Function at 0x498417
Capabilities:
Get common file path

Disassembly:
push 0x14c
mov eax, 0x4d9c10
call fcn.004a1e4e
mov esi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x14c], ebx
mov dword [ebp - 0xf4], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0xf0], ebx
mov dword [ebp - 0xec], ebx
mov dword [ebp - 0xe8], ebx
mov dword [ebp - 0xf8], ebx
mov edi, dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
lea eax, [ebp - 0xf4]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 1
lea eax, [ebp - 0x20]
mov byte [ebp - 4], 4
push eax
mov dword [ebp - 0x20], ebx
mov word [ebp - 0x1c], 0x100
mov dword [ebp - 0x18], ebx
mov word [ebp - 0x14], 0x500
call edi
test eax, eax
jne 0x4984a6
push 1
lea eax, [ebp - 0xe1]
mov ecx, esi
push eax
push 0x4e23a8
call fcn.00404280
push 0x14
push ebx
jmp 0x498734
lea eax, [ebp - 0xf0]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea eax, [ebp - 0x18]
push eax
call edi
test eax, eax
je 0x498489
lea eax, [ebp - 0xec]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x221
push 0x20
push 2
lea eax, [ebp - 0x18]
push eax
call edi
test eax, eax
je 0x498489
push 0x40
lea eax, [ebp - 0x148]
push ebx
push eax
call fcn.004a34a0
mov eax, dword [ebp - 0xec]
add esp, 0xc
mov dword [ebp - 0x12c], eax
xor edx, edx
mov eax, dword [ebp - 0xf0]
inc edx
mov dword [ebp - 0x10c], eax
lea eax, [ebp - 0xe8]
push 3
pop ecx
push 2
mov dword [ebp - 0x140], ecx
mov dword [ebp - 0x120], ecx
pop ecx
push eax
push ebx
lea eax, [ebp - 0x148]
mov dword [ebp - 0x148], 0x1200a9
push eax
push ecx
mov dword [ebp - 0x144], edx
mov dword [ebp - 0x13c], ebx
mov dword [ebp - 0x138], ebx
mov dword [ebp - 0x134], ebx
mov dword [ebp - 0x130], 5
mov dword [ebp - 0x128], 0x1f01ff
mov dword [ebp - 0x124], edx
mov dword [ebp - 0x11c], ebx
mov dword [ebp - 0x118], ebx
mov dword [ebp - 0x114], ebx
mov dword [ebp - 0x110], ecx
call dword [sym.imp.ADVAPI32.dll_SetEntriesInAclW]
test eax, eax
jne 0x498489
push 0x14
call fcn.004a14d0
mov edi, eax
pop ecx
test edi, edi
je 0x4985af
push 0x14
push ebx
call fcn.004a1ba5
pop ecx
pop ecx
mov dword [ebp - 0xf8], edi
push 1
test edi, edi
je 0x49848b
push edi
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
test eax, eax
jne 0x4985e4
lea eax, [ebp - 0xe1]
push 1
push eax
push 0x4e23a8
mov ecx, esi
call fcn.00404280
jmp 0x498731
push ebx
push dword [ebp - 0xe8]
push 1
push edi
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
test eax, eax
lea eax, [ebp - 0xe1]
je 0x4985d0
push ebx
push eax
lea ecx, [ebp - 0x50]
mov dword [ebp - 0x108], 0xc
mov dword [ebp - 0x104], edi
mov dword [ebp - 0x100], ebx
mov dword [ebp - 0x50], 0x4e81b4
mov dword [ebp - 0x28], 0x4e8f38
call fcn.00404a90
mov ebx, 0x104
mov byte [ebp - 4], 5
push ebx
lea eax, [ebp - 0x158]
push eax
lea ecx, [ebp - 0x50]
call fcn.00409470
mov ecx, dword [eax]
mov byte [ebp - 4], 6
mov byte [eax + 4], 1
call fcn.00403f10
push dword [eax]
push ebx
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea ecx, [ebp - 0x158]
mov byte [ebp - 4], 5
call fcn.00409a90
lea eax, [ebp - 0xe0]
push eax
call fcn.004982e9
push eax
lea eax, [ebp - 0xb0]
mov byte [ebp - 4], 7
push 0x4dd880
push eax
call fcn.0040c840
push 0x4dd83c
push eax
lea eax, [ebp - 0x80]
mov byte [ebp - 4], 8
push eax
call fcn.0040c970
add esp, 0x1c
push eax
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 9
call fcn.004033f0
lea ecx, [ebp - 0x80]
call fcn.00404c20
lea ecx, [ebp - 0xb0]
call fcn.00404c20
lea ecx, [ebp - 0xe0]
mov byte [ebp - 4], 5
call fcn.00404c20
lea eax, [ebp - 0x108]
push eax
sub esp, 0x30
lea eax, [ebp - 0x50]
mov ecx, esp
mov dword [ebp - 0xfc], ecx
push 0
push eax
mov dword [ecx], 0x4e81b4
mov dword [ecx + 0x28], 0x4e8f38
call fcn.00406fd0
call fcn.004967df
add esp, 0x34
test eax, eax
jne 0x498720
push 1
lea eax, [ebp - 0xe1]
mov ecx, esi
push eax
push 0x4e23a8
call fcn.00404280
jmp 0x498729
push esi
lea ecx, [ebp - 0x50]
call fcn.00439040
lea ecx, [ebp - 0x50]
call fcn.00404c20
push 0x14
push edi
call fcn.004a1ba5
pop ecx
pop ecx
lea ecx, [ebp - 0xe8]
call fcn.00496214
lea ecx, [ebp - 0xec]
call fcn.0049622e
lea ecx, [ebp - 0xf0]
call fcn.0049622e
lea ecx, [ebp - 0xf4]
call fcn.0049622e
mov eax, esi
call fcn.004a1df8
ret