Function at 0x1000bca0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1002a03a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xdb4
mov eax, dword [0x10035a8c]
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0xd64], ecx
push str.SDNotifyQueue
lea ecx, [ebp - 0xd5c]
mov dword [ebp - 0x14], eax
call fcn.10002a00
xor eax, eax
mov ecx, 0x41
lea edi, [ebp - 0x118]
rep stosd dword es:[edi], eax
push 0x104
lea eax, [ebp - 0x118]
push eax
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea edi, [ebp - 0x118]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x1000bd11
mov ecx, dword [str.SDNotifyQueue.dat]
mov edx, dword [0x1002c9bc]
mov eax, dword [0x1002c9c0]
mov dword [edi], ecx
mov ecx, dword [0x1002c9c4]
mov dword [edi + 4], edx
mov dx, word [0x1002c9c8]
mov dword [edi + 8], eax
mov al, byte [0x1002c9ca]
mov dword [edi + 0xc], ecx
mov word [edi + 0x10], dx
lea ecx, [ebp - 0xd74]
mov byte [edi + 0x12], al
call fcn.100206d7
lea ecx, [ebp - 0x118]
push ecx
lea ecx, [ebp - 0xd60]
mov byte [ebp - 4], 1
call fcn.10002a00
mov esi, dword [ebp + 8]
mov eax, dword [ebp - 0xd60]
mov edx, esi
neg edx
sbb edx, edx
push 0
and edx, 0x9001
push edx
push eax
lea ecx, [ebp - 0xd74]
mov byte [ebp - 4], 2
call fcn.1002096f
test eax, eax
je 0x1000beb7
mov byte [ebp - 4], 3
call fcn.10020327
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
lea edi, [eax + 0x10]
mov dword [ebp + 8], edi
xor eax, eax
test esi, esi
sete al
push 0
push 0x1000
lea ecx, [ebp - 0xd74]
mov byte [ebp - 4], 4
push eax
push ecx
lea ecx, [ebp - 0xdc0]
call fcn.10025c6e
test esi, esi
mov bl, 5
mov byte [ebp - 4], bl
je 0x1000bf2f
mov edx, dword [ebp - 0xd5c]
mov eax, dword [edx - 0xc]
push 0
push eax
lea eax, [ebp - 0xdc0]
push eax
call fcn.100259be
mov eax, dword [ebp - 0xd5c]
mov ecx, dword [eax - 0xc]
push ecx
push eax
lea ecx, [ebp - 0xdc0]
call fcn.10025a4d
lea ecx, [ebp - 0xd58]
call fcn.10001850
mov ecx, dword [ebp - 0xd64]
mov esi, dword [ecx + 8]
mov byte [ebp - 4], 6
lea ecx, [ecx]
test esi, esi
je 0x1000be5b
mov eax, esi
mov esi, dword [esi]
add eax, 8
push eax
lea ecx, [ebp - 0xd58]
call fcn.100013e0
lea edx, [ebp - 0xdc0]
push edx
lea ecx, [ebp - 0xd58]
call fcn.10001d10
jmp 0x1000be30
lea ecx, [ebp - 0xdc0]
call fcn.100257b6
lea ecx, [ebp - 0xd58]
mov byte [ebp - 4], bl
call fcn.10001aa0
lea ecx, [ebp - 0xdc0]
call fcn.10025a3f
lea ecx, [ebp - 0xd74]
call fcn.10020675
lea ecx, [ebp - 0xdc0]
mov byte [ebp - 4], 4
call fcn.10025c29
lea eax, [edi - 0x10]
mov byte [ebp - 4], 3
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x1000beb7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [ebp - 0xd60]
add eax, 0xfffffff0
mov dword [ebp - 4], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x1000bede
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
lea ecx, [ebp - 0xd74]
mov byte [ebp - 4], 0
call fcn.10020716
mov eax, dword [ebp - 0xd5c]
add eax, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x1000bf14
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x14]
call fcn.1001291b
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0xdc0]
push ecx
call fcn.10005760
mov edx, dword [ebp - 0xd5c]
mov edi, dword [ebp + 8]
push edx
push edi
call fcn.10012f21
add esp, 8
test eax, eax
jne 0x1000be74
lea ebx, [ebx]
mov eax, dword [ebp - 0xd98]
cmp eax, dword [ebp - 0xd94]
je 0x1000be74
lea ecx, [ebp - 0xd58]
call fcn.10001850
lea ecx, [ebp - 0xdc0]
push ecx
lea ecx, [ebp - 0xd58]
mov byte [ebp - 4], 7
call fcn.10001d10
sub esp, 0xc40
lea edx, [ebp - 0xd58]
mov ecx, esp
mov dword [ebp - 0xd78], esp
push edx
call fcn.10001910
mov ecx, dword [ebp - 0xd64]
add ecx, 4
call fcn.10003070
lea ecx, [ebp - 0xd58]
mov byte [ebp - 4], bl
call fcn.10001aa0
jmp 0x1000bf60