Function at 0x10378e5
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification]
push ebx
push esi
push edi
mov edi, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
mov dword [ebp - 4], eax
lea eax, reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification
push eax
xor esi, esi
push 0xb
push esi
mov dword [ebp - reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification], esi
call edi
test eax, eax
mov ebx, 0x100badc
jl 0x10379fa
lea eax, reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification
push eax
push 0x16
push esi
call edi
test eax, eax
jl 0x10379dd
lea eax, reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification
push eax
push 0x100cad4
push 1
push esi
push 0x1037bc8
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x10379cf
push dword [ebp - 0x21c]
call fcn.0103abf1
mov edi, eax
cmp edi, esi
je 0x1037984
mov eax, dword [ebp - reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification]
mov ecx, dword [eax]
push 0xff00
push dword [ebp - 0x21c]
push edi
push esi
push eax
call dword [ecx + 0x34]
mov eax, dword [edi]
push edi
call dword [eax + 8]
push dword [ebp - 0x214]
call fcn.0103abf1
mov edi, eax
cmp edi, esi
je 0x10379b0
mov eax, dword [ebp - reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification]
mov ecx, dword [eax]
push esi
push dword [ebp - 0x214]
push edi
push esi
push eax
call dword [ecx + 0x34]
mov eax, dword [edi]
push edi
call dword [eax + 8]
mov eax, dword [ebp - reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification]
mov ecx, dword [eax]
lea edx, reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification
push edx
push ebx
push eax
call dword [ecx]
mov eax, dword [ebp - reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push dword [ebp - 0x214]
call dword [sym.imp.SHELL32.dll_ILFree]
jmp 0x10379ee
push dword [ebp - 0x21c]
call fcn.0103abf1
mov dword [ebp - reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification], eax
push dword [ebp - 0x21c]
call dword [sym.imp.SHELL32.dll_ILFree]
cmp dword [ebp - reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification], esi
je 0x1037afa
lea eax, reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification
push eax
push 0x2001f
push esi
push 0x1037b38
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1037aee
push dword [ebp - 0x218]
push dword [ebp - 0x210]
call fcn.01037758
lea eax, reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification
push eax
push esi
push esi
push 5
push esi
call dword [sym.imp.SHELL32.dll_SHGetFolderLocation]
cmp dword [ebp - reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification], esi
je 0x1037a9d
lea eax, reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification
push eax
push ebx
push esi
push dword [ebp - 0x214]
push esi
call fcn.0100baf1
test eax, eax
jl 0x1037a91
push dword [ebp - 0x220]
push 0x1037b1c
push dword [ebp - 0x210]
call fcn.010376b1
mov eax, dword [ebp - reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push dword [ebp - 0x214]
call dword [sym.imp.SHELL32.dll_ILFree]
lea eax, reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification
push eax
push esi
push esi
push 2
push esi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea eax, reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov esi, 0x1037b08
mov edi, eax
push esi
push edi
call dword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x1037ae2
push dword [ebp - 0x218]
push esi
push edi
push dword [ebp - 0x210]
call fcn.010376ee
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.01001b01
leave
ret