Function at 0x100155c2
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0xd94]
sub esp, 0xe14
mov eax, dword [0x10074bac]
xor eax, ebp
mov dword [ebp + 0xd90], eax
mov eax, dword [ebp + 0xda0]
push ebx
push esi
mov esi, dword [ebp + 0xd9c]
push edi
mov edi, 0x3ff
xor ebx, ebx
push edi
mov dword [ebp - 0x74], eax
lea eax, [ebp - 0x6f]
push ebx
push eax
mov dword [ebp - 0x78], esi
mov byte [ebp - 0x70], bl
call fcn.10040850
push edi
lea eax, [ebp + 0x391]
push ebx
push eax
mov byte [ebp + 0x390], bl
call fcn.10040850
add esp, 0x18
cmp esi, ebx
mov esi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edi, 0x200
jne 0x10015669
cmp dword [ebp - 0x74], ebx
jne 0x1001567e
mov eax, dword [ebp + 0xda8]
cmp eax, ebx
je 0x1001564b
lea edx, [ebp - 0x70]
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
cmp cl, bl
jne 0x10015641
mov eax, dword [ebp + 0xdac]
cmp eax, ebx
je 0x10015691
lea edx, [ebp + 0x390]
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
cmp cl, bl
jne 0x1001565d
jmp 0x10015691
push ebx
push ebx
push edi
lea eax, [ebp - 0x70]
push eax
push 0xffffffffffffffff
push dword [ebp - 0x78]
push ebx
push ebx
call esi
cmp dword [ebp - 0x74], ebx
je 0x10015691
push ebx
push ebx
push edi
lea eax, [ebp + 0x390]
push eax
push 0xffffffffffffffff
push dword [ebp - 0x74]
push ebx
push ebx
call esi
lea eax, [ebp - 0x70]
push eax
call fcn.10014a4d
pop ecx
mov dword [ebp - 0x80], eax
cmp eax, 0xfffffffe
je 0x10015721
lea eax, [ebp + 0x390]
push eax
call fcn.10014a4d
pop ecx
mov dword [ebp - 0x7c], eax
cmp eax, 0xfffffffe
je 0x10015721
lea eax, [ebp + 0x390]
push eax
lea eax, [ebp - 0x70]
push eax
call fcn.1002cfea
mov esi, eax
pop ecx
pop ecx
cmp esi, 0xfffffffe
je 0x10015721
test byte [0x1013f2d8], 1
je 0x1001571c
lea eax, [ebp - 0x70]
push ebx
push eax
call fcn.1001526e
mov esi, eax
pop ecx
pop ecx
cmp esi, ebx
jne 0x1001571c
lea eax, [ebp + 0x390]
push 1
push eax
call fcn.1001526e
mov esi, eax
pop ecx
pop ecx
cmp esi, ebx
jne 0x1001571c
lea eax, [ebp + 0x390]
push eax
lea eax, [ebp - 0x70]
push eax
push str.isWhite_Process_SAL_Error_not_found_a_hash_by_lpApplicationName__s_lpCommandLine__s_
push 0x63
call fcn.1003dfed
add esp, 0x10
cmp esi, 0xfffffffe
jne 0x10015788
mov eax, dword [0x101434ac]
cmp eax, 0x68
je 0x10015735
cmp eax, 0x49
je 0x10015735
cmp eax, 0x44
jne 0x10015753
lea eax, [ebp + 0x390]
push eax
lea eax, [ebp - 0x70]
push eax
push str.MyCreateProcess_in_whiteList_lpApplicationName__s__lpCommandLine__s_
push ebx
call fcn.1003dfed
mov eax, dword [0x101434ac]
add esp, 0x10
cmp eax, 0x68
je 0x10015762
cmp eax, 0x49
je 0x10015762
cmp eax, 0x44
jne 0x10015780
cmp dword [ebp - 0x78], ebx
je 0x10015780
cmp dword [ebp - 0x74], ebx
je 0x10015780
push dword [ebp - 0x74]
push dword [ebp - 0x78]
push str.MyCreateProcess_in_whiteList_lpApplicationNameW__ls__lpCommandLineW__ls_
push ebx
call fcn.1003dfed
add esp, 0x10
xor eax, eax
inc eax
jmp 0x10015a44
lea eax, [ebp + 0x390]
push eax
lea eax, [ebp - 0x70]
push eax
call fcn.10033b1e
pop ecx
pop ecx
test al, al
je 0x100157a6
or eax, 0xffffffff
jmp 0x10015a44
cmp dword [ebp - 0x80], ebx
jne 0x10015862
lea eax, [ebp - 0x70]
push 2
push eax
call fcn.1000f3e6
pop ecx
pop ecx
test eax, eax
je 0x10015910
push 2
call dword [sym.imp.KERNEL32.dll_SetLastError]
test dword [0x1015bd84], 0x80000000
je 0x1001579e
mov esi, 0x1ff
push esi
lea eax, [ebp + 0xb91]
push ebx
push eax
mov byte [ebp + 0xb90], bl
call fcn.10040850
push esi
lea eax, [ebp + 0x991]
push ebx
push eax
mov byte [ebp + 0x990], bl
call fcn.10040850
add esp, 0x18
lea eax, [ebp + 0x990]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp + 0x990]
push eax
lea eax, [ebp + 0xb90]
push str._s_s
push eax
call fcn.10040b98
lea eax, [ebp + 0xb90]
add esp, 0x10
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x1001583e
sub eax, esi
cmp eax, 5
jbe 0x1001579e
lea eax, [ebp + 0xb90]
push eax
call dword [0x1019efdc]
jmp 0x1001579e
cmp dword [ebp - 0x7c], ebx
jne 0x10015910
lea eax, [ebp + 0x390]
push 2
push eax
call fcn.1000f3e6
pop ecx
pop ecx
test eax, eax
je 0x10015910
push 2
call dword [sym.imp.KERNEL32.dll_SetLastError]
test dword [0x1015bd84], 0x80000000
je 0x1001579e
mov esi, 0x1ff
push esi
lea eax, [ebp + 0xb91]
push ebx
push eax
mov byte [ebp + 0xb90], bl
call fcn.10040850
push esi
lea eax, [ebp + 0x991]
push ebx
push eax
mov byte [ebp + 0x990], bl
call fcn.10040850
add esp, 0x18
lea eax, [ebp + 0x990]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea eax, [ebp + 0x390]
push eax
lea eax, [ebp + 0x990]
push eax
lea eax, [ebp + 0xb90]
push str._s_s
push eax
call fcn.10040b98
lea eax, [ebp + 0xb90]
add esp, 0x10
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x10015904
jmp 0x10015845
test dword [0x101446a0], 0x8000000
jne 0x10015a42
test byte [0x10072cdc], 1
je 0x10015a42
lea eax, [ebp + 0x390]
push eax
call fcn.10011e48
pop ecx
test al, al
je 0x10015a42
mov eax, dword [ebp + 0xda4]
cmp eax, ebx
je 0x10015952
cmp word [eax + 0x30], bx
je 0x1001596a
mov eax, dword [ebp + 0xdb0]
cmp eax, ebx
je 0x10015a42
cmp word [eax + 0x30], bx
jne 0x10015a42
mov edi, 0x101964f0
push edi
push ebx
call fcn.1002a722
pop ecx
pop ecx
test eax, eax
je 0x10015988
cmp dword [0x102a851c], ebx
je 0x10015a42
cmp dword [0x101434ac], 0x47
jne 0x1001599e
push str._CreateProcessA_.....HIDE....maybe_hackShell
push ebx
call fcn.1003dfed
pop ecx
pop ecx
push 0x3ff
lea eax, [ebp + 0x791]
push ebx
push eax
mov byte [ebp + 0x790], bl
call fcn.10040850
lea eax, [ebp + 0x390]
push eax
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp + 0x790]
push str._s__s
push eax
call fcn.10040b98
add esp, 0x1c
push 0x10060b98
lea eax, [ebp + 0x790]
push eax
xor esi, esi
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x100159f0
push 0xd
pop esi
lea eax, [ebp + esi + 0x790]
push 0x20
push eax
call fcn.10040730
pop ecx
pop ecx
cmp eax, ebx
je 0x10015a07
mov byte [eax], bl
lea eax, [ebp + 0x790]
push eax
call fcn.1002b942
pop ecx
test al, al
je 0x10015a42
cmp dword [0x10144ecc], ebx
jne 0x10015a42
push ebx
push edi
lea eax, [ebp + 0x790]
push eax
push 1
push 0x8000000
mov ecx, 0x10196498
call fcn.1003903e
test eax, eax
jne 0x1001579e
xor eax, eax
mov ecx, dword [ebp + 0xd90]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1004083f
add ebp, 0xd94
leave
ret