Function at 0x10032d70
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x1013641b
mov eax, dword fs:[0]
push eax
sub esp, 0x6f8
mov eax, dword [0x1017455c]
xor eax, esp
mov dword [esp + 0x6f4], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x1017455c]
xor eax, esp
push eax
lea eax, [esp + 0x70c]
mov dword fs:[0], eax
mov eax, dword [esp + 0x71c]
xor ebx, ebx
push 0x103
mov esi, edx
lea edx, [esp + 0x1e5]
push ebx
push edx
mov dword [esp + 0x38], eax
mov dword [esp + 0x24], ecx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x3c], ebx
xor ebp, ebp
mov byte [esp + 0x1ec], bl
call fcn.10116880
add esp, 0xc
push 0x103
lea eax, [esp + 0x4fd]
push ebx
push eax
mov byte [esp + 0x504], bl
call fcn.10116880
add esp, 0xc
push 0x103
lea ecx, [esp + 0xdd]
push ebx
push ecx
mov byte [esp + 0xe4], bl
call fcn.10116880
add esp, 0xc
push 0x103
lea edx, [esp + 0x605]
push ebx
push edx
mov byte [esp + 0x60c], bl
call fcn.10116880
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
add esp, 0xc
cmp esi, ebx
je 0x10032e5d
cmp byte [esi], bl
je 0x10032e5d
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esp + 0xdc]
push eax
call esi
jmp 0x10032ed3
push 0x104
lea ecx, [esp + 0x4fc]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea esi, [esp + 0x4f8]
call fcn.10049c80
mov edx, esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
push edx
lea eax, [esp + 0xdc]
push eax
call esi
cmp byte [esp + 0xd8], bl
je 0x10032ec4
lea eax, [esp + 0xd8]
nop
inc eax
cmp byte [eax], bl
jne 0x10032ea0
lea ecx, [esp + 0xd8]
sub eax, ecx
je 0x10032ec4
cmp byte [esp + eax + 0xd7], 0x5c
je 0x10032ec4
push 0x10149ea8
mov edx, ecx
push edx
call edi
push str.driversetchosts
lea eax, [esp + 0xdc]
push eax
call edi
lea ecx, [esp + 0x24]
lea edx, [esp + 0xd8]
call fcn.1005bf90
mov dword [esp + 0x3c], eax
cmp dword [esp + 0x24], ebx
je 0x100333b1
cmp eax, ebx
je 0x10033200
lea ecx, [esp + 0x40]
mov dword [esp + 0x20], ebx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x28], ebx
call fcn.10062b90
lea ecx, [esp + 0xd8]
push ecx
lea edx, [esp + 0x1e4]
push edx
mov dword [esp + 0x71c], ebx
call esi
push 0x10150054
lea eax, [esp + 0x1e4]
push eax
call edi
lea ecx, [esp + 0x1e0]
push 0x1014a614
push ecx
call fcn.1010ebfe
mov esi, dword [esp + 0x2c]
add esp, 8
lea edx, [esp + 0x17]
mov dword [esp + 0x1c], eax
push edx
lea eax, [esp + 0x1a]
push eax
lea ecx, [esp + 0x40]
push ecx
lea ebx, [esp + 0x40]
lea edi, [esp + 0x2c]
call fcn.10037650
mov edi, eax
xor ebx, ebx
cmp edi, ebx
je 0x100331e6
mov ebp, dword [esp + 0x20]
push edi
call fcn.100454f0
add esp, 4
cmp eax, ebx
je 0x100330fc
mov cl, byte [edi]
cmp cl, bl
je 0x100330fc
cmp cl, 0x23
je 0x100330fc
cmp eax, 0x104
jge 0x100330fc
push 0x103
lea edx, [esp + 0x2ed]
push ebx
push edx
mov byte [esp + 0x2f4], bl
call fcn.10116880
add esp, 0xc
push 0x103
lea eax, [esp + 0x3f5]
push ebx
push eax
mov byte [esp + 0x3fc], bl
call fcn.10116880
mov esi, dword [esp + 0x38]
add esp, 0xc
mov dword [esp + 0x20], ebx
mov dword [esp + 0x28], ebx
cmp esi, ebx
je 0x100330dd
cmp dword [esp + 0x18], ebx
je 0x100330dd
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x2ec]
mov ecx, edi
call fcn.10046ea0
lea edx, [esp + 0x24]
add esp, 4
push edx
lea edx, [esp + 0x3f4]
mov ecx, edi
call fcn.10046ea0
add esp, 4
cmp byte [esp + 0x2e8], bl
je 0x10033078
cmp byte [esp + 0x3f0], bl
je 0x10033078
mov eax, esi
lea ecx, [esp + 0x3f0]
call fcn.10031890
test eax, eax
je 0x1003306e
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x2e8]
call fcn.10031890
test eax, eax
jne 0x10033078
mov dword [esp + 0x30], 1
jmp 0x1003309d
push 1
push ebx
mov ecx, edi
lea edx, [esp + 0x48]
call fcn.10062ec0
test eax, eax
je 0x1003309d
mov eax, dword [esp + 0x1c]
push edi
push 0x1014a618
push eax
call fcn.10110652
add esp, 0xc
mov eax, dword [esp + 0x34]
cmp eax, ebx
je 0x100330ab
mov cl, byte [esp + 0x16]
mov byte [eax], cl
mov eax, dword [esp + 0x38]
cmp eax, ebx
je 0x100330b9
mov dl, byte [esp + 0x17]
mov byte [eax], dl
cmp ebp, ebx
je 0x100331e6
push 0xa
push ebp
mov edi, ebp
call fcn.1010d780
add esp, 8
cmp eax, ebx
jne 0x100331be
xor ebp, ebp
jmp 0x100331de
push 1
push ebx
mov ecx, edi
lea edx, [esp + 0x48]
call fcn.10062ec0
test eax, eax
je 0x1003309d
mov ecx, dword [esp + 0x1c]
push edi
push 0x1014a618
push ecx
jmp 0x10033095
mov dl, byte [edi]
xor ecx, ecx
cmp dl, 0x23
jne 0x10033110
mov ecx, 1
mov dword [esp + 0x28], ecx
jmp 0x1003311f
cmp dword [esp + 0x28], ebx
je 0x1003311f
mov dword [esp + 0x28], ebx
mov ecx, 1
cmp eax, ebx
je 0x10033130
cmp dl, bl
je 0x10033130
cmp dl, 0x23
jne 0x1003309d
cmp ecx, ebx
je 0x1003309d
cmp dl, 0x23
jne 0x1003308a
push str._old
mov ecx, edi
call fcn.10047020
add esp, 4
cmp eax, 0xffffffff
je 0x1003308a
mov eax, edi
cmp byte [edi], bl
je 0x10033165
nop
inc eax
cmp byte [eax], bl
jne 0x10033160
sub eax, edi
inc eax
push eax
call fcn.1010dced
mov esi, eax
add esp, 4
cmp esi, ebx
je 0x1003308a
mov edx, esi
mov eax, edi
sub edx, edi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
cmp cl, bl
jne 0x10033181
push 1
push 0x1013f817
push str._old
push esi
call fcn.10047ed0
mov edx, dword [esp + 0x2c]
push esi
push 0x1014a618
push edx
call fcn.10110652
add esp, 0x1c
push esi
call fcn.1010dc10
add esp, 4
jmp 0x1003309d
mov cl, byte [eax]
mov dword [esp + 0x34], eax
mov byte [eax], bl
lea ebp, [eax + 1]
dec eax
cmp byte [eax], 0xd
mov byte [esp + 0x16], cl
jne 0x100331de
mov dword [esp + 0x38], eax
mov byte [esp + 0x17], 0xd
mov byte [eax], bl
cmp edi, ebx
jne 0x10032f83
lea ecx, [esp + 0x40]
mov dword [esp + 0x714], 0xffffffff
call fcn.10062c60
mov ebp, dword [esp + 0x1c]
xor ebx, ebx
mov edx, dword [esp + 0x24]
push edx
call fcn.1010dc10
add esp, 4
cmp ebp, ebx
je 0x100333a4
push ebp
call fcn.1010f263
add esp, 4
cmp dword [esp + 0x30], ebx
je 0x10033398
xor ebp, ebp
call fcn.1003c830
test eax, eax
je 0x1003327c
xor eax, eax
mov edi, str.ProtectHostsX
mov ebx, 0x101482cc
call fcn.10031430
lea eax, [esp + 0x2c]
push eax
push str.ProtectHosts
mov ecx, ebx
mov edx, reloc.OLEAUT32.dll_SysReAllocString
call fcn.10031670
test al, al
je 0x1003326a
xor eax, eax
mov edi, str.ProtectHosts
call fcn.10031430
push 0xfa
mov ebp, 1
call dword [sym.imp.KERNEL32.dll_Sleep]
xor ebx, ebx
push ebx
lea edi, [esp + 0xdc]
lea ebx, [esp + 0x1e4]
call fcn.10063ba0
add esp, 4
test eax, eax
jne 0x100332ef
push 0x103
push eax
lea ecx, [esp + 0x2f1]
push ecx
mov byte [esp + 0x2f4], al
call fcn.10116880
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x104
mov edi, eax
lea esi, [esp + 0x2ec]
call fcn.10049ce0
add esp, 4
mov edx, esi
push edx
lea eax, [esp + 0xdc]
push eax
mov ecx, ebx
push ecx
push str._HOSTS__CopyFile_from___s__to___s__failed__Reason:__s
push 0
call fcn.10053700
add esp, 0x14
jmp 0x10033355
push 0
push 0
lea edx, [esp + 0x20]
lea ecx, [esp + 0x1e8]
mov dword [esp + 0x20], 0
call fcn.10044660
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x44]
push edx
push eax
lea ecx, [esp + 0xe8]
push ecx
lea edx, [esp + 0x1f4]
push edx
push str._HOSTS__CopyFile_from___s__to___s__Success._EarlierSize:__lu_._NewSize:__lu_
push 0
call fcn.10053700
add esp, 0x20
cmp byte [esp + 0x600], 0
je 0x10033355
lea eax, [esp + 0x600]
push eax
push str._HOSTS__Backup_Kept_in_file___s_
push 0
call fcn.10053700
add esp, 0xc
test ebp, ebp
je 0x10033396
mov eax, 1
mov edi, str.ProtectHostsX
mov ebx, 0x101482cc
call fcn.10031430
lea ecx, [esp + 0x2c]
push ecx
push str.ProtectHosts
mov ecx, ebx
mov edx, reloc.OLEAUT32.dll_SysReAllocString
call fcn.10031670
test al, al
je 0x10033396
mov eax, 1
mov edi, str.ProtectHosts
call fcn.10031430
xor ebx, ebx
lea eax, [esp + 0x1e0]
call fcn.10033960
cmp dword [esp + 0x30], ebx
je 0x100333b1
mov eax, 1
jmp 0x100333b3
xor eax, eax
mov ecx, dword [esp + 0x70c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x6f4]
xor ecx, esp
call fcn.1010d699
add esp, 0x704
ret