Function at 0x100b49c1
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x143c
call fcn.10090ca0
mov eax, dword [0x100f83e0]
xor eax, ebp
mov dword [ebp - 0xfb8], eax
push esi
and dword [ebp - 0xfa8], 0
push 0xf9c
push 0
lea eax, [ebp - 0xfa4]
push eax
call fcn.100770c0
add esp, 0xc
and dword [ebp - 0x143c], 0
and dword [ebp - 0xfb0], 0
and word [ebp - 0x11c8], 0
push 0x208
push 0
lea eax, [ebp - 0x11c6]
push eax
call fcn.100770c0
add esp, 0xc
and dword [ebp - 4], 0
and dword [ebp - 0x1228], 0
and word [ebp - 0x1218], 0
push 0x40
push 0
lea eax, [ebp - 0x1216]
push eax
call fcn.100770c0
add esp, 0xc
and dword [ebp - 0xfac], 0
and dword [ebp - 0x121c], 0
and dword [ebp - 0xfb4], 0
and dword [ebp - 0x11cc], 0
and dword [ebp - 0x1224], 0
and dword [ebp - 0x1220], 0
and word [ebp - 0x1438], 0
push 0x208
push 0
lea eax, [ebp - 0x1436]
push eax
call fcn.100770c0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x1438]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x100dce34
lea eax, [ebp - 0x1438]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x1438]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0xfb4], eax
cmp dword [ebp - 0xfb4], 0
jne 0x100b4add
jmp 0x100b4cde
push 0x100dcea0
push dword [ebp - 0xfb4]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x11cc], eax
cmp dword [ebp - 0x11cc], 0
jne 0x100b4b07
jmp 0x100b4cde
push 0x100dceb0
push dword [ebp - 0xfb4]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x1224], eax
cmp dword [ebp - 0x1224], 0
jne 0x100b4b31
jmp 0x100b4cde
push 0x100dcec4
push dword [ebp - 0xfb4]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x1220], eax
cmp dword [ebp - 0x1220], 0
jne 0x100b4b5b
jmp 0x100b4cde
cmp dword [ebp + 8], 0
je 0x100b4b6b
mov eax, dword [ebp + 8]
movzx eax, word [eax]
test eax, eax
jne 0x100b4b75
jmp 0x100b4cde
lea eax, [ebp - 0x143c]
push eax
push 0xfa0
lea eax, [ebp - 0xfa8]
push eax
call dword [ebp - 0x11cc]
test eax, eax
je 0x100b4b9b
cmp dword [ebp - 0x143c], 0
jne 0x100b4ba5
jmp 0x100b4cde
mov eax, dword [ebp - 0x143c]
shr eax, 2
mov dword [ebp - 0xfb0], eax
and dword [ebp - 0xfac], 0
jmp 0x100b4bca
mov eax, dword [ebp - 0xfac]
inc eax
mov dword [ebp - 0xfac], eax
mov eax, dword [ebp - 0xfac]
cmp eax, dword [ebp - 0xfb0]
jae 0x100b4cd7
mov eax, dword [ebp - 0xfac]
push dword [ebp + eax*4 - 0xfa8]
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x100b4cd2
and dword [ebp - 0x1228], 0
push 0x20a
push 0
lea eax, [ebp - 0x11c8]
push eax
call fcn.100770c0
add esp, 0xc
lea eax, [ebp - 0x143c]
push eax
push 4
lea eax, [ebp - 0x1228]
push eax
push dword [ebp - 4]
call dword [ebp - 0x1224]
test eax, eax
je 0x100b4cc5
push 0x104
lea eax, [ebp - 0x11c8]
push eax
push dword [ebp - 0x1228]
push dword [ebp - 4]
call dword [ebp - 0x1220]
test eax, eax
je 0x100b4cc5
lea eax, [ebp - 0x11c8]
push eax
call dword [sym.imp.USER32.dll_CharUpperW]
lea eax, [ebp - 0x11c8]
push eax
call fcn.100779fb
pop ecx
shl eax, 1
push eax
lea esi, [ebp - 0x1218]
lea ecx, [ebp - 0x11c8]
call fcn.1004d73c
pop ecx
movzx eax, al
test eax, eax
je 0x100b4cc5
push dword [ebp + 8]
lea eax, [ebp - 0x1218]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x100b4cc5
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [ebp - 4], 0
mov dword [ebp - 0x121c], 1
jmp 0x100b4cde
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [ebp - 4], 0
jmp 0x100b4bbd
and dword [ebp - 0x121c], 0
cmp dword [ebp - 0xfb4], 0
je 0x100b4cfa
push dword [ebp - 0xfb4]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
and dword [ebp - 0xfb4], 0
mov eax, dword [ebp - 0x121c]
pop esi
mov ecx, dword [ebp - 0xfb8]
xor ecx, ebp
call fcn.100770aa
leave
ret