Function at 0xb11cf0
Capabilities:
Get common file path

Disassembly:
sub esp, 0xc
push ebx
push esi
push edi
push ebp
push 0xbb80
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ebp, eax
test ebp, ebp
jne 0xb11d1d
mov ax, 3
pop ebp
pop edi
pop esi
pop ebx
add esp, 0xc
ret
push 0x104
push ebp
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
jne 0xb11d55
push ebp
mov ebx, dword [sym.imp.KERNEL32.dll_GlobalHandle]
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push ebp
call ebx
push eax
mov ebp, dword [sym.imp.KERNEL32.dll_GlobalFree]
call ebp
mov ax, 3
pop ebp
pop edi
pop esi
pop ebx
add esp, 0xc
ret
mov edi, ebp
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, 0xb144a0
sub eax, eax
mov dword [esp + 0x10], ecx
mov ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov ecx, 0xffffffff
mov edi, ebp
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push 0
and ecx, 3
push ebp
rep movsb byte es:[edi], byte [esi]
mov ebx, dword [sym.imp.KERNEL32.dll__lopen]
call ebx
cmp eax, 0xffffffff
mov esi, eax
jne 0xb11e15
mov eax, dword [esp + 0x10]
mov edi, 0xb14490
mov ecx, 0xffffffff
mov byte [eax + ebp], 0
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov ecx, 0xffffffff
mov edi, ebp
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push 0
and ecx, 3
push ebp
rep movsb byte es:[edi], byte [esi]
call ebx
cmp eax, 0xffffffff
mov esi, eax
jne 0xb11e15
push ebp
mov ebx, dword [sym.imp.KERNEL32.dll_GlobalHandle]
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push ebp
call ebx
push eax
mov ebp, dword [sym.imp.KERNEL32.dll_GlobalFree]
call ebp
mov ax, 2
pop ebp
pop edi
pop esi
pop ebx
add esp, 0xc
ret
push 2
mov edi, dword [sym.imp.KERNEL32.dll__llseek]
push 0xfffffffffffffffc
push esi
call edi
lea eax, [esp + 0x10]
push 4
push eax
mov ebx, dword [sym.imp.KERNEL32.dll__lread]
push esi
call ebx
cmp dword [esp + 0x10], 0x55ffaaff
je 0xb11e6a
push esi
call dword [sym.imp.KERNEL32.dll__lclose]
push ebp
mov ebx, dword [sym.imp.KERNEL32.dll_GlobalHandle]
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push ebp
call ebx
push eax
mov ebp, dword [sym.imp.KERNEL32.dll_GlobalFree]
call ebp
xor ax, ax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0xc
ret
push 2
push 0xfffffffffffffff4
push esi
call edi
lea eax, [esp + 0x14]
push 4
push eax
push esi
call ebx
push 2
mov eax, 0xfffffff4
sub eax, dword [esp + 0x18]
push eax
push esi
call edi
mov ecx, dword [esp + 0x14]
push ecx
push ebp
push esi
call ebx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x18]
push ecx
push edx
mov edx, dword [esp + 0x1c]
mov ecx, ebp
call fcn.00b0f600
push ebp
mov ebx, dword [sym.imp.KERNEL32.dll_GlobalHandle]
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push ebp
call ebx
push eax
mov ebp, dword [sym.imp.KERNEL32.dll_GlobalFree]
call ebp
push esi
call dword [sym.imp.KERNEL32.dll__lclose]
mov dword [esp + 0x10], 0
cmp dword [esp + 0x14], 0
jle 0xb11f01
mov edx, 0xc
mov esi, dword [esp + 0x10]
mov ecx, edx
add esi, dword [esp + 0x18]
mov edi, dword [0xb16b24]
repe cmpsb byte [esi], byte es:[edi]
je 0xb11f24
add dword [esp + 0x10], edx
mov eax, dword [esp + 0x10]
cmp dword [esp + 0x14], eax
jg 0xb11edf
mov eax, dword [esp + 0x18]
push eax
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, dword [esp + 0x18]
push eax
call ebx
push eax
call ebp
xor ax, ax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0xc
ret
mov eax, dword [esp + 0x18]
push eax
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, dword [esp + 0x18]
push eax
call ebx
push eax
call ebp
or byte [0xb168fa], 0x10
mov ax, 1
pop ebp
pop edi
pop esi
pop ebx
add esp, 0xc
ret