Function at 0x10002d60
Capabilities:
Get common file path

Disassembly:
sub esp, 0xd64
mov eax, dword [0x1002f1f8]
xor eax, esp
mov dword [esp + 0xd60], eax
mov eax, dword [esp + 0xd68]
push ebx
push ebp
mov ebp, dword [esp + 0xd7c]
push esi
mov ebx, ecx
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0xd7c]
xor ecx, ecx
or esi, 0xffffffff
push edi
mov edi, edx
mov dword [esp + 0x10], ecx
cmp eax, ecx
je 0x10002da4
mov dword [eax], ebx
push 0x31c
push ecx
lea ecx, [esp + 0x34]
push ecx
call fcn.100170d0
add esp, 0xc
mov dword [esp + 0x30], ebx
mov dword [esp + 0x13c], 0
test ebp, ebp
je 0x10002dfb
test edi, edi
je 0x10002df1
push 0xffffffffffffffff
push edi
lea edx, [esp + 0x3c]
push 0x104
push edx
call fcn.1001727d
mov eax, dword [esp + 0xd8c]
add esp, 0x10
mov dword [esp + 0x138], eax
lea ecx, [esp + 0x2c]
push ecx
call ebp
add esp, 4
push 0x207
lea edx, [esp + 0xb6d]
push 0
push edx
mov byte [esp + 0xb74], 0
call fcn.100170d0
add esp, 0xc
test edi, edi
je 0x10002e46
mov eax, dword [esp + 0xd7c]
push edi
push eax
push ebx
push str.nlexcept_filter_ex:_exception_0x_x_:_line__d_of__s_n
push 0xffffffffffffffff
lea ecx, [esp + 0xb7c]
push 0x208
push ecx
call fcn.1001725c
add esp, 0x1c
jmp 0x10002e63
push ebx
push str.nlexcept_filter_ex:_exception_0x_x_n
push 0xffffffffffffffff
lea edx, [esp + 0xb74]
push 0x208
push edx
call fcn.1001725c
add esp, 0x14
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [esp + 0x18], eax
test eax, eax
je 0x1000310c
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x55a]
push ecx
mov word [esp + 0x55c], ax
call fcn.100170d0
push 0xffffffffffffffff
lea edx, [esp + 0x150]
push edx
lea eax, [esp + 0x564]
push 0x104
push eax
call fcn.1001716b
add esp, 0x1c
cmp dword [esp + 0x13c], 0
jne 0x10002ee8
push 0x104
lea ecx, [esp + 0x554]
push ecx
push 0
call fcn.10002940
add esp, 0xc
test al, al
je 0x10003127
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push str.psapi.dll
call edi
mov ebp, eax
push str.dbghelp.dll
mov dword [esp + 0x14], ebp
call edi
mov ebx, eax
mov dword [esp + 0x14], ebx
test ebp, ebp
je 0x100030e3
test ebx, ebx
je 0x100030e3
push str.GetProcessImageFileNameW
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call ebp
push str.MiniDumpWriteDump
push ebx
mov edi, eax
call ebp
mov ebx, eax
test edi, edi
je 0x100030db
test ebx, ebx
je 0x100030db
xor edx, edx
push 0x206
push edx
lea eax, [esp + 0x762]
push eax
mov word [esp + 0x764], dx
call fcn.100170d0
mov edx, dword [esp + 0x24]
add esp, 0xc
push 0x104
lea ecx, [esp + 0x75c]
push ecx
push edx
call edi
test eax, eax
je 0x100030db
lea eax, [esp + 0x758]
push 0x5c
push eax
call fcn.100164f0
mov edi, eax
add esp, 8
test edi, edi
je 0x100030db
xor ecx, ecx
push 0x206
push ecx
lea edx, [esp + 0x352]
push edx
mov word [esp + 0x354], cx
call fcn.100170d0
push edi
lea eax, [esp + 0x560]
push eax
push str._s_s.dmp
push 0xffffffffffffffff
lea ecx, [esp + 0x364]
push 0x104
push ecx
call fcn.1001714a
mov ebp, dword [sym.imp.KERNEL32.dll_CreateFileW]
add esp, 0x24
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
lea edx, [esp + 0x360]
push edx
call ebp
mov esi, eax
cmp esi, 0xffffffff
jne 0x10003095
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x96a]
push ecx
mov word [esp + 0x96c], ax
call fcn.100170d0
add esp, 0xc
xor edx, edx
lea eax, [esp + 0x960]
push eax
push edx
push edx
push 0x1c
push edx
mov word [esp + 0x35c], dx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jl 0x100030db
push edi
lea ecx, [esp + 0x964]
push ecx
push str._sTemp_s.dmp
push esi
lea edx, [esp + 0x358]
push 0x104
push edx
call fcn.1001714a
add esp, 0x18
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
lea eax, [esp + 0x360]
push eax
call ebp
mov esi, eax
cmp esi, 0xffffffff
je 0x100030db
mov edi, 0x105
call fcn.10002d30
cmp al, 1
jne 0x100030a8
mov edi, 0x107
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, dword [esp + 0x1c]
push 0
push 0
lea edx, [esp + 0x28]
push edx
push edi
push esi
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], ecx
mov dword [esp + 0x3c], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
mov eax, dword [esp + 0x30]
push eax
call ebx
mov ebx, dword [esp + 0x14]
mov ebp, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call edi
cmp esi, 0xffffffff
je 0x100030f8
push esi
call edi
mov esi, dword [sym.imp.KERNEL32.dll_FreeLibrary]
test ebp, ebp
je 0x10003105
push ebp
call esi
test ebx, ebx
je 0x1000310c
push ebx
call esi
mov ecx, dword [esp + 0xd70]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
xor eax, eax
call fcn.10016aa8
add esp, 0xd64
ret
mov ebp, dword [esp + 0x10]
mov ebx, ebp
jmp 0x100030e3