee10
push str.EventData
lea esi, [ebp]
call fcn.10022a70
test eax, eax
je 0x1000dd45
lea ecx, [ebp - 0x50]
push ecx
mov esi, eax
call fcn.10022980
mov byte [ebp - 4], 9
mov edi, dword [ebp - 0x44]
mov eax, dword [ebp - 0x40]
cmp edi, eax
jbe 0x1000dbc4
call fcn.100272d6
mov eax, dword [ebp - 0x40]
mov esi, dword [ebp - 0x50]
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x34], edi
lea ecx, [ecx]
mov ebx, eax
cmp dword [ebp - 0x44], eax
jbe 0x1000dbdc
call fcn.100272d6
test esi, esi
je 0x1000dbe5
cmp esi, dword [ebp - 0x50]
je 0x1000dbea
call fcn.100272d6
cmp edi, ebx
je 0x1000dd10
test esi, esi
jne 0x1000dc20
call fcn.100272d6
cmp edi, dword [esi + 0x10]
jb 0x1000dc05
call fcn.100272d6
mov ebx, dword [edi]
push 0x10041078
call fcn.100228e0
test eax, eax
je 0x1000dc29
cmp dword [eax + 0x34], 8
jb 0x1000dc24
mov edi, dword [eax + 0x20]
jmp 0x1000dc2b
mov esi, dword [esi]
jmp 0x1000dbfb
lea edi, [eax + 0x20]
jmp 0x1000dc2b
xor edi, edi
cmp dword [ebx + 0x38], 8
jb 0x1000dc36
mov ebx, dword [ebx + 0x24]
jmp 0x1000dc39
add ebx, 0x24
test edi, edi
je 0x1000dcdf
test ebx, ebx
je 0x1000dcdf
mov edx, edi
lea esi, [ebp - 0xb4]
call fcn.10003d20
mov edx, esi
push edx
lea eax, [ebp - 0x94]
push eax
mov byte [ebp - 4], 0xa
call fcn.1000ec30
push ebx
mov ecx, eax
call fcn.10001a20
mov ecx, esi
mov byte [ebp - 4], 9
call fcn.100019f0
xor ecx, ecx
push 0x206
push ecx
lea edx, [ebp + 0x2da]
push edx
mov word [ebp + 0x2d8], cx
call fcn.100285e0
push ebx
push edi
push str._r_n_tName:_s_value:_s_
lea eax, [ebp + 0x2d8]
push 0x103
push eax
call fcn.10001f00
lea eax, [ebp + 0x2d8]
add esp, 0x20
lea edx, [eax + 2]
jmp 0x1000dcc0
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1000dcc0
sub eax, edx
sar eax, 1
push eax
lea ecx, [ebp + 0x2d8]
push ecx
lea eax, [ebp + 0x78]
call fcn.10005480
mov eax, dword [ebp - 0x38]
test eax, eax
jne 0x1000dd0c
call fcn.100272d6
xor eax, eax
mov edx, dword [ebp - 0x34]
cmp edx, dword [eax + 0x10]
jb 0x1000dcfa
call fcn.100272d6
add dword [ebp - 0x34], 4
mov eax, dword [ebp - 0x40]
mov edi, dword [ebp - 0x34]
mov esi, dword [ebp - 0x38]
jmp 0x1000dbd0
mov eax, dword [eax]
jmp 0x1000dced
mov edi, dword [ebp - 0x28]
lea ebx, [ebp - 0x94]
call fcn.1000ee10
mov eax, dword [ebp - 0x44]
xor esi, esi
cmp eax, esi
je 0x1000dd30
push eax
call fcn.100269ba
add esp, 4
mov eax, dword [ebp - 0x50]
push eax
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x3c], esi
call fcn.100269ba
add esp, 4
lea ecx, [ebp - 0x94]
push ecx
mov byte [ebp - 4], 3
call fcn.1000b3f0
mov edi, 8
cmp dword [ebp + 0x90], edi
jb 0x1000dd6e
mov edx, dword [ebp + 0x7c]
push edx
call fcn.100269ba
add esp, 4
xor ebx, ebx
xor eax, eax
mov esi, 7
mov dword [ebp + 0x90], esi
mov dword [ebp + 0x8c], ebx
mov word [ebp + 0x7c], ax
cmp dword [ebp + 0xc8], edi
jb 0x1000dd9e
mov ecx, dword [ebp + 0xb4]
push ecx
call fcn.100269ba
add esp, 4
xor edx, edx
lea eax, [ebp]
mov dword [ebp + 0xc8], esi
mov word [ebp + 0xb4], dx
push eax
mov dword [ebp + 0xc4], ebx
mov byte [ebp - 4], 0
call fcn.10020f80
inc dword [ebp - 0x1c]
mov esi, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
jmp 0x1000d725
mov dword [ebp - 4], 0xffffffff
xor edi, edi
cmp dword [ebp - 0x30], edi
je 0x1000ddfd
mov esi, dword [ebp - 0x2c]
push str.Wow64RevertWow64FsRedirection
push str.kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, edi
je 0x1000ddfd
push esi
call eax
mov eax, dword [ebp - 0x18]
cmp eax, edi
je 0x1000de0d
push eax
call fcn.1002716e
add esp, 4
xor esi, esi
nop
mov eax, dword [ebp + esi*4 - 0x244]
cmp eax, edi
je 0x1000de28
push eax
call sub.wevtapi.dll_EvtClose
mov dword [ebp + esi*4 - 0x244], edi
inc esi
cmp esi, 0x64
jb 0x1000de10
mov eax, dword [ebp - 0x60]
cmp eax, edi
je 0x1000de3b
push eax
call sub.wevtapi.dll_EvtClose
mov eax, dword [ebp - 0x5c]
cmp eax, edi
je 0x1000de48
push eax
call sub.wevtapi.dll_EvtClose
mov ecx, dword [ebp - 0x28]
mov eax, dword [ecx + 0x10]
sub eax, dword [ecx + 0xc]
mov esi, dword [ebp - 0x14]
sar eax, 5
push eax
push esi
push str.QueryEvent.Rlt:_08x_Count:_d
call fcn.1001af90
mov ecx, eax
call fcn.1001b3f0
add esp, 0xc
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x4e0]
xor ecx, ebp
call fcn.100269c5
add ebp, 0x4e4
mov esp, ebp
pop ebp
ret