Function at 0x100d4570
Capabilities:
Contain obfuscated stackstrings
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10209a8b
mov eax, dword fs:[0]
push eax
sub esp, 0x2b8
mov eax, dword [0x10283a3c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
xor ebx, ebx
lea eax, [ebp - 0x248]
push 0x208
push ebx
push eax
mov dword [ebp - 0x2ac], ebx
call fcn.101be270
add esp, 0xc
lea eax, [ebp - 0x248]
push ebx
push ebx
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea edi, [esi + 0xd0]
cmp word [ebp - 0x248], bx
je 0x100d45ea
lea eax, [ebp - 0x248]
mov ecx, edi
push eax
call fcn.10043990
push 0x208
lea eax, [ebp - 0x248]
push 0
push eax
call fcn.101be270
add esp, 0xc
lea eax, [ebp - 0x248]
push 0
push 0x19
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
cmp word [ebp - 0x248], bx
je 0x100d462a
lea eax, [ebp - 0x248]
mov ecx, edi
push eax
call fcn.10043990
mov eax, dword [esi + 0xd0]
lea edi, [esi + 0xd0]
cmp eax, dword [edi + 4]
je 0x100d4b24
call fcn.100814d0
lea ecx, [esi + 0x68]
neg esi
push 0
push 0
sbb esi, esi
push 0
and esi, ecx
mov ecx, eax
push esi
push 0
call fcn.100373c0
mov eax, dword [edi + 4]
mov esi, dword [edi]
mov dword [ebp - 0x2b4], eax
cmp esi, eax
je 0x100d4b24
call fcn.100f8ff0
push 1
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
mov ecx, eax
call edx
movzx eax, al
sub eax, 1
jne 0x100d4a22
push 0x57
mov dword [ebp - 0x298], eax
lea ecx, [ebp - 0x2a8]
mov dword [ebp - 0x294], eax
push str.d:jenkins.jenkinsworkspacemgamezipperzipper_tpiproducttpiultraultramainwnd.cpp
mov dword [ebp - 0x298], eax
mov dword [ebp - 0x294], 0xf
mov byte [ebp - 0x2a8], al
call fcn.10023160
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x290]
push 3
mov dword [ebp - 0x280], 0
mov dword [ebp - 0x27c], 0
push 0x1021ddf8
mov dword [ebp - 0x280], 0
mov dword [ebp - 0x27c], 0xf
mov byte [ebp - 0x290], 0
call fcn.10023160
mov byte [ebp - 4], 1
lea eax, [ebp - 0x2a8]
push 0x1ea
push eax
lea eax, [ebp - 0x290]
push eax
lea ecx, [ebp - 0xd8]
call fcn.1001fd50
mov edi, eax
mov byte [ebp - 4], 3
xor eax, eax
mov word [ebp - 0x278], ax
lea ecx, [ebp - 0x278]
push 7
lea eax, [ebp - 0x20]
mov dword [ebp - 0x268], 0
mov dword [ebp - 0x264], 0
push eax
mov dword [ebp - 0x20], 0x6c0055
mov dword [ebp - 0x1c], 0x720074
mov dword [ebp - 0x18], 0x3a0061
mov dword [ebp - 0x14], 0x20
mov dword [ebp - 0x268], 0
mov dword [ebp - 0x264], 7
call fcn.10027e50
or ebx, 1
lea ecx, [ebp - 0x278]
mov dword [ebp - 0x2ac], ebx
mov eax, str._null_
cmp dword [ebp - 0x264], 8
cmovae ecx, dword [ebp - 0x278]
test ecx, ecx
cmovne eax, ecx
push eax
push edi
call fcn.1001ed80
add esp, 8
mov byte [ebp - 4], 4
xor eax, eax
mov dword [ebp - 0x250], eax
lea ecx, [ebp - 0x260]
mov dword [ebp - 0x24c], eax
mov word [ebp - 0x24], ax
mov dword [ebp - 0x250], eax
mov word [ebp - 0x260], ax
lea eax, [ebp - 0x40]
push 0xe
push eax
mov dword [ebp - 0x40], 0x6f006d
mov dword [ebp - 0x3c], 0x69006e
mov dword [ebp - 0x38], 0x6f0074
mov dword [ebp - 0x34], 0x200072
mov dword [ebp - 0x30], 0x610070
mov dword [ebp - 0x2c], 0x680074
mov dword [ebp - 0x28], 0x20003a
mov dword [ebp - 0x24c], 7
call fcn.10027e50
or ebx, 2
lea ecx, [ebp - 0x260]
mov dword [ebp - 0x2ac], ebx
mov eax, str._null_
cmp dword [ebp - 0x24c], 8
cmovae ecx, dword [ebp - 0x260]
test ecx, ecx
cmovne eax, ecx
push eax
push edi
call fcn.1001ed80
add esp, 8
mov ecx, esi
cmp dword [esi + 0x14], 8
jb 0x100d4869
mov ecx, dword [esi]
test ecx, ecx
mov eax, str._null_
cmovne eax, ecx
push eax
push edi
call fcn.1001ed80
add esp, 8
call fcn.100f8ff0
push edi
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x1c]
and ebx, 0xfffffffd
mov dword [ebp - 0x2ac], ebx
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x24c]
cmp edx, 8
jb 0x100d48d7
mov ecx, dword [ebp - 0x260]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x100d48cd
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100d4b40
push edx
push ecx
call fcn.1017033c
add esp, 8
xor eax, eax
mov dword [ebp - 0x250], 0
and ebx, 0xfffffffe
mov dword [ebp - 0x24c], 7
mov word [ebp - 0x260], ax
mov dword [ebp - 0x2ac], ebx
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x264]
cmp edx, 8
jb 0x100d4941
mov ecx, dword [ebp - 0x278]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x100d4937
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100d4b40
push edx
push ecx
call fcn.1017033c
add esp, 8
xor eax, eax
mov dword [ebp - 0x268], 0
mov dword [ebp - 0x264], 7
mov word [ebp - 0x278], ax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xd8]
call fcn.100212b0
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x27c]
cmp edx, 0x10
jb 0x100d49ab
mov ecx, dword [ebp - 0x290]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x100d49a1
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100d4b40
push edx
push ecx
call fcn.1017033c
add esp, 8
mov dword [ebp - 0x280], 0
mov dword [ebp - 0x27c], 0xf
mov byte [ebp - 0x290], 0
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x294]
cmp edx, 0x10
jb 0x100d4a07
mov ecx, dword [ebp - 0x2a8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x100d49fd
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100d4b40
push edx
push ecx
call fcn.1017033c
add esp, 8
mov dword [ebp - 0x298], 0
mov dword [ebp - 0x294], 0xf
mov byte [ebp - 0x2a8], 0
mov eax, dword [0x1028df44]
mov dword [ebp - 0x2b0], eax
test eax, eax
jne 0x100d4a9b
push 0x10283368
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [0x1028df44], 0
jne 0x100d4a85
push 0x120
call fcn.1017030c
add esp, 4
mov dword [ebp - 0x2b8], eax
mov dword [ebp - 4], 6
test eax, eax
je 0x100d4a6c
mov ecx, eax
call fcn.100364f0
jmp 0x100d4a6e
xor eax, eax
mov dword [ebp - 4], 0xffffffff
xor edx, edx
lea ecx, [ebp - 0x2bc]
lock or dword [ecx], edx
mov dword [0x1028df44], eax
push 0x10283368
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [0x1028df44]
mov dword [ebp - 0x2b0], eax
cmp dword [esi + 0x14], 8
mov edi, esi
jb 0x100d4aa5
mov edi, dword [esi]
push ecx
mov ebx, esp
mov dword [ebp - 0x2c0], esp
mov dword [ebp - 0x2c4], ebx
call fcn.10029e80
mov ecx, eax
test ecx, ecx
je 0x100d4b45
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebx], eax
mov dword [ebp - 4], 7
test edi, edi
je 0x100d4aed
test edi, 0xffff0000
jne 0x100d4aed
movzx eax, di
mov ecx, ebx
push eax
call fcn.10028430
jmp 0x100d4af5
push edi
mov ecx, ebx
call fcn.100276b0
mov dword [ebp - 4], 8
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x2b0]
call fcn.100378a0
add esi, 0x18
cmp esi, dword [ebp - 0x2b4]
je 0x100d4b24
mov ebx, dword [ebp - 0x2ac]
jmp 0x100d4670
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1017034a
mov esp, ebp
pop ebp
ret
call fcn.101c1b70
push 0x80004005
call fcn.100253e0
int3