Function at 0x100d1200
Capabilities:
Get common file path

Disassembly:
sub esp, 0x208
lea eax, [esp]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push edi
push 0x104
push eax
call esi
lea ecx, [esp + 0x10c]
push 0x104
push ecx
call esi
push 0x101361a8
push 0x101947ac
push 0x10136198
push 0x1019457c
push 0x10136188
push 0x10194750
lea edi, [esp + 0x20]
or ecx, 0xffffffff
xor eax, eax
push 0x10136174
push 0x10194670
push 0x10136164
repne scasb al, byte es:[edi]
push 0x1019469c
push 0x10136154
push 0x10194770
push 0x10136148
mov eax, dword [0x10136138]
push 0x10194528
push 0x1013612c
push 0x10194688
not ecx
push 0x10136120
dec ecx
push 0x1019451c
push 0x10136114
push 0x10194548
lea edx, [esp + ecx + 0x58]
push 0x10136100
push 0x101947ec
push 0x101360f4
mov dword [edx], eax
mov eax, dword [0x1013613c]
push 0x101945c0
push 0x101360e8
push 0x10194744
mov dword [edx + 4], eax
mov eax, dword [0x10136140]
push 0x101360dc
push 0x101947b0
push 0x101360cc
mov dword [edx + 8], eax
mov ax, word [0x10136144]
push 0x10194674
push 0x101360c4
push 0x10194714
mov word [edx + 0xc], ax
mov edx, dword [0x101360b8]
mov eax, dword [0x101360bc]
lea ecx, [esp + ecx + 0x18c]
push 0x101360ac
push 0x10194740
push 0x101360a0
mov dword [ecx], edx
mov dx, word [0x101360c0]
push 0x101947a8
push 0x10136090
push 0x10194664
mov dword [ecx + 4], eax
mov al, byte [0x101360c2]
push 0x10136088
push 0x10194718
push 0x1013607c
mov word [ecx + 8], dx
push 0x10194650
push 0x10136070
push 0x101947e8
mov byte [ecx + 0xa], al
push 0x10136064
push 0x10194798
push 0x10136054
push 0x10194578
push 0x10136048
push 0x10194808
push 0x10136034
push 0x101946d0
push 0x10136020
push 0x1019470c
push 0x10136010
push 0x101947bc
push 0x10135ffc
push 0x1019455c
push 0x10135ff0
push 0x1019453c
push 0x10135fe0
push 0x10194778
push 0x10135fd4
push 0x101946e4
push 0x10135fc8
push 0x10194708
push 0x10135fbc
push 0x10194720
push 0x10135fac
push 0x1019465c
push 0x10135f9c
push 0x10194534
push 0x10135f90
push 0x10194644
push 0x10135f80
push 0x10194710
push 0x10135f74
push 0x10194788
push 0x10135f68
push 0x101945c4
push 0x10135f58
push 0x101945dc
push 0x10135f4c
push 0x10194800
push 0x10135f40
push 0x101945e4
push 0x10135f34
push 0x10194620
push 0x10135f28
push 0x10194654
push 0x10135f1c
push 0x10194510
push 0x10135f10
push 0x10194638
push 0x10135f04
push 0x1019477c
push 0x10135ef4
push 0x1019454c
push 0x10135ee8
push 0x10194648
push 0x10135edc
push 0x101947b4
push 0x10135ecc
push 0x101946e8
push 0x10135ebc
push 0x101946e0
push 0x10135eac
push 0x101945d0
push 0x10135e9c
push 0x101945c8
push 0x10135e8c
push 0x1019456c
push 0x10135e78
push 0x101947c8
push 0x10135e68
push 0x101945ec
push 0x10135e58
push 0x101946dc
push 0x10135e4c
push 0x101945bc
push 0x10135e44
push 0x10194560
push 0x10135e3c
push 0x10194780
push 0x10135e2c
push 0x10194524
push 0x10135e20
push 0x101947a0
push 0x10135e10
push 0x1019476c
push 0x10135e00
push 0x101946f8
push 0x10135df0
push 0x10194540
push 0x10135de4
push 0x10194568
push 0x10135dd8
push 0x101947f4
push 0x10135dcc
push 0x10194538
push 0x10135dc0
push 0x101946a4
push 0x10135db4
push 0x10194580
push 0x10135da8
push 0x101946b8
push 0x10135d98
push 0x101945d8
push 0x10135d88
push 0x10194658
push 0x10135d78
push 0x10194574
push 0x10135d68
push 0x1019468c
push 0x10135d58
push 0x10194514
push 0x10135d50
push 0x10194754
push 0x10135d48
push 0x1019471c
push 0x10135d40
push 0x101947c0
push 0x10135d34
push 0x101945cc
push 0x10135d28
push 0x101947f0
push 0x10135d18
push 0x10194564
push 0x10135d0c
push 0x10194558
push 0x10135d00
push 0x10194784
push 0x10135cf4
push 0x101947a4
push 0x10135cec
push 0x10194588
push 0x10135ce0
push 0x1019474c
push 0x10135cd4
push 0x101947c4
push 0x10135cc0
push 0x10194520
push 0x10135cb0
push 0x1019452c
push 0x10135ca0
push 0x10194584
push 0x10135c94
push 0x101945f0
push 0x10135c88
push 0x101945e8
push 0x10135c80
push 0x101945f4
push 0x10135c74
push 0x101947b8
push 0x10135c6c
push 0x10194694
push 0x10135c64
push 0x10194530
push 0x10135c54
push 0x101945d4
push 0x10135c44
push 0x101947fc
push 0x10135c38
push 0x10194758
push 0x10135c28
push 0x10194570
push 0x10135c1c
push 0x10194764
push 0x10135c14
push 0x101946f0
push 0x10135c08
push 0x10194640
push 0x10135bfc
push 0x101947e0
push 0x10135bf0
push 0x10194660
push 0x10135be0
push 0x1019475c
push 0x10135bd0
push 0x10194680
push 0x10135bc0
push 0x101946ac
lea ecx, [esp + 0x380]
push 0x6f
push ecx
push 0x10194820
call fcn.100d1190
add esp, 0x384
test al, al
je 0x100d17ca
push 0x10135bb0
push 0x10194624
push 0x10135ba4
push 0x10194728
push 0x10135b94
push 0x10194760
push 0x10135b80
push 0x10194804
push 0x10135b70
push 0x10194724
push 0x10135b68
push 0x101946bc
push 0x10135b5c
push 0x101946d4
push 0x10135b50
push 0x1019478c
push 0x10135b40
push 0x10194774
push 0x10135b2c
push 0x101946d8
push 0x10135b14
push 0x10194684
push 0x10135b00
push 0x101947f8
push 0x10135aec
push 0x101947e4
push 0x10135ae0
push 0x1019463c
push 0x10135acc
push 0x1019461c
push 0x10135abc
push 0x10194598
lea edx, [esp + 0x18c]
push 0x10
push edx
push 0x10194824
call fcn.100d1190
add esp, 0x8c
test al, al
je 0x100d17ca
pop edi
mov eax, 1
pop esi
add esp, 0x208
ret
push 0x10135aa8
xor esi, esi
call fcn.100d1830
add esp, 4
mov eax, esi
pop edi
pop esi
add esp, 0x208
ret