Function at 0x1000d4ba
Capabilities:
Get common file path

Disassembly:
test edi, edi
js 0x1000d48d
mov eax, dword [ebp - 0x434]
test eax, eax
je 0x1000d48d
mov dword [eax], 1
cmp dword [ebp - 0x418], 0
mov dword [ebp - 0x41c], edx
je 0x1000d594
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10001a60
mov esp, ebp
pop ebp
ret 0x2c
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x44c
mov eax, dword [0x10041914]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x28]
mov ecx, dword [ebp + 0x20]
mov dword [ebp - 0x420], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x448], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x430], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x424], eax
mov eax, dword [ebp + 0x1c]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x428], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x440], edx
xor edx, edx
mov dword [ebp - 0x43c], esi
mov dword [ebp - 0x438], ecx
mov dword [ebp - 0x434], eax
mov dword [ebp - 0x42c], edx
mov dword [ebp - 0x418], edx
mov dword [ebp - 0x41c], edx
mov edi, edx
test eax, eax
je 0x1000d53f
mov dword [eax], edx
test ecx, ecx
je 0x1000e008
test esi, esi
je 0x1000e008
mov ebx, dword [ecx]
test ebx, ebx
je 0x1000d4a0
cmp dword [ebx + 4], 0
je 0x1000d574
push dword [ebx + 4]
push esi
call sub.msvcrt.dll__wcsicmp
pop ecx
pop ecx
test eax, eax
je 0x1000dfdf
xor edx, edx
cmp dword [ebx + 8], 0
jne 0x1000d59f
mov eax, dword [ebp - 0x418]
test eax, eax
jne 0x1000dfa7
cmp dword [ebp - 0x41c], eax
jne 0x1000dfa7
mov ebx, dword [ebx + 0x2c]
mov esi, dword [ebp - 0x43c]
jmp 0x1000d551
push dword [ebx + 8]
push esi
call sub.msvcrt.dll__wcsicmp
pop ecx
xor edx, edx
pop ecx
test eax, eax
jne 0x1000d57a
jmp 0x100205a4
push eax
call sub.msvcrt.dll__wcsicmp
pop ecx
pop ecx
test eax, eax
jne 0x100204c1
xor edx, edx
inc eax
mov edi, edx
mov dword [ebp - 0x418], eax
mov eax, dword [ebp - 0x438]
cmp dword [eax + 0x28], edx
jne 0x1002064e
mov ecx, dword [ebp - 0x448]
mov eax, dword [ebx + 0x18]
and eax, 0xf
mov dword [ecx], eax
mov ecx, dword [ebp - 0x430]
test ecx, ecx
je 0x1000dfd3
mov eax, dword [ebx + 0x1c]
mov dword [ecx], eax
mov ecx, dword [ebx + 0xc]
test ecx, ecx
je 0x1000dff1
jmp 0x10020664
test dword [ebx + 0x18], 0xf
jne 0x100204a9
jmp 0x1002049e
mov eax, dword [ebp - 0x424]
mov dword [eax], edx
jmp 0x1000e012
mov eax, dword [ebp - 0x428]
mov dword [eax], edx
jmp 0x1000d479
mov edi, 0x80070057
jmp 0x1000d4a0
test edi, edi
js 0x1000d48d
mov ecx, dword [ebx + 0x10]
test ecx, ecx
je 0x1000dffb
jmp 0x100206d4
inc eax
mov dword [ebp - 0x41c], eax
xor eax, eax
mov edi, eax
mov eax, dword [ebp - 0x420]
xor ecx, ecx
push dword [ebx]
cmp cx, word [eax]
jne 0x1000df8c
jmp 0x100205b4
mov esi, 0x104
lea eax, [ebp - 0x20c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x10020647
lea eax, [ebp - 0x20c]
mov edx, esi
push eax
lea ecx, [ebp - 0x414]
call fcn.1000d402
push 0x10020750
lea ecx, [ebp - 0x20c]
call fcn.1000f7be
push 0x10020770
lea ecx, [ebp - 0x414]
call fcn.1000f7be
push esi
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x420]
call sub.msvcrt.dll__wcsnicmp
neg eax
push 0x104
sbb esi, esi
lea eax, [ebp - 0x414]
push eax
push dword [ebp - 0x420]
call sub.msvcrt.dll__wcsnicmp
neg eax
push 0x104
sbb eax, eax
inc eax
mov dword [ebp - 0x44c], eax
lea eax, [ebp - 0x20c]
push eax
push dword [ebx]
call sub.msvcrt.dll__wcsnicmp
neg eax
push 0x104
sbb eax, eax
inc eax
mov dword [ebp - 0x444], eax
lea eax, [ebp - 0x414]
push eax
push dword [ebx]
call sub.msvcrt.dll__wcsnicmp
add esp, 0x30
neg eax
sbb eax, eax
inc eax
inc esi
jne 0x10020591
cmp dword [ebp - 0x44c], esi
je 0x10020647
cmp dword [ebp - 0x444], 0
jne 0x100205a2
test eax, eax
je 0x10020647
xor edx, edx
xor eax, eax
mov edi, edx
inc eax
mov dword [ebp - 0x418], eax
jmp 0x1000d580
mov edx, 0x104
lea ecx, [ebp - 0x20c]
call fcn.1000d402
mov edi, eax
test edi, edi
js 0x10020647
mov ecx, dword [ebx]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x42c]
jne 0x100205cf
sub ecx, edx
sar ecx, 1
push 0x5c
pop eax
cmp ax, word [ebp + ecx*2 - 0x20e]
je 0x10020601
push 0x100051e0
lea ecx, [ebp - 0x20c]
call fcn.1000f7be
mov edi, eax
test edi, edi
js 0x10020647
push esi
lea ecx, [ebp - 0x20c]
call fcn.1000f7be
mov edi, eax
test edi, edi
js 0x10020647
mov ecx, dword [ebp - 0x440]
lea eax, [ebp - 0x20c]
push eax
mov edx, 0x104
call fcn.1000d402
mov edi, eax
test edi, edi
js 0x10020647
xor eax, eax
xor edi, edi
inc eax
inc edi
mov dword [ebp - 0x418], eax
xor edx, edx
jmp 0x1000d580
xor edx, edx
jmp 0x1000d57a
mov ecx, ebx
call fcn.1003edaf
xor edx, edx
test eax, eax
je 0x1000dfb6
jmp 0x1000d48d
push 2
lea edx, [ecx + 2]
xor esi, esi
pop edi
mov ax, word [ecx]
add ecx, edi
cmp ax, si
jne 0x1002066c
sub ecx, edx
sar ecx, 1
push 2
pop edx
lea edi, [ecx + 1]
xor ecx, ecx
mov eax, edi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x100206c8
push dword [ebx + 0xc]
mov edx, edi
mov ecx, esi
call fcn.1000d402
mov edi, eax
xor edx, edx
test edi, edi
js 0x1000d48d
mov eax, dword [ebp - 0x424]
mov dword [eax], esi
jmp 0x1000e012
mov edi, 0x8007000e
xor edx, edx
jmp 0x1000e012
push 2
lea edx, [ecx + 2]
xor esi, esi
pop edi
mov ax, word [ecx]
add ecx, edi
cmp ax, si
jne 0x100206dc
sub ecx, edx
sar ecx, 1
push 2
pop edx
lea edi, [ecx + 1]
xor ecx, ecx
mov eax, edi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x10020738
push dword [ebx + 0x10]
mov edx, edi
mov ecx, esi
call fcn.1000d402
mov edi, eax
xor edx, edx
test edi, edi
js 0x1000d48d
mov eax, dword [ebp - 0x428]
mov dword [eax], esi
jmp 0x1000d479
mov edi, 0x8007000e
xor edx, edx
jmp 0x1000d479