Function at 0x1031b24
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification]
push ebx
push edi
mov dword [ebp - 4], eax
mov edi, ecx
call fcn.01031a6f
xor ebx, ebx
cmp dword [ebp + 8], ebx
mov dword [ebp - reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification], eax
setne al
cmp dword [ebp + 8], 0xffffffff
je 0x1031cfe
cmp dword [ebp - reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification], 0xffffffff
setne cl
cmp al, cl
je 0x1031cfe
cmp al, bl
je 0x1031d12
lea eax, reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification
push eax
push 0x1a
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jl 0x1031cfe
lea eax, reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification
push eax
push dword [ebp - 0x210]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
push 0x1031d30
lea eax, reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification
push eax
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
push dword [ebp - 0x210]
call dword [sym.imp.SHELL32.dll_ILFree]
lea eax, reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification
push eax
call dword [sym.imp.SHELL32.dll_ILCreateFromPathW]
cmp eax, ebx
mov dword [ebp - reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification], eax
je 0x1031cfe
push esi
lea eax, reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification
push eax
push 0x1031d84
push 3
push ebx
mov esi, 0x102a2a0
push esi
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x1031cf1
mov eax, dword [ebp - reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification]
mov ecx, dword [eax]
lea edx, reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification
push edx
push 0x1019a8c
push eax
call dword [ecx]
test eax, eax
jl 0x1031ce5
push dword [ebp - 0x210]
mov eax, dword [ebp - reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification]
mov ecx, dword [eax]
push ebx
push eax
call dword [ecx + 0xc]
test eax, eax
jl 0x1031cd9
mov eax, dword [ebp - reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification]
mov ecx, dword [eax]
push 1
push eax
call dword [ecx + 0x18]
push ebx
lea eax, reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification
push eax
push ebx
push 1
push esi
push dword [ebp - 0x214]
mov esi, dword [sym.imp.SHLWAPI.dll_IUnknown_Exec]
mov word [ebp - 0x230], 3
mov dword [ebp - reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification], 0x1a
call esi
push ebx
lea eax, reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification
push eax
push ebx
push 0x2f
push 0x1031d94
push dword [ebp - 0x214]
mov dword [ebp - reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification], ebx
call esi
mov eax, dword [ebp - reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification]
mov ecx, dword [eax]
lea edx, reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification
push edx
push 0x100cc8c
push eax
call dword [ecx]
test eax, eax
jl 0x1031cd9
mov eax, dword [edi + 0x40]
push dword [ebp - 0x21c]
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
cmp eax, ebx
jl 0x1031ccd
mov ecx, dword [edi + 0x40]
mov edx, dword [ecx]
push 2
movsx eax, ax
push 2
push eax
push ecx
call dword [edx + 0x18]
mov eax, dword [ebp - reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push dword [ebp - 0x210]
call dword [sym.imp.SHELL32.dll_ILFree]
pop esi
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification]
pop edi
pop ebx
call fcn.01001b01
leave
ret 4
mov ecx, edi
call fcn.01031a6f
cmp eax, reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification
je 0x1031cfe
mov ecx, dword [edi + 0x40]
mov edx, dword [ecx]
push eax
push ecx
call dword [edx + 0x1c]
jmp 0x1031d12