Function at 0x497f4d
Capabilities:
Get common file path

Disassembly:
push 0x14c
mov eax, 0x4d9700
call fcn.004a19ce
mov esi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x14c], ebx
mov dword [ebp - 0xf4], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0xf0], ebx
mov dword [ebp - 0xec], ebx
mov dword [ebp - 0xe8], ebx
mov dword [ebp - 0xf8], ebx
mov edi, dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
lea eax, [ebp - 0xf4]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 1
lea eax, [ebp - 0x20]
mov byte [ebp - 4], 4
push eax
mov dword [ebp - 0x20], ebx
mov word [ebp - 0x1c], 0x100
mov dword [ebp - 0x18], ebx
mov word [ebp - 0x14], 0x500
call edi
test eax, eax
jne 0x497fdc
push 1
lea eax, [ebp - 0xe1]
mov ecx, esi
push eax
push 0x4e23a8
call fcn.00404280
push 0x14
push ebx
jmp 0x49826a
lea eax, [ebp - 0xf0]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea eax, [ebp - 0x18]
push eax
call edi
test eax, eax
je 0x497fbf
lea eax, [ebp - 0xec]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x221
push 0x20
push 2
lea eax, [ebp - 0x18]
push eax
call edi
test eax, eax
je 0x497fbf
push 0x40
lea eax, [ebp - 0x148]
push ebx
push eax
call fcn.004a3000
mov eax, dword [ebp - 0xec]
add esp, 0xc
mov dword [ebp - 0x12c], eax
xor edx, edx
mov eax, dword [ebp - 0xf0]
inc edx
mov dword [ebp - 0x10c], eax
lea eax, [ebp - 0xe8]
push 3
pop ecx
push 2
mov dword [ebp - 0x140], ecx
mov dword [ebp - 0x120], ecx
pop ecx
push eax
push ebx
lea eax, [ebp - 0x148]
mov dword [ebp - 0x148], 0x1200a9
push eax
push ecx
mov dword [ebp - 0x144], edx
mov dword [ebp - 0x13c], ebx
mov dword [ebp - 0x138], ebx
mov dword [ebp - 0x134], ebx
mov dword [ebp - 0x130], 5
mov dword [ebp - 0x128], 0x1f01ff
mov dword [ebp - 0x124], edx
mov dword [ebp - 0x11c], ebx
mov dword [ebp - 0x118], ebx
mov dword [ebp - 0x114], ebx
mov dword [ebp - 0x110], ecx
call dword [sym.imp.ADVAPI32.dll_SetEntriesInAclW]
test eax, eax
jne 0x497fbf
push 0x14
call fcn.004a1050
mov edi, eax
pop ecx
test edi, edi
je 0x4980e5
push 0x14
push ebx
call fcn.004a1725
pop ecx
pop ecx
mov dword [ebp - 0xf8], edi
push 1
test edi, edi
je 0x497fc1
push edi
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
test eax, eax
jne 0x49811a
lea eax, [ebp - 0xe1]
push 1
push eax
push 0x4e23a8
mov ecx, esi
call fcn.00404280
jmp 0x498267
push ebx
push dword [ebp - 0xe8]
push 1
push edi
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
test eax, eax
lea eax, [ebp - 0xe1]
je 0x498106
push ebx
push eax
lea ecx, [ebp - 0x50]
mov dword [ebp - 0x108], 0xc
mov dword [ebp - 0x104], edi
mov dword [ebp - 0x100], ebx
mov dword [ebp - 0x50], 0x4e7908
mov dword [ebp - 0x28], 0x4e793c
call fcn.00404a90
mov ebx, 0x104
mov byte [ebp - 4], 5
push ebx
lea eax, [ebp - 0x158]
push eax
lea ecx, [ebp - 0x50]
call fcn.00409470
mov ecx, dword [eax]
mov byte [ebp - 4], 6
mov byte [eax + 4], 1
call fcn.00403f10
push dword [eax]
push ebx
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea ecx, [ebp - 0x158]
mov byte [ebp - 4], 5
call fcn.00409a90
lea eax, [ebp - 0xe0]
push eax
call fcn.00497e1f
push eax
lea eax, [ebp - 0xb0]
mov byte [ebp - 4], 7
push 0x4dd880
push eax
call fcn.0040c840
push 0x4dd83c
push eax
lea eax, [ebp - 0x80]
mov byte [ebp - 4], 8
push eax
call fcn.0040c970
add esp, 0x1c
push eax
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 9
call fcn.004033f0
lea ecx, [ebp - 0x80]
call fcn.00404c20
lea ecx, [ebp - 0xb0]
call fcn.00404c20
lea ecx, [ebp - 0xe0]
mov byte [ebp - 4], 5
call fcn.00404c20
lea eax, [ebp - 0x108]
push eax
sub esp, 0x30
lea eax, [ebp - 0x50]
mov ecx, esp
mov dword [ebp - 0xfc], ecx
push 0
push eax
mov dword [ecx], 0x4e7908
mov dword [ecx + 0x28], 0x4e793c
call fcn.00406fd0
call fcn.00496315
add esp, 0x34
test eax, eax
jne 0x498256
push 1
lea eax, [ebp - 0xe1]
mov ecx, esi
push eax
push 0x4e23a8
call fcn.00404280
jmp 0x49825f
push esi
lea ecx, [ebp - 0x50]
call fcn.00438f00
lea ecx, [ebp - 0x50]
call fcn.00404c20
push 0x14
push edi
call fcn.004a1725
pop ecx
pop ecx
lea ecx, [ebp - 0xe8]
call fcn.00495d4a
lea ecx, [ebp - 0xec]
call fcn.00495d64
lea ecx, [ebp - 0xf0]
call fcn.00495d64
lea ecx, [ebp - 0xf4]
call fcn.00495d64
mov eax, esi
call fcn.004a1978
ret