Function at 0x1001eca8
Capabilities:
Get common file path
Get file system object information

Disassembly:
mov eax, 0x1005b68a
call fcn.1005a5c0
sub esp, 0xb4
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x38], ecx
push edi
mov esi, edx
mov dword [ebp - 0x1c], ebx
call fcn.1001ad18
push ecx
push eax
lea ecx, [ebp - 0x2c]
call fcn.1001f327
mov dword [ebp - 4], ebx
mov edi, dword [sym.imp.USER32.dll_GetDC]
mov dword [ebp - 0x18], 0xa8eac8b
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], bl
je 0x1001ecfc
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call edi
push eax
call dword [sym.imp.GDI32.dll_UpdateColors]
mov dword [ebp - 0x18], ebx
jmp 0x1001ed1b
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x1001ed18
push ebx
push ebx
push 0x18d7
push ebx
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xffffffe5
jl 0x1001ed01
mov edx, dword [ebp - 0x2c]
add esi, 0xffffd8d5
mov ecx, edx
mov eax, dword [edx + 4]
cmp byte [eax + 0xd], 0
jne 0x1001ed5a
cmp dword [eax + 0x10], esi
jge 0x1001ed3f
mov eax, dword [eax + 8]
jmp 0x1001ed43
mov ecx, eax
mov eax, dword [eax]
cmp byte [eax + 0xd], 0
je 0x1001ed35
cmp ecx, edx
je 0x1001ed5a
cmp esi, dword [ecx + 0x10]
jl 0x1001ed5a
mov dword [ebp - 0x30], ecx
lea esi, [ebp - 0x30]
jmp 0x1001ed60
mov dword [ebp - 0x34], edx
lea esi, [ebp - 0x34]
mov esi, dword [esi]
lea ecx, [ebp - 0x5c]
push 2
pop ebx
push ebx
call fcn.1000f33d
xor edx, edx
mov dword [ebp - 0x18], 0x4d8e5ccc
mov dword [ebp - 0x18], edx
jmp 0x1001ed8c
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x5c]
mov dword [eax + ecx*4], 0xdcec
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x1001ed7c
mov dword [ebp - 0x18], 1
cmp dword [ebp - 0x18], edx
jl 0x1001edc4
mov byte [ebp - 0xd], dl
cmp byte [ebp - 0xd], 0
je 0x1001edbf
push 0x1dd5
push 0x1350
push edx
push 0x587
push edx
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
xor edx, edx
dec dword [ebp - 0x18]
jns 0x1001ed9d
lea ecx, [ebp - 0x5c]
call fcn.1000f3c0
mov eax, dword [0x106ee4e4]
test al, 1
jne 0x1001ee01
and dword [0x106ee500], 0
or eax, 1
mov dword [0x106ee4e4], eax
xor eax, eax
push 0x1005c496
mov dword [0x106ee504], 7
mov word [0x106ee4f0], ax
call fcn.10043d39
pop ecx
mov dword [ebp - 0x18], 1
mov dword [ebp - 0x18], 0x1d691704
push 4
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x14], 0
pop ecx
jmp 0x1001ee2f
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xac], 8
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x1001ee1e
mov dword [ebp - 0x14], 0
jmp 0x1001ee4b
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x6c], 0x16ffa942
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x1001ee3d
mov dword [ebp - 0x14], 0
jmp 0x1001ee6a
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xbc], 0xa87187d7
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x1001ee59
mov dword [ebp - 0x18], 0
jmp 0x1001efe1
mov dword [ebp - 0x14], 0
jmp 0x1001ee92
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x24], 0xffffffff
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1001ee84
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
neg eax
je 0x1001eea4
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
xor ecx, ecx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
cmp eax, 1
setle cl
xor edx, edx
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setge dl
xor ebx, ebx
cmp edx, dword [ebp - 0x14]
setge bl
xor ecx, ecx
cmp ebx, eax
mov eax, 0xf394a2a4
setle cl
cmp eax, ecx
sbb eax, eax
neg eax
cmp eax, 0x3cfcb8f
jg 0x1001efa8
push 3
pop ebx
push ebx
lea ecx, [ebp - 0x44]
call fcn.1000f33d
push ebx
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 1
call fcn.1000f33d
mov dword [ebp - 0x14], 0
jmp 0x1001ef1f
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x44]
mov dword [eax + ecx*4], 0x26ed4bca
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1001ef0f
mov dword [ebp - 0x14], 0
jmp 0x1001ef3d
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x50]
mov dword [eax + ecx*4], 0xd7c1543f
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1001ef2d
mov eax, dword [ebp - 0x44]
mov dword [eax + 8], 1
mov dword [ebp - 0x14], 0xf1ba1372
mov dword [ebp - 0x14], 0xf6a1241a
inc dword [ebp - 0x68]
dec dword [eax + 8]
jns 0x1001ef4c
push 2
pop ebx
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], 0
jl 0x1001ef92
mov byte [ebp - 0xd], 0
cmp byte [ebp - 0xd], 0
je 0x1001ef8d
push 0x7bb
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call edi
push eax
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
dec dword [ebp - 0x14]
jns 0x1001ef6e
lea ecx, [ebp - 0x50]
call fcn.1000f3c0
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 0
call fcn.1000f3c0
jmp 0x1001efc2
mov byte [ebp - 0xd], 0
cmp byte [ebp - 0xd], 0
je 0x1001efbf
push 0xd5d
push 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push 2
pop ebx
mov byte [ebp - 0xd], 0
cmp byte [ebp - 0xd], 0
je 0x1001efde
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call edi
push eax
call dword [sym.imp.GDI32.dll_GetClipBox]
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xffffffed
jge 0x1001ee7b
cmp esi, dword [ebp - 0x2c]
je 0x1001f00a
push dword [esi + 0x18]
mov edx, dword [esi + 0x14]
lea ecx, [ebp - 0x84]
call fcn.10015b98
pop ecx
mov byte [ebp - 4], bl
xor ebx, ebx
inc ebx
jmp 0x1001f021
push 0x106ee4f0
lea ecx, [ebp - 0x9c]
call fcn.1000f170
mov dword [ebp - 4], 3
mov esi, dword [ebp - 0x38]
mov ecx, esi
push eax
mov dword [ebp - 0x1c], ebx
call fcn.1000f170
or ebx, 4
test bl, 2
je 0x1001f049
push 0
push 1
lea ecx, [ebp - 0x9c]
and ebx, 0xfffffffd
call fcn.1000fe44
test bl, 1
je 0x1001f05d
push 0
push 1
lea ecx, [ebp - 0x84]
call fcn.1000fe44
lea ecx, [ebp - 0x2c]
call fcn.1001f20b
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret