Function at 0x10001c40
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc44
mov eax, dword [0x101bd92c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
push 0x206
push eax
mov word [ebp - 0xc38], ax
lea eax, [ebp - 0xc36]
push eax
mov edi, ecx
xor ebx, ebx
call fcn.10098090
add esp, 0xc
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x828], ax
lea eax, [ebp - 0x826]
push eax
call fcn.10098090
add esp, 0xc
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x620], ax
lea eax, [ebp - 0x61e]
push eax
call fcn.10098090
add esp, 0xc
xor eax, eax
push 0x206
push eax
mov word [ebp - 0xa30], ax
lea eax, [ebp - 0xa2e]
push eax
call fcn.10098090
add esp, 0xc
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x418], ax
lea eax, [ebp - 0x416]
push eax
call fcn.10098090
add esp, 0xc
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push eax
call fcn.10098090
add esp, 0xc
lea eax, [ebp - 0xc38]
push ebx
push 0x1a
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
xor ecx, ecx
jmp 0x10001d30
movzx eax, word [ebp + ecx - 0xc38]
mov word [ebp + ecx - 0x418], ax
lea ecx, [ecx + 2]
test ax, ax
jne 0x10001d30
lea eax, [ebp - 0x418]
push 0x5c
push eax
call fcn.10092237
add esp, 8
test eax, eax
je 0x10001fb0
xor ecx, ecx
mov word [eax], cx
jmp 0x10001d70
movzx eax, word [ebp + ecx - 0x418]
mov word [ebp + ecx - 0x828], ax
lea ecx, [ecx + 2]
test ax, ax
jne 0x10001d70
lea ecx, [ebp - 0x828]
add ecx, 0xfffffffe
mov ax, word [ecx + 2]
lea ecx, [ecx + 2]
test ax, ax
jne 0x10001d91
mov eax, dword [str.Local]
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov dword [ecx], eax
mov eax, dword [0x101916f4]
mov dword [ecx + 4], eax
mov eax, dword [0x101916f8]
mov dword [ecx + 8], eax
mov ax, word [0x101916fc]
mov word [ecx + 0xc], ax
lea eax, [ebp - 0x828]
push eax
call esi
test eax, eax
mov ecx, 1
mov eax, ebx
cmovne eax, ecx
mov dword [ebp - 0xc3c], eax
xor ecx, ecx
jmp 0x10001df0
movzx eax, word [ebp + ecx - 0x418]
mov word [ebp + ecx - 0x620], ax
lea ecx, [ecx + 2]
test ax, ax
jne 0x10001df0
lea ecx, [ebp - 0x620]
add ecx, 0xfffffffe
mov ax, word [ecx + 2]
lea ecx, [ecx + 2]
test ax, ax
jne 0x10001e11
mov eax, dword [str.LocalLow]
mov dword [ecx], eax
mov eax, dword [0x10191704]
mov dword [ecx + 4], eax
mov eax, dword [0x10191708]
mov dword [ecx + 8], eax
mov eax, dword [0x1019170c]
mov dword [ecx + 0xc], eax
mov eax, dword [0x10191710]
mov dword [ecx + 0x10], eax
lea eax, [ebp - 0x620]
push eax
call esi
test eax, eax
mov ecx, 1
mov eax, ebx
cmovne eax, ecx
mov dword [ebp - 0xc40], eax
xor ecx, ecx
jmp 0x10001e70
movzx eax, word [ebp + ecx - 0x418]
mov word [ebp + ecx - 0xa30], ax
lea ecx, [ecx + 2]
test ax, ax
jne 0x10001e70
lea ecx, [ebp - 0xa30]
add ecx, 0xfffffffe
mov ax, word [ecx + 2]
lea ecx, [ecx + 2]
test ax, ax
jne 0x10001e91
mov eax, dword [str.Roaming]
mov dword [ecx], eax
mov eax, dword [0x10191718]
mov dword [ecx + 4], eax
mov eax, dword [0x1019171c]
mov dword [ecx + 8], eax
mov eax, dword [0x10191720]
mov dword [ecx + 0xc], eax
mov ax, word [0x10191724]
mov word [ecx + 0x10], ax
lea eax, [ebp - 0xa30]
push eax
call esi
test eax, eax
mov eax, 1
cmovne ebx, eax
mov eax, dword [ebp - 0xc3c]
test eax, eax
je 0x10001fb0
mov eax, dword [ebp - 0xc40]
test eax, eax
je 0x10001fb0
test ebx, ebx
je 0x10001fb0
call fcn.10003d50
test eax, eax
je 0x10001fb0
push str.SmartCloudIME.users
lea eax, [ebp - 0x620]
push eax
lea eax, [ebp - 0x210]
push 0x10191744
push eax
call fcn.10091da4
add esp, 0x10
lea eax, [ebp - 0x210]
push eax
call esi
test eax, eax
jne 0x10001f46
lea eax, [ebp - 0x210]
push eax
call fcn.1000c920
add esp, 4
cmp word [ebp - 0x210], 0
jne 0x10001f73
xor ecx, ecx
push ecx
lea eax, [ebp - 0x210]
push eax
lea ecx, [edi + 0x24]
call fcn.100048b0
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1009174c
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x210]
lea edx, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10001f80
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x210]
push eax
lea ecx, [edi + 0x24]
call fcn.100048b0
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1009174c
mov esp, ebp
pop ebp
ret
mov ecx, edi
call fcn.10004040
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1009174c
mov esp, ebp
pop ebp
ret