Function at 0x2a87df5d
Capabilities:
Get common file path

Disassembly:
push 0x58c
mov eax, 0x2a9851d8
call fcn.2a8c96ea
mov dword [ebp - 0x55c], ecx
mov esi, str.MicrosoftOutlook_
lea edi, [ebp - 0x28]
push 0x5c
pop eax
mov word [ebp - 0x554], ax
xor ebx, ebx
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x560]
push eax
push 0x801a
push ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
call sub.SHELL32.dll_SHGetSpecialFolderLocation
test eax, eax
jne 0x2a87e574
lea eax, [ebp - 0x33c]
push eax
push dword [ebp - 0x560]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
lea eax, [ebp - 0x560]
push eax
push 0x801c
push ebx
call sub.SHELL32.dll_SHGetSpecialFolderLocation
test eax, eax
jne 0x2a87e574
lea eax, [ebp - 0x238]
push eax
push dword [ebp - 0x560]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
push 0x200
lea eax, [ebp - 0x53c]
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
push 0x100
lea eax, [ebp - 0x134]
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
push ebx
call fcn.2a886a5c
add esp, 0x1c
cmp eax, 4
jne 0x2a87e574
call fcn.2a886a5c
mov edi, eax
mov dword [ebp - 0x564], edi
test edi, edi
je 0x2a87e574
mov ecx, dword [0x2a9fed58]
mov esi, dword [ecx + 0xca8]
mov ecx, esi
call dword [0x2a9874b0]
call esi
movzx eax, ax
test ax, ax
je 0x2a87e227
call fcn.2a88826d
test ax, ax
jne 0x2a87e227
call fcn.2a888530
test ax, ax
jne 0x2a87e227
mov eax, dword [0x2a9fed58]
mov esi, dword [eax + 0xcac]
mov ecx, esi
call dword [0x2a9874b0]
call esi
mov edi, eax
lea eax, [ebp - 0x53c]
push 0x100
push eax
mov ecx, dword [edi]
mov esi, dword [ecx + 0xac]
mov ecx, esi
call dword [0x2a9874b0]
mov ecx, edi
call esi
test al, al
je 0x2a87e574
mov ecx, 0x100
mov dword [ebp - 0x550], ebx
push ecx
lea eax, [ebp - 0x53c]
push eax
push ecx
lea eax, [ebp - 0x134]
push eax
lea eax, [ebp - 0x550]
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_wcstombs_s]
add esp, 0x14
test eax, eax
jne 0x2a87e574
cmp dword [ebp - 0x550], ebx
jbe 0x2a87e574
lea ebx, [ebp - 0x134]
mov esi, str.RoamCache_
lea edi, [ebp - 0x34]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov edi, dword [ebp - 0x55c]
add edi, 4
call fcn.2a888167
cmp eax, 0xe
jl 0x2a87e4e0
lea eax, [ebp - 0x238]
push 3
push eax
call fcn.2a886a5c
pop ecx
mov esi, eax
pop ecx
mov dword [ebp - 0x550], esi
lea eax, [ebp - 0x550]
mov dword [ebp - 4], 4
cmp eax, edi
je 0x2a87e149
push eax
mov ecx, edi
call fcn.2a886a5c
mov dword [ebp - 4], 5
test esi, esi
je 0x2a87e15b
push esi
call fcn.2a886a5c
pop ecx
mov esi, dword [ebp - 0x55c]
lea eax, [ebp - 0x554]
or dword [ebp - 4], 0xffffffff
push eax
lea edi, [esi + 4]
push dword [edi]
call fcn.2a886a5c
lea eax, [ebp - 0x28]
push eax
push dword [edi]
call fcn.2a886a5c
lea eax, [ebp - 0x34]
push eax
push dword [edi]
call fcn.2a886a5c
add esp, 0x18
mov ecx, esi
push ebx
push edi
call fcn.2a87ddbe
test ax, ax
jne 0x2a87e568
push edi
call fcn.2a886a5c
lea eax, [ebp - 0x238]
push 3
push eax
call fcn.2a886a5c
mov esi, eax
add esp, 0xc
mov dword [ebp - 0x550], esi
lea eax, [ebp - 0x550]
mov dword [ebp - 4], 6
cmp eax, edi
je 0x2a87e1d9
push eax
mov ecx, edi
call fcn.2a886a5c
mov dword [ebp - 4], 7
test esi, esi
je 0x2a87e1eb
push esi
call fcn.2a886a5c
pop ecx
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x554]
push eax
push dword [edi]
call fcn.2a886a5c
lea eax, [ebp - 0x28]
push eax
push dword [edi]
call fcn.2a886a5c
mov ecx, dword [ebp - 0x55c]
add esp, 0x10
push ebx
push edi
call fcn.2a87ddbe
test ax, ax
jne 0x2a87e568
push edi
jmp 0x2a87e562
call fcn.2a888530
test ax, ax
jne 0x2a87e0f4
call fcn.2a88826d
test ax, ax
jne 0x2a87e0f4
push str.MAPIInitialize
push edi
call dword [sym.imp.kernel32.dll_GetProcAddress]
push str.MAPIUninitialize
push dword [ebp - 0x564]
mov edi, eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
mov dword [ebp - 0x550], eax
test edi, edi
je 0x2a87e568
test eax, eax
je 0x2a87e568
mov eax, dword [0x2a9fee0c]
push 0x2a860550
push ebx
mov dword [ebp - 4], ebx
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x2a9874b0]
call esi
pop ecx
pop ecx
xor eax, eax
mov ecx, edi
inc eax
push ebx
mov byte [ebp - 4], al
call dword [0x2a9874b0]
call edi
test eax, eax
js 0x2a87e57a
lea eax, [ebp - 0x568]
mov dword [ebp - 0x56c], ebx
push eax
push ebx
mov dword [ebp - 0x568], ebx
call sub.MAPI32.dll_Ordinal_19
test eax, eax
js 0x2a87e491
mov eax, dword [ebp - 0x568]
test eax, eax
je 0x2a87e491
lea ecx, [ebp - 0x558]
mov dword [ebp - 0x558], ebx
mov esi, dword [eax]
push ecx
push ebx
push eax
mov ecx, dword [esi + 0x10]
call dword [0x2a9874b0]
call dword [esi + 0x10]
test eax, eax
js 0x2a87e466
mov eax, dword [ebp - 0x558]
test eax, eax
je 0x2a87e466
push 4
mov ecx, 0x3d04000b
xor edi, edi
mov dword [ebp - 0x594], ecx
inc edi
pop edx
mov dword [ebp - 0x544], ecx
lea ecx, [ebp - 0x594]
mov dword [ebp - 0x540], ecx
lea ecx, [ebp - 0x54c]
mov dword [ebp - 0x54c], edx
mov dword [ebp - 0x548], edx
mov word [ebp - 0x58c], di
mov esi, dword [eax]
push 2
push ecx
push eax
mov ecx, dword [esi + 0x38]
call dword [0x2a9874b0]
call dword [esi + 0x38]
test eax, eax
jns 0x2a87e38d
mov eax, dword [0x2a9fee0c]
push 0xffffffffffffffff
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x2a9874b0]
call esi
pop ecx
mov dword [ebp - 0x574], ebx
lea eax, [ebp - 0x574]
push 0x2a9eefa8
jmp 0x2a87e5a0
mov eax, dword [ebp - 0x558]
lea ecx, [ebp - 0x54c]
push ebx
push ebx
push ecx
mov esi, dword [eax]
push eax
mov ecx, dword [esi + 0x34]
call dword [0x2a9874b0]
call dword [esi + 0x34]
test eax, eax
jns 0x2a87e3da
mov eax, dword [0x2a9fee0c]
push 0xffffffffffffffff
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x2a9874b0]
call esi
pop ecx
mov dword [ebp - 0x578], ebx
lea eax, [ebp - 0x578]
push 0x2a9eefa8
jmp 0x2a87e5a0
mov eax, dword [ebp - 0x558]
lea ecx, [ebp - 0x56c]
push ecx
push ebx
push edi
mov esi, dword [eax]
push eax
mov ecx, dword [esi + 0x4c]
call dword [0x2a9874b0]
call dword [esi + 0x4c]
test eax, eax
js 0x2a87e43b
mov eax, dword [ebp - 0x56c]
cmp dword [eax], ebx
jbe 0x2a87e43b
mov eax, dword [eax + 0xc]
mov esi, dword [ebp - 0x550]
mov ecx, esi
mov ebx, dword [eax + 8]
call dword [0x2a9874b0]
call esi
mov eax, dword [0x2a9fee0c]
mov byte [ebp - 4], 2
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x2a9874b0]
call esi
or dword [ebp - 4], 0xffffffff
jmp 0x2a87e0f4
mov eax, dword [0x2a9fee0c]
push 0xffffffffffffffff
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x2a9874b0]
call esi
pop ecx
mov dword [ebp - 0x57c], ebx
lea eax, [ebp - 0x57c]
push 0x2a9eefa8
jmp 0x2a87e5a0
mov eax, dword [0x2a9fee0c]
push 0xffffffffffffffff
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x2a9874b0]
call esi
pop ecx
mov dword [ebp - 0x580], ebx
lea eax, [ebp - 0x580]
push 0x2a9eefa8
jmp 0x2a87e5a0
mov eax, dword [0x2a9fee0c]
push 0xffffffffffffffff
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x2a9874b0]
call esi
pop ecx
mov dword [ebp - 0x584], ebx
lea eax, [ebp - 0x584]
push 0x2a9eefa8
jmp 0x2a87e5a0
push edi
call fcn.2a886a5c
lea eax, [ebp - 0x33c]
push 3
push eax
call fcn.2a886a5c
mov esi, eax
add esp, 0xc
mov dword [ebp - 0x550], esi
lea eax, [ebp - 0x550]
mov dword [ebp - 4], 8
cmp eax, edi
je 0x2a87e518
push eax
mov ecx, edi
call fcn.2a886a5c
mov dword [ebp - 4], 9
test esi, esi
je 0x2a87e52a
push esi
call fcn.2a886a5c
pop ecx
mov edi, dword [ebp - 0x55c]
lea eax, [ebp - 0x554]
or dword [ebp - 4], 0xffffffff
push eax
lea esi, [edi + 4]
push dword [esi]
call fcn.2a886a5c
lea eax, [ebp - 0x28]
push eax
push dword [esi]
call fcn.2a886a5c
add esp, 0x10
mov ecx, edi
push ebx
push esi
call fcn.2a87ddbe
test ax, ax
jne 0x2a87e568
push esi
call fcn.2a886a5c
pop ecx
push dword [ebp - 0x564]
call fcn.2a84c830
pop ecx
call fcn.2a8c96a2
ret
mov eax, dword [0x2a9fee0c]
push 0xffffffffffffffff
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x2a9874b0]
call esi
pop ecx
mov dword [ebp - 0x570], ebx
lea eax, [ebp - 0x570]
push 0x2a9eefa8
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
int3