Function at 0x100b4af7
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x143c
call fcn.10091bf0
mov eax, dword [0x100f93e0]
xor eax, ebp
mov dword [ebp - 0xfb8], eax
push esi
and dword [ebp - 0xfa8], 0
push 0xf9c
push 0
lea eax, [ebp - 0xfa4]
push eax
call fcn.100771d0
add esp, 0xc
and dword [ebp - 0x143c], 0
and dword [ebp - 0xfb0], 0
and word [ebp - 0x11c8], 0
push 0x208
push 0
lea eax, [ebp - 0x11c6]
push eax
call fcn.100771d0
add esp, 0xc
and dword [ebp - 4], 0
and dword [ebp - 0x1228], 0
and word [ebp - 0x1218], 0
push 0x40
push 0
lea eax, [ebp - 0x1216]
push eax
call fcn.100771d0
add esp, 0xc
and dword [ebp - 0xfac], 0
and dword [ebp - 0x121c], 0
and dword [ebp - 0xfb4], 0
and dword [ebp - 0x11cc], 0
and dword [ebp - 0x1224], 0
and dword [ebp - 0x1220], 0
and word [ebp - 0x1438], 0
push 0x208
push 0
lea eax, [ebp - 0x1436]
push eax
call fcn.100771d0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x1438]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x100dde34
lea eax, [ebp - 0x1438]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x1438]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0xfb4], eax
cmp dword [ebp - 0xfb4], 0
jne 0x100b4c13
jmp 0x100b4e14
push 0x100ddea0
push dword [ebp - 0xfb4]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x11cc], eax
cmp dword [ebp - 0x11cc], 0
jne 0x100b4c3d
jmp 0x100b4e14
push 0x100ddeb0
push dword [ebp - 0xfb4]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x1224], eax
cmp dword [ebp - 0x1224], 0
jne 0x100b4c67
jmp 0x100b4e14
push 0x100ddec4
push dword [ebp - 0xfb4]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x1220], eax
cmp dword [ebp - 0x1220], 0
jne 0x100b4c91
jmp 0x100b4e14
cmp dword [ebp + 8], 0
je 0x100b4ca1
mov eax, dword [ebp + 8]
movzx eax, word [eax]
test eax, eax
jne 0x100b4cab
jmp 0x100b4e14
lea eax, [ebp - 0x143c]
push eax
push 0xfa0
lea eax, [ebp - 0xfa8]
push eax
call dword [ebp - 0x11cc]
test eax, eax
je 0x100b4cd1
cmp dword [ebp - 0x143c], 0
jne 0x100b4cdb
jmp 0x100b4e14
mov eax, dword [ebp - 0x143c]
shr eax, 2
mov dword [ebp - 0xfb0], eax
and dword [ebp - 0xfac], 0
jmp 0x100b4d00
mov eax, dword [ebp - 0xfac]
inc eax
mov dword [ebp - 0xfac], eax
mov eax, dword [ebp - 0xfac]
cmp eax, dword [ebp - 0xfb0]
jae 0x100b4e0d
mov eax, dword [ebp - 0xfac]
push dword [ebp + eax*4 - 0xfa8]
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x100b4e08
and dword [ebp - 0x1228], 0
push 0x20a
push 0
lea eax, [ebp - 0x11c8]
push eax
call fcn.100771d0
add esp, 0xc
lea eax, [ebp - 0x143c]
push eax
push 4
lea eax, [ebp - 0x1228]
push eax
push dword [ebp - 4]
call dword [ebp - 0x1224]
test eax, eax
je 0x100b4dfb
push 0x104
lea eax, [ebp - 0x11c8]
push eax
push dword [ebp - 0x1228]
push dword [ebp - 4]
call dword [ebp - 0x1220]
test eax, eax
je 0x100b4dfb
lea eax, [ebp - 0x11c8]
push eax
call dword [sym.imp.USER32.dll_CharUpperW]
lea eax, [ebp - 0x11c8]
push eax
call fcn.10077b0b
pop ecx
shl eax, 1
push eax
lea esi, [ebp - 0x1218]
lea ecx, [ebp - 0x11c8]
call fcn.1004d83f
pop ecx
movzx eax, al
test eax, eax
je 0x100b4dfb
push dword [ebp + 8]
lea eax, [ebp - 0x1218]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x100b4dfb
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [ebp - 4], 0
mov dword [ebp - 0x121c], 1
jmp 0x100b4e14
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [ebp - 4], 0
jmp 0x100b4cf3
and dword [ebp - 0x121c], 0
cmp dword [ebp - 0xfb4], 0
je 0x100b4e30
push dword [ebp - 0xfb4]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
and dword [ebp - 0xfb4], 0
mov eax, dword [ebp - 0x121c]
pop esi
mov ecx, dword [ebp - 0xfb8]
xor ecx, ebp
call fcn.100771ba
leave
ret