Function at 0x10b7b1b
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x538
mov eax, dword [0x111121c]
push ebx
push esi
push edi
push 0x20019
xor esi, esi
push esi
push 0x80000002
mov dword [ebp - 0x4d8], ecx
push 0x101acd0
lea ecx, [ebp - 0x538]
mov dword [ebp - 4], eax
mov dword [ebp - 0x4d4], esi
call fcn.01064103
lea eax, [ebp - 0x538]
push eax
lea ecx, [ebp - 0x51c]
call fcn.01064040
lea ecx, [ebp - 0x51c]
call fcn.010643eb
test eax, eax
jne 0x10b7d89
push 0x60
push 0x101acd0
lea eax, [ebp - 0xc4]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyNW]
push 0x60
push dword [ebp - 0x510]
lea eax, [ebp - 0xc4]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCatBuffW]
push 0x20019
push esi
push 0x80000002
lea eax, [ebp - 0xc4]
push eax
lea ecx, [ebp - 0x504]
call fcn.01064103
push 0x101ad44
lea ecx, [ebp - 0x504]
call fcn.01064159
push eax
lea ecx, [ebp - 0x4dc]
call fcn.01038399
mov eax, dword [ebp - 0x4dc]
cmp eax, esi
je 0x10b7d72
cmp word [eax], si
je 0x10b7d5a
push dword [ebp - 0x510]
lea ecx, [ebp - 0x4e4]
call fcn.01038399
mov ebx, dword [ebp - 0x4e4]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push 0x101af60
push ebx
call edi
test eax, eax
je 0x10b7d47
push 0x101afb0
push ebx
call edi
test eax, eax
je 0x10b7d47
push 0x101af10
push ebx
call edi
test eax, eax
je 0x10b7d47
push 0x14
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
cmp eax, esi
pop ecx
je 0x10b7c63
mov dword [eax], esi
mov dword [eax + 4], esi
mov dword [eax + 8], esi
mov dword [eax + 0xc], esi
mov dword [eax + 0x10], esi
mov edi, eax
jmp 0x10b7c65
xor edi, edi
cmp edi, esi
je 0x10b7d47
push ebx
call fcn.010b781f
push 0x101ad50
lea ecx, [ebp - 0x504]
mov ebx, eax
call fcn.01064159
push eax
lea ecx, [ebp - 0x4e0]
call fcn.01038399
push 0x101ad58
lea ecx, [ebp - 0x504]
call fcn.01064159
push eax
lea ecx, [ebp - 0x4e8]
call fcn.01038399
cmp ebx, esi
je 0x10b7cc5
push ebx
lea ecx, [ebp - 0x4d0]
call fcn.0103d18c
lea eax, [ebp - 0x4d0]
jmp 0x10b7ccb
mov eax, dword [ebp - 0x4dc]
mov ebx, dword [ebp - 0x4e8]
push 1
push ebx
push dword [ebp - 0x4e0]
mov ecx, edi
push eax
push dword [ebp - 0x4e4]
call fcn.010b7878
cmp eax, esi
mov dword [ebp - 0x4d4], eax
jl 0x10b7d05
mov ecx, dword [ebp - 0x4d8]
push edi
add ecx, 0x38
call fcn.0105f868
test eax, eax
jne 0x10b7d0e
mov ecx, edi
push 1
call fcn.010b7af5
cmp ebx, esi
je 0x10b7d21
cmp ebx, 0x1111298
je 0x10b7d21
push ebx
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
cmp dword [ebp - 0x4e0], esi
je 0x10b7d41
cmp dword [ebp - 0x4e0], 0x1111298
je 0x10b7d41
push dword [ebp - 0x4e0]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov ebx, dword [ebp - 0x4e4]
cmp ebx, esi
je 0x10b7d5a
cmp ebx, 0x1111298
je 0x10b7d5a
push ebx
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
cmp dword [ebp - 0x4dc], 0x1111298
je 0x10b7d72
push dword [ebp - 0x4dc]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
lea ecx, [ebp - 0x504]
call fcn.0106413d
cmp dword [ebp - 0x4d4], esi
jge 0x10b7b6c
call fcn.010bae40
test al, al
je 0x10b7e90
call fcn.010b64ed
test eax, eax
jne 0x10b7e13
push 0x14
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
cmp eax, esi
pop ecx
je 0x10b7dbd
mov dword [eax], esi
mov dword [eax + 4], esi
mov dword [eax + 8], esi
mov dword [eax + 0xc], esi
mov dword [eax + 0x10], esi
mov edi, eax
jmp 0x10b7dbf
xor edi, edi
cmp edi, esi
je 0x10b7e13
push 0x9d04
lea ecx, [ebp - 0x4d0]
call fcn.0103d18c
xor ebx, ebx
inc ebx
push ebx
push esi
push esi
lea eax, [ebp - 0x4d0]
push eax
push 0x101af60
mov ecx, edi
call fcn.010b7878
cmp eax, esi
mov dword [ebp - 0x4d4], eax
jl 0x10b7e09
mov ecx, dword [ebp - 0x4d8]
push edi
add ecx, 0x38
call fcn.0105f868
test eax, eax
jne 0x10b7e16
push ebx
mov ecx, edi
call fcn.010b7af5
jmp 0x10b7e16
xor ebx, ebx
inc ebx
call fcn.010b6508
test eax, eax
jne 0x10b7e93
push 0x14
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
cmp eax, esi
pop ecx
je 0x10b7e3d
mov dword [eax], esi
mov dword [eax + 4], esi
mov dword [eax + 8], esi
mov dword [eax + 0xc], esi
mov dword [eax + 0x10], esi
mov edi, eax
jmp 0x10b7e3f
xor edi, edi
cmp edi, esi
je 0x10b7e93
push 0x9d05
lea ecx, [ebp - 0x4d0]
call fcn.0103d18c
push ebx
push esi
push esi
lea eax, [ebp - 0x4d0]
push eax
push 0x101afb0
mov ecx, edi
call fcn.010b7878
cmp eax, esi
mov dword [ebp - 0x4d4], eax
jl 0x10b7e86
mov ecx, dword [ebp - 0x4d8]
push edi
add ecx, 0x38
call fcn.0105f868
test eax, eax
jne 0x10b7e93
push ebx
mov ecx, edi
call fcn.010b7af5
jmp 0x10b7e93
xor ebx, ebx
inc ebx
call fcn.010668e4
test eax, eax
je 0x10b7f53
call fcn.0103e636
test eax, eax
jne 0x10b7f53
lea eax, [ebp - 0x2cc]
push eax
push esi
push esi
push 0x25
push esi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jl 0x10b7f53
push 0x14
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
cmp eax, esi
pop ecx
je 0x10b7ee5
mov dword [eax], esi
mov dword [eax + 4], esi
mov dword [eax + 8], esi
mov dword [eax + 0xc], esi
mov dword [eax + 0x10], esi
mov edi, eax
jmp 0x10b7ee7
xor edi, edi
cmp edi, esi
je 0x10b7f53
push 0x9d01
lea ecx, [ebp - 0x4d0]
call fcn.0103d18c
push 0x104
push 0x101b0c8
lea eax, [ebp - 0x2cc]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCatBuffW]
push ebx
lea eax, [ebp - 0x2cc]
push eax
push esi
lea eax, [ebp - 0x4d0]
push eax
push 0x101af10
mov ecx, edi
call fcn.010b7878
cmp eax, esi
mov dword [ebp - 0x4d4], eax
jl 0x10b7f4b
mov ecx, dword [ebp - 0x4d8]
push edi
add ecx, 0x38
call fcn.0105f868
test eax, eax
jne 0x10b7f53
mov ecx, edi
push ebx
call fcn.010b7af5
cmp dword [ebp - 0x4d4], esi
jl 0x10b8050
call fcn.0106096e
test eax, eax
je 0x10b7fce
cmp dword [0x1112ce4], ebx
je 0x10b7fce
push 0x14
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
cmp eax, esi
pop ecx
je 0x10b7f8e
mov dword [eax], esi
mov dword [eax + 4], esi
mov dword [eax + 8], esi
mov dword [eax + 0xc], esi
mov dword [eax + 0x10], esi
mov edi, eax
jmp 0x10b7f90
xor edi, edi
cmp edi, esi
je 0x10b7fce
push 4
push esi
push esi
push 0x101ae08
push 0x101ae20
mov ecx, edi
call fcn.010b7878
cmp eax, esi
mov dword [ebp - 0x4d4], eax
jl 0x10b7fc6
mov ecx, dword [ebp - 0x4d8]
push edi
add ecx, 0x38
call fcn.0105f868
test eax, eax
jne 0x10b7fce
mov ecx, edi
push ebx
call fcn.010b7af5
cmp dword [ebp - 0x4d4], esi
jl 0x10b8050
push 0x14
mov dword [ebp - 0x4d4], 0x8007000e
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
cmp eax, esi
pop ecx
je 0x10b7ffe
mov dword [eax], esi
mov dword [eax + 4], esi
mov dword [eax + 8], esi
mov dword [eax + 0xc], esi
mov dword [eax + 0x10], esi
mov edi, eax
jmp 0x10b8000
xor edi, edi
cmp edi, esi
je 0x10b8050
push 0x9ec9
lea ecx, [ebp - 0x4d0]
call fcn.0103d18c
push 5
push esi
push esi
lea eax, [ebp - 0x4d0]
push eax
push 0x101aec0
mov ecx, edi
call fcn.010b7878
cmp eax, esi
mov dword [ebp - 0x4d4], eax
jl 0x10b8048
mov ecx, dword [ebp - 0x4d8]
push edi
add ecx, 0x44
call fcn.0105f868
test eax, eax
jne 0x10b8050
mov ecx, edi
push ebx
call fcn.010b7af5
lea ecx, [ebp - 0x51c]
call fcn.010640b6
lea ecx, [ebp - 0x538]
call fcn.0106413d
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x4d4]
pop edi
pop esi
pop ebx
call fcn.0105eca9
leave
ret