Function at 0x100f461a
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc50
mov eax, dword [0x101dc354]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 2
pop esi
push 0xf
pop edx
push 0x10
pop ecx
push 0xe
pop eax
xor edi, edi
mov word [ebp - 0xc44], ax
push 0x208
lea eax, [ebp - 0x20c]
mov dword [ebp - 0xc50], esi
push edi
or ebx, 0xffffffff
mov dword [ebp - 0xc18], edi
or dword [ebp - 0xc28], ebx
push eax
mov dword [ebp - 0xc24], edi
mov word [ebp - 0xc3c], dx
mov word [ebp - 0xc3a], cx
mov dword [ebp - 0xc38], 0x100349b4
mov word [ebp - 0xc42], dx
mov dword [ebp - 0xc40], 0x100349c4
mov word [ebp - 0xc4c], dx
mov word [ebp - 0xc4a], cx
mov dword [ebp - 0xc48], 0x100349d4
mov dword [ebp - 0xc30], edi
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
call dword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetWindowsDirectoryW]
mov edi, eax
cmp edi, 0x104
jbe 0x100f46ee
push 0x100349e4
mov edx, 0x292
mov ecx, 0x10034928
call fcn.100e970f
test edi, edi
jne 0x100f4725
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
test edi, edi
jle 0x100f4709
movzx edi, di
or edi, 0x80070000
test edi, edi
jns 0x100f4725
push 0x100349f4
push 1
push edi
push 0x4000000
call fcn.100ab973
add esp, 0x10
jmp 0x100f49ae
push 0x10034a18
lea eax, [ebp - 0x20c]
push eax
push 0x1002fe74
lea eax, [ebp - 0x414]
push 0x208
push eax
call fcn.100f4e99
mov edi, eax
add esp, 0x14
test edi, edi
jns 0x100f4757
push 0x10034a40
jmp 0x100f4710
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0xc20]
push eax
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
push 0x100347ac
lea eax, [ebp - 0x20c]
push eax
push 0x1002fe74
push 0x208
push eax
call fcn.100f4e99
mov edi, eax
add esp, 0x14
test edi, edi
jns 0x100f479a
push 0x10034a64
jmp 0x100f4710
push 0
push 0
push esi
push 0
push 1
push 0x40000000
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x100f47df
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
test edi, edi
jle 0x100f47d3
movzx edi, di
or edi, 0x80070000
test edi, edi
jns 0x100f47df
push 0x10034a8c
jmp 0x100f4710
lea eax, [ebp - 0xc24]
push eax
lea eax, [ebp - 0xc20]
push eax
push 0
push 0
call dword [sym.imp.ntdll.dll_LdrLoadDll]
test eax, eax
jns 0x100f481f
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov edi, eax
test edi, edi
jle 0x100f4813
movzx edi, di
or edi, 0x80070000
test edi, edi
jns 0x100f481f
push 0x10034ab8
jmp 0x100f4710
lea eax, [ebp - 0xc2c]
push eax
push 0
lea eax, [ebp - 0xc3c]
push eax
push dword [ebp - 0xc24]
call dword [sym.imp.ntdll.dll_LdrGetProcedureAddress]
test eax, eax
jns 0x100f4863
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov edi, eax
test edi, edi
jle 0x100f4857
movzx edi, di
or edi, 0x80070000
test edi, edi
jns 0x100f4863
push 0x10034ad4
jmp 0x100f4710
lea eax, [ebp - 0xc34]
push eax
push 0
lea eax, [ebp - 0xc44]
push eax
push dword [ebp - 0xc24]
call dword [sym.imp.ntdll.dll_LdrGetProcedureAddress]
test eax, eax
jns 0x100f48a7
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov edi, eax
test edi, edi
jle 0x100f489b
movzx edi, di
or edi, 0x80070000
test edi, edi
jns 0x100f48a7
push 0x10034b00
jmp 0x100f4710
lea eax, [ebp - 0xc30]
push eax
push 0
lea eax, [ebp - 0xc4c]
push eax
push dword [ebp - 0xc24]
call dword [sym.imp.ntdll.dll_LdrGetProcedureAddress]
test eax, eax
jns 0x100f48eb
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov edi, eax
test edi, edi
jle 0x100f48df
movzx edi, di
or edi, 0x80070000
test edi, edi
jns 0x100f48eb
push 0x10034b2c
jmp 0x100f4710
lea eax, [ebp - 0xc28]
mov edi, 0x800
push eax
lea eax, [ebp - 0xc18]
push eax
push edi
lea eax, [ebp - 0xc14]
push eax
push esi
mov esi, dword [ebp - 0xc2c]
mov ecx, esi
call dword [0x101e07c0]
call esi
test eax, eax
jns 0x100f495a
mov esi, dword [ebp - 0xc2c]
lea eax, [ebp - 0xc28]
and dword [ebp - 0xc50], 0
mov ecx, esi
push eax
lea eax, [ebp - 0xc18]
push eax
push edi
lea eax, [ebp - 0xc14]
push eax
push 0
call dword [0x101e07c0]
call esi
mov edi, eax
test edi, edi
jns 0x100f495a
push 0x10034b58
jmp 0x100f4710
mov edi, dword [ebp - 0xc50]
push edi
push dword [ebp - 0xc18]
lea edx, [ebp - 0xc14]
mov ecx, ebx
call fcn.100f4cf5
mov esi, dword [ebp - 0xc34]
lea eax, [ebp - 0xc18]
push eax
push 0x800
lea eax, [ebp - 0xc14]
mov ecx, esi
push eax
push edi
push dword [ebp - 0xc28]
call dword [0x101e07c0]
call esi
test eax, eax
jns 0x100f4960
lea edi, [eax + 0x7ff8fefd]
neg edi
sbb edi, edi
and edi, eax
cmp dword [ebp - 0xc28], 0xffffffff
je 0x100f49cd
push dword [ebp - 0xc28]
mov esi, dword [ebp - 0xc30]
mov ecx, esi
call dword [0x101e07c0]
call esi
cmp dword [ebp - 0xc24], 0
je 0x100f49e2
push dword [ebp - 0xc24]
call dword [sym.imp.ntdll.dll_LdrUnloadDll]
cmp ebx, 0xffffffff
je 0x100f49ee
push ebx
call dword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100b88c0
leave
ret