Function at 0x43c050
Capabilities:
Get common file path

Disassembly:
mov eax, 0x10164
call fcn.0046be90
mov eax, dword [0x4b77c0]
xor eax, esp
mov dword [esp + 0x10160], eax
mov dword [esp + 4], 0x10000
call fcn.004346a0
test eax, eax
je 0x43c093
mov eax, 1
mov ecx, dword [esp + 0x10160]
xor ecx, esp
call fcn.0046be7b
add esp, 0x10164
ret
push ebx
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x168]
push ecx
push str.PagingFiles
push str.SystemCurrentControlSetControlSession_ManagerMemory_Management
call fcn.004508c0
add esp, 0x10
xor ebx, ebx
test eax, eax
je 0x43c0e2
cmp dword [esp + 8], 0xc
jbe 0x43c0e2
cmp dword [esp + 0x1016c], ebx
jne 0x43c0e2
lea eax, [ebx + 1]
pop ebx
mov ecx, dword [esp + 0x10160]
xor ecx, esp
call fcn.0046be7b
add esp, 0x10164
ret
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
test eax, eax
jne 0x43c0f6
push str.UAC_INIT_ERROR
call fcn.00430610
push ebp
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileA]
mov byte [esp + 0xf], 0x43
mov ebp, 0x10
push esi
lea esp, [esp]
push 6
push str..X:
lea ecx, [esp + 0x3c]
mov dword [esp + 0x54], 0xf
mov dword [esp + 0x50], ebx
mov byte [esp + 0x40], bl
call fcn.0040c450
cmp dword [esp + 0x48], 4
jae 0x43c13c
call fcn.0046c18e
mov eax, dword [esp + 0x38]
cmp dword [esp + 0x4c], ebp
jae 0x43c14a
lea eax, [esp + 0x38]
mov dl, byte [esp + 0x13]
mov byte [eax + 4], dl
cmp dword [esp + 0x10178], ebx
je 0x43c199
push 0x104
lea eax, [esp + 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x43c199
movsx ecx, byte [esp + 0x6c]
push ecx
call fcn.0046e17b
movsx edx, byte [esp + 0x17]
add esp, 4
cmp eax, edx
jne 0x43c199
cmp dword [esp + 0x4c], ebp
jb 0x43c290
mov eax, dword [esp + 0x38]
push eax
jmp 0x43c288
mov eax, dword [esp + 0x38]
cmp dword [esp + 0x4c], ebp
jae 0x43c1a7
lea eax, [esp + 0x38]
push ebx
push ebx
push 3
push ebx
push 3
push SysReAllocStringLen
push eax
call edi
mov esi, eax
cmp esi, 0xffffffff
je 0x43c27d
push ebx
lea edx, [esp + 0x1c]
push edx
push 0x18
lea eax, [esp + 0x28]
push eax
push ebx
push ebx
push 0x70000
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
push esi
test eax, eax
jne 0x43c1ec
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x43c27d
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push 0xf
push str.X:pagefile.sys
lea ecx, [esp + 0x58]
mov dword [esp + 0x70], 0xf
mov dword [esp + 0x6c], ebx
mov byte [esp + 0x5c], bl
call fcn.0040c450
mov eax, dword [esp + 0x54]
cmp dword [esp + 0x68], ebp
jae 0x43c222
lea eax, [esp + 0x54]
mov dl, byte [esp + 0x13]
mov byte [eax], dl
mov eax, dword [esp + 0x54]
cmp dword [esp + 0x68], ebp
jae 0x43c236
lea eax, [esp + 0x54]
push ebx
push ebx
push 3
push ebx
push 1
push SysReAllocStringLen
push eax
call edi
cmp eax, 0xffffffff
je 0x43c24f
push eax
call esi
jmp 0x43c25a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x20
je 0x43c2bd
cmp dword [esp + 0x68], ebp
jb 0x43c26d
mov eax, dword [esp + 0x54]
push eax
call fcn.0046b849
add esp, 4
mov dword [esp + 0x68], 0xf
mov dword [esp + 0x64], ebx
mov byte [esp + 0x54], bl
cmp dword [esp + 0x4c], ebp
jb 0x43c290
mov ecx, dword [esp + 0x38]
push ecx
call fcn.0046b849
add esp, 4
mov al, byte [esp + 0x13]
inc al
cmp al, 0x5a
mov byte [esp + 0x13], al
jle 0x43c110
xor eax, eax
mov ecx, dword [esp + 0x10170]
pop esi
pop edi
pop ebp
pop ebx
xor ecx, esp
call fcn.0046be7b
add esp, 0x10164
ret
lea ecx, [esp + 0x50]
call fcn.0042e890
lea ecx, [esp + 0x34]
call fcn.0042e890
mov eax, 1
jmp 0x43c2a4