Function at 0x1002b6a
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x450
mov eax, dword [0x1009004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
and dword [ebp - 0x41c], 0
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push esi
push edi
mov dword [ebp - 0x424], eax
mov eax, dword [ebp + 0xc]
push 0x40
push 8
mov dword [ebp - 0x420], eax
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_HeapAlloc]
push eax
call edi
mov esi, eax
test esi, esi
jne 0x1002bc5
mov dword [ebp - 0x41c], 8
jmp 0x1002df7
lea eax, [ebp - 0x418]
push eax
push 0x104
push dword [ebp - 0x420]
call fcn.01002b04
test eax, eax
jge 0x1002bef
mov dword [ebp - 0x41c], 0x57
jmp 0x1002dc5
inc dword [ebp - 0x418]
mov eax, dword [ebp - 0x418]
add eax, eax
push eax
push 8
call ebx
push eax
call edi
mov dword [esi], eax
test eax, eax
jne 0x1002c1a
mov dword [ebp - 0x41c], 8
jmp 0x1002dc5
push dword [ebp - 0x420]
push dword [ebp - 0x418]
push eax
call fcn.0100170e
push dword [esi]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
push dword [esi]
call dword [sym.imp.USER32.dll_CharLowerBuffW]
cmp dword [ebp - 0x424], 0
je 0x1002c8d
lea eax, [ebp - 0x418]
push eax
push 0x104
push dword [ebp - 0x424]
call fcn.01002b04
test eax, eax
jl 0x1002be0
inc dword [ebp - 0x418]
mov eax, dword [ebp - 0x418]
add eax, eax
push eax
push 8
call ebx
push eax
call edi
mov dword [esi + 4], eax
test eax, eax
je 0x1002c0b
push dword [ebp - 0x424]
jmp 0x1002d17
lea eax, [ebp - 0x20c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
jne 0x1002cb4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x41c], eax
jmp 0x1002dbc
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.USER32.dll_CharLowerBuffW]
lea eax, [ebp - 0x418]
push eax
push 0x104
lea eax, [ebp - 0x20c]
push eax
call fcn.01002b04
test eax, eax
jl 0x1002be0
inc dword [ebp - 0x418]
mov eax, dword [ebp - 0x418]
add eax, eax
push eax
push 8
call ebx
push eax
call edi
mov dword [esi + 4], eax
test eax, eax
je 0x1002c0b
lea ecx, [ebp - 0x20c]
push ecx
push dword [ebp - 0x418]
push eax
call fcn.0100170e
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_CharLowerBuffW]
push dword [esi + 4]
mov edi, 0x104
push edi
lea eax, [ebp - 0x414]
push eax
call fcn.0100170e
test eax, eax
jl 0x1002df9
push 0
push edi
push dword [ebp - 0x420]
lea eax, [ebp - 0x414]
push eax
call sub.SETUPAPI.dll_pSetupConcatenatePaths
test eax, eax
je 0x1002df9
push 9
pop ecx
xor eax, eax
lea edi, [ebp - 0x450]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x450]
push eax
push 0
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test eax, eax
je 0x1002df9
lea eax, [ebp - 0x42c]
push eax
lea eax, [ebp - 0x43c]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
lea eax, [esi + 0x2c]
push eax
lea eax, [ebp - 0x42c]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
cmp dword [ebp - 0x41c], 0
je 0x1002df9
mov eax, dword [esi]
mov edi, dword [sym.imp.KERNEL32.dll_HeapFree]
test eax, eax
je 0x1002ddc
push eax
push 0
call ebx
push eax
call edi
and dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x1002def
push eax
push 0
call ebx
push eax
call edi
and dword [esi + 4], 0
push esi
push 0
call ebx
push eax
call edi
xor esi, esi
push dword [ebp - 0x41c]
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.01007194
leave
ret 8