Function at 0x1000bb00
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x274
push ebx
mov bl, byte [ebp - 1]
push esi
lea ecx, [eax + 0x858]
mov esi, eax
push edi
mov dword [ebp - 8], esi
mov dword [ebp - 0x40], ecx
cmp eax, ecx
ja case.0x1000bbb6.195
jmp 0x1000bb30
cmp esi, 0x5b42
ja 0x1000be59
je 0x1000be52
lea eax, [esi - 0x3a9a]
cmp eax, 0xd8
ja case.0x1000bb5a.15003
movzx eax, byte [eax + 0x1000bf04]
jmp dword [eax*4 + 0x1000bed8]
push 3
lea ecx, [ebp - 0x28]
push 0x10161e54
push ecx
call fcn.100fdb50
add esp, 0xc
jmp case.0x1000bb5a.15003
mov edx, 0x53
mov word [ebp - 0x38], dx
jmp case.0x1000bb5a.15003
push 2
lea eax, [ebp - 0x33]
push 0x10161e5c
push eax
call fcn.100fd2d0
add esp, 0xc
jmp case.0x1000bb5a.15003
cmp byte [ebp - 1], 0
je 0x1000bc1b
xor esi, esi
cmp esi, 0xc3
ja case.0x1000bbb6.1
movzx ecx, byte [esi + 0x1000bff4]
jmp dword [ecx*4 + 0x1000bfe0]
xor eax, eax
lea edx, [ebp - 0x168]
push edx
push 0x104
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
jmp case.0x1000bbb6.1
push 0
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x5c]
push ecx
push 1
push 0
push 0x104
lea edx, [ebp - 0x270]
push edx
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_ReadDirectoryChangesW]
jmp case.0x1000bbb6.1
xor bl, bl
add esi, 0x41
lea eax, [esi + 0x6d91]
cmp eax, 0x6e54
jbe 0x1000bba7
mov esi, dword [ebp - 8]
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.USER32.dll_UpdateWindow]
xor eax, eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], eax
jmp case.0x1000bb5a.15003
push 1
lea edx, [ebp - 0x30]
push 0x10161e60
push edx
call fcn.100fda10
add esp, 0xc
jmp case.0x1000bb5a.15003
push 0
push 0
push 0
push 0
push closesocket
push closesocket
push closesocket
push closesocket
push 0x70000
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0x30]
push ecx
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
test eax, eax
mov dword [ebp - 0x24], eax
sete byte [ebp - 1]
jmp case.0x1000bb5a.15003
mov edx, dword [ebp - 0x24]
push edx
call dword [sym.imp.USER32.dll_DestroyWindow]
lea eax, [ebp - 0x58]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetCPInfo]
mov esi, 0x2e38
lea ecx, [ecx]
cmp esi, 0x2f1c
ja 0x1000bd66
je 0x1000bd1e
mov eax, esi
sub eax, 0x2e38
je 0x1000bd06
sub eax, 0x4c
je 0x1000bce1
sub eax, 0x4c
jne 0x1000bdce
mov dword [ebp - 0x1b], 0x746341
jmp 0x1000bdce
push 2
lea ecx, [ebp - 0x1e]
push 0x10161e64
push ecx
call fcn.100fdb50
mov edx, 0x67
add esp, 0xc
mov byte [ebp - 0x1d], 0x75
mov word [ebp - 0x1c], dx
jmp 0x1000bdce
push 3
lea eax, [ebp - 0x20]
push 0x10161e6c
push eax
call fcn.100fdb50
add esp, 0xc
jmp 0x1000bdce
mov cx, word [0x10161e74]
mov dl, byte [0x10161e76]
lea eax, [ebp - 0x20]
mov word [ebp - 0x18], cx
mov byte [ebp - 0x16], dl
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x1000bd36
mov cx, word [0x10161e78]
mov dl, byte [0x10161e7a]
mov word [eax], cx
mov cl, byte [0x10161e7e]
mov byte [eax + 2], dl
mov ax, word [0x10161e7c]
mov word [ebp - 0x14], ax
mov byte [ebp - 0x12], cl
jmp 0x1000bdce
mov eax, esi
sub eax, 0x2f68
je 0x1000bd89
sub eax, 0x4c
jne 0x1000bdce
mov dx, word [0x10161e70]
mov al, byte [0x10161e72]
mov word [ebp - 0xc], dx
mov byte [ebp - 0xa], al
jmp 0x1000bdce
push 2
lea ecx, [ebp - 0x20]
push 0x10161e80
push ecx
call fcn.100fda10
lea edi, [ebp - 0x20]
add esp, 0xc
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x1000bda0
mov dx, word [0x10161e84]
mov cl, byte [0x10161e8a]
mov ax, word [0x10161e88]
mov word [edi], dx
mov edx, 0x25
mov byte [ebp - 0xd], cl
mov word [ebp - 0xf], ax
mov word [ebp - 0xd], dx
add esi, 0x4c
cmp esi, 0x3000
jbe 0x1000bcb0
mov esi, dword [ebp - 8]
mov bl, 1
jmp case.0x1000bb5a.15003
push 1
lea eax, [ebp - 0x30]
push 0x10161e90
push eax
mov byte [ebp - 0x30], 0
call fcn.100fda10
mov cx, word [0x10161e94]
mov dl, byte [0x10161e96]
add esp, 0xc
push 5
lea eax, [ebp - 0x2d]
push str.nWCl
push eax
mov word [ebp - 0x2f], cx
mov byte [ebp - 0x2d], dl
call fcn.100fdb50
add esp, 0xc
jmp case.0x1000bb5a.15003
push 3
lea ecx, [ebp - 0x37]
push 0x10161ea0
push ecx
call fcn.100fdb50
add esp, 0xc
push 2
lea edx, [ebp - 0x38]
push 0x10161ea4
push edx
call fcn.100fda10
add esp, 0xc
jmp case.0x1000bb5a.15003
call fcn.10019930
jmp case.0x1000bb5a.15003
mov eax, esi
sub eax, 0x5b5a
je 0x1000be9d
sub eax, 0x18
je 0x1000be73
sub eax, 0x18
jne case.0x1000bb5a.15003
call fcn.1001c370
jmp case.0x1000bb5a.15003
push 0xc0a850c9
call fcn.10022260
mov dword [ebp - 8], eax
add esp, 4
lea ecx, [ebp - 8]
lea edx, [ebp - 0x3c]
lea eax, [ebp - 0x44]
call fcn.1002b140
mov edi, 0x10188d44
call fcn.1000a4c0
jmp case.0x1000bb5a.15003
push 0xc0a850a1
call fcn.10022260
add esp, 4
push 0xffffff00
mov dword [ebp - 0x44], eax
call fcn.10022260
add esp, 4
mov dword [ebp - 0x3c], eax
add esi, 0x18
mov dword [ebp - 8], esi
cmp esi, dword [ebp - 0x40]
jbe 0x1000bb30
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret