Function at 0x10017c10
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x624]
sub esp, 0x624
push 0xffffffffffffffff
push 0x100375a0
mov eax, dword fs:[0]
push eax
sub esp, 0x54
mov eax, dword [0x1004f100]
xor eax, ebp
mov dword [ebp + 0x620], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, 0x1770
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], eax
mov eax, 0xea60
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], eax
or eax, 0xffffffff
mov edi, ecx
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x14], ebx
jmp 0x10017c8f
mov edi, dword [ebp - 0x20]
mov ebx, dword [ebp - 0x14]
cmp dword [edi + 0x224], 0
je 0x10017ff1
cmp ebx, 9
jb 0x10017cad
mov dword [ebp - 0x14], 9
mov ebx, dword [ebp - 0x14]
jmp 0x10017cb1
test ebx, ebx
jbe 0x10017ccb
call fcn.1001af90
mov ecx, dword [ebp + ebx*4 - 0x5c]
push ecx
push ebx
push str.CThreadSandboxProcProtect_main_SpecTimeOut:_d_Count:_d
mov ecx, eax
call fcn.1001b3f0
add esp, 0xc
mov edx, dword [ebp + ebx*4 - 0x5c]
mov eax, dword [edi + 4]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x10017ff1
cmp dword [edi + 0x220], 0
je 0x10017c8f
push 0x20c
lea ecx, [ebp + 4]
push 0
push ecx
call fcn.100285e0
mov esi, dword [edi + 0x220]
add esp, 0xc
mov dword [ebp - 0x28], esi
mov dword [ebp], 0
call fcn.1001f360
mov eax, dword [eax + 0x148]
test eax, eax
jne 0x10017d29
mov dword [ebp - 0x18], 0xffffffff
jmp 0x10017c8f
lea edx, [ebp]
push edx
push esi
call eax
mov dword [ebp - 0x18], eax
test eax, eax
jne 0x10017c8f
mov eax, dword [ebp]
cmp eax, dword [edi + 0x220]
jne 0x10017c8f
call fcn.1001af90
mov edx, dword [ebp + 4]
lea ecx, [ebp + 8]
push ecx
mov ecx, dword [edi + 0x220]
push edx
push ecx
push str.Protect_Check_sid:_d_type:_d_Info:_s
mov ecx, eax
call fcn.1001b3f0
add esp, 0x10
cmp dword [ebp + 4], 4
jne 0x10017c8f
mov ebx, dword [edi + 0x220]
mov esi, str.FSEMessager.exe
call fcn.100154f0
mov ebx, dword [edi + 0x220]
mov esi, str.Explorer.exe
mov dword [ebp - 0x1c], eax
call fcn.100154f0
mov ebx, dword [ebp - 0x1c]
mov edi, eax
test ebx, ebx
jne 0x10017e36
test edi, edi
je 0x10017c89
xor edx, edx
push 0x206
push edx
lea eax, [ebp + 0x212]
push eax
mov word [ebp + 0x210], dx
call fcn.100285e0
add esp, 0xc
call fcn.1001f3f0
push eax
push str._sFSEMessager.exe
lea ecx, [ebp + 0x210]
push 0x104
push ecx
call fcn.10001f00
add esp, 0x10
push ebx
push edi
lea ecx, [ebp + 0x210]
call fcn.10014990
mov esi, eax
mov dword [ebp - 0x18], esi
call fcn.1001af90
push esi
push edi
lea edx, [ebp + 0x210]
push edx
push str.Protect_Check_Start__s_With_Explorer:_d_Rlt:_08x
mov ecx, eax
call fcn.1001b3f0
mov eax, dword [ebp - 0x20]
mov ebx, dword [eax + 0x220]
add esp, 0x10
mov esi, str.FSEMessager.exe
call fcn.100154f0
inc dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov ebx, eax
test edi, edi
jne 0x10017f14
test ebx, ebx
je 0x10017c89
xor ecx, ecx
push 0x206
push ecx
lea edx, [ebp + 0x41a]
push edx
mov word [ebp + 0x418], cx
call fcn.100285e0
add esp, 0xc
push 0x104
lea eax, [ebp + 0x418]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov eax, 0x104
lea ecx, [ebp + 0x418]
xor esi, esi
mov edx, eax
test eax, eax
je 0x10017e99
cmp word [ecx], 0
je 0x10017f58
add ecx, 2
dec eax
jmp 0x10017e85
mov esi, 0x80070057
xor eax, eax
test esi, esi
jl 0x10017ec1
mov ecx, 0x104
sub ecx, eax
lea edx, [ebp + eax*2 + 0x418]
push str.explorer.exe
mov eax, 0x7fffffff
call fcn.10014100
push 0
push ebx
lea ecx, [ebp + 0x418]
call fcn.10014990
mov esi, eax
mov dword [ebp - 0x18], esi
call fcn.1001af90
push esi
push ebx
lea ecx, [ebp + 0x418]
push ecx
push str.Protect_Check_Start__s_With_Fsemessager:_d_Rlt:_08x
mov ecx, eax
call fcn.1001b3f0
mov edx, dword [ebp - 0x20]
mov ebx, dword [edx + 0x220]
add esp, 0x10
mov esi, str.Explorer.exe
call fcn.100154f0
inc dword [ebp - 0x14]
mov edi, eax
test edi, edi
je 0x10017c89
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x10017c89
push edi
push 0
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
mov dword [ebp - 0x1c], esi
test esi, esi
je 0x10017c89
push ebx
push 0
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x24], eax
test eax, eax
jne 0x10017f69
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x10017c89
test esi, esi
jl 0x10017e9e
sub edx, eax
mov eax, edx
jmp 0x10017ea0
mov edi, dword [ebp - 0x20]
mov ecx, dword [edi + 4]
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x2c], eax
xor esi, esi
lea ebx, [ebx]
mov ebx, dword [ebp - 0x28]
cmp ebx, dword [edi + 0x220]
jne 0x10017fb1
push 0xea60
push 0
lea edx, [ebp - 0x34]
push edx
push 3
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov esi, eax
cmp esi, 0x102
jne 0x10017fb1
mov dword [ebp - 0x14], 0
jmp 0x10017f80
call fcn.1001af90
mov ecx, dword [edi + 0x220]
push ecx
push ebx
push esi
push str.Protect_Check_WaitedRlt:_d_Sessiond:_d__d
mov ecx, eax
call fcn.1001b3f0
mov edx, dword [ebp - 0x1c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 0x10
push edx
call esi
mov eax, dword [ebp - 0x24]
push eax
call esi
jmp 0x10017c8c
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x620]
xor ecx, ebp
call fcn.100269c5
add ebp, 0x624
mov esp, ebp
pop ebp
ret 4