Function at 0x1001e030
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10047c2d
mov eax, dword fs:[0]
push eax
sub esp, 0xb44
mov eax, dword [0x1005c070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor eax, eax
mov word [ebp - 0x530], ax
push 0x208
push 0
lea ecx, [ebp - 0x52e]
push ecx
call fcn.1002bb10
add esp, 0xc
mov edx, dword [ebp + 8]
mov dword [ebp - 0xa78], edx
lea eax, [ebp - 0x530]
mov dword [ebp - 0xa70], eax
mov ecx, dword [ebp - 0xa70]
mov dword [ebp - 0xb50], ecx
mov edx, dword [ebp - 0xa78]
mov ax, word [edx]
mov word [ebp - 0xa62], ax
mov ecx, dword [ebp - 0xa70]
mov dx, word [ebp - 0xa62]
mov word [ecx], dx
mov eax, dword [ebp - 0xa78]
add eax, 2
mov dword [ebp - 0xa78], eax
mov ecx, dword [ebp - 0xa70]
add ecx, 2
mov dword [ebp - 0xa70], ecx
cmp word [ebp - 0xa62], 0
jne 0x1001e09b
lea edx, [ebp - 0x530]
mov dword [ebp - 0xa68], edx
mov eax, dword [ebp - 0xa68]
add eax, 2
mov dword [ebp - 0xa8c], eax
mov ecx, dword [ebp - 0xa68]
mov dx, word [ecx]
mov word [ebp - 0xa72], dx
add dword [ebp - 0xa68], 2
cmp word [ebp - 0xa72], 0
jne 0x1001e0fe
mov eax, dword [ebp - 0xa68]
sub eax, dword [ebp - 0xa8c]
sar eax, 1
mov dword [ebp - 0xa90], eax
mov ecx, dword [ebp - 0xa90]
movzx edx, word [ebp + ecx*2 - 0x532]
cmp edx, 0x5c
jne 0x1001e1cd
lea eax, [ebp - 0x530]
mov dword [ebp - 0xa6c], eax
mov ecx, dword [ebp - 0xa6c]
add ecx, 2
mov dword [ebp - 0xa94], ecx
mov edx, dword [ebp - 0xa6c]
mov ax, word [edx]
mov word [ebp - 0xa74], ax
add dword [ebp - 0xa6c], 2
cmp word [ebp - 0xa74], 0
jne 0x1001e165
mov ecx, dword [ebp - 0xa6c]
sub ecx, dword [ebp - 0xa94]
sar ecx, 1
mov dword [ebp - 0xa98], ecx
mov edx, dword [ebp - 0xa98]
lea eax, [edx + edx - 2]
mov dword [ebp - 0xa80], eax
cmp dword [ebp - 0xa80], 0x20a
jae 0x1001e1b8
jmp 0x1001e1bd
call fcn.100290e8
xor ecx, ecx
mov edx, dword [ebp - 0xa80]
mov word [ebp + edx - 0x530], cx
mov byte [ebp - 0x638], 0
push 0x104
push 0
lea eax, [ebp - 0x637]
push eax
call fcn.1002bb10
add esp, 0xc
push 0
push 0
push 0x104
lea ecx, [ebp - 0x638]
push ecx
push 0xffffffffffffffff
lea edx, [ebp - 0x530]
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push 0x10007490
lea eax, [ebp - 0x638]
push eax
push str.install_directory_:
mov ecx, 0x1005dfb8
call fcn.100074c0
mov ecx, eax
call fcn.100074c0
mov ecx, eax
call fcn.10003100
lea ecx, [ebp - 0x530]
push ecx
lea edx, [ebp - 0xa60]
push edx
call fcn.1001daf0
add esp, 8
mov dword [ebp - 4], 0
call fcn.1001daa0
test eax, eax
je 0x1001e42c
xor eax, eax
mov word [ebp - 0x844], ax
push 0x208
push 0
lea ecx, [ebp - 0x842]
push ecx
call fcn.1002bb10
add esp, 0xc
push 0x104
lea edx, [ebp - 0x844]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryW]
lea eax, [ebp - 0x844]
push eax
lea ecx, [ebp - 0x964]
call fcn.10004990
mov dword [ebp - 0xa9c], eax
mov ecx, dword [ebp - 0xa9c]
mov dword [ebp - 0xae0], ecx
mov byte [ebp - 4], 1
push 0x100560bc
mov edx, dword [ebp - 0xae0]
push edx
lea eax, [ebp - 0x97c]
push eax
call fcn.10021e70
add esp, 0xc
mov dword [ebp - 0xb4c], eax
mov ecx, dword [ebp - 0xb4c]
mov dword [ebp - 0xb48], ecx
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0xb48]
push edx
lea ecx, [ebp - 0xa60]
call fcn.1001f130
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x97c]
call fcn.10004940
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x964]
call fcn.10004940
lea eax, [ebp - 0x844]
push eax
lea ecx, [ebp - 0x934]
call fcn.10004990
mov dword [ebp - 0xb44], eax
mov ecx, dword [ebp - 0xb44]
mov dword [ebp - 0xb40], ecx
mov byte [ebp - 4], 3
push 0x100560d8
mov edx, dword [ebp - 0xb40]
push edx
lea eax, [ebp - 0x94c]
push eax
call fcn.10021e70
add esp, 0xc
mov dword [ebp - 0xb3c], eax
mov ecx, dword [ebp - 0xb3c]
mov dword [ebp - 0xb38], ecx
mov byte [ebp - 4], 4
mov edx, dword [ebp - 0xb38]
push edx
lea ecx, [ebp - 0xa60]
call fcn.1001f130
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x94c]
call fcn.10004940
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x934]
call fcn.10004940
lea eax, [ebp - 0x844]
push eax
lea ecx, [ebp - 0x904]
call fcn.10004990
mov dword [ebp - 0xb34], eax
mov ecx, dword [ebp - 0xb34]
mov dword [ebp - 0xb30], ecx
mov byte [ebp - 4], 5
push 0x10056120
mov edx, dword [ebp - 0xb30]
push edx
lea eax, [ebp - 0x91c]
push eax
call fcn.10021e70
add esp, 0xc
mov dword [ebp - 0xb2c], eax
mov ecx, dword [ebp - 0xb2c]
mov dword [ebp - 0xb28], ecx
mov byte [ebp - 4], 6
mov edx, dword [ebp - 0xb28]
push edx
lea ecx, [ebp - 0xa60]
call fcn.1001f130
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x91c]
call fcn.10004940
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x904]
call fcn.10004940
xor eax, eax
mov word [ebp - 0x21c], ax
push 0x208
push 0
lea ecx, [ebp - 0x21a]
push ecx
call fcn.1002bb10
add esp, 0xc
push 0x104
lea edx, [ebp - 0x21c]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x8ec]
call fcn.10004990
mov dword [ebp - 0xb20], eax
mov ecx, dword [ebp - 0xb20]
mov dword [ebp - 0xb1c], ecx
mov byte [ebp - 4], 7
push str._sgephook.dll
mov edx, dword [ebp - 0xb1c]
push edx
lea eax, [ebp - 0x9ac]
push eax
call fcn.10021e70
add esp, 0xc
mov dword [ebp - 0xb18], eax
mov ecx, dword [ebp - 0xb18]
mov dword [ebp - 0xb14], ecx
mov byte [ebp - 4], 8
mov edx, dword [ebp - 0xb14]
push edx
lea ecx, [ebp - 0xa60]
call fcn.1001f130
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x9ac]
call fcn.10004940
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x8ec]
call fcn.10004940
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x8bc]
call fcn.10004990
mov dword [ebp - 0xb10], eax
mov ecx, dword [ebp - 0xb10]
mov dword [ebp - 0xb0c], ecx
mov byte [ebp - 4], 9
push str._sgephook_signed.dll
mov edx, dword [ebp - 0xb0c]
push edx
lea eax, [ebp - 0x8d4]
push eax
call fcn.10021e70
add esp, 0xc
mov dword [ebp - 0xb08], eax
mov ecx, dword [ebp - 0xb08]
mov dword [ebp - 0xb04], ecx
mov byte [ebp - 4], 0xa
mov edx, dword [ebp - 0xb04]
push edx
lea ecx, [ebp - 0xa60]
call fcn.1001f130
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x8d4]
call fcn.10004940
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x8bc]
call fcn.10004940
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x88c]
call fcn.10004990
mov dword [ebp - 0xb00], eax
mov ecx, dword [ebp - 0xb00]
mov dword [ebp - 0xafc], ecx
mov byte [ebp - 4], 0xb
push str.EndpointAppDataBaseConfig.json
mov edx, dword [ebp - 0xafc]
push edx
lea eax, [ebp - 0x8a4]
push eax
call fcn.10021e70
add esp, 0xc
mov dword [ebp - 0xaf8], eax
mov ecx, dword [ebp - 0xaf8]
mov dword [ebp - 0xaf4], ecx
mov byte [ebp - 4], 0xc
mov edx, dword [ebp - 0xaf4]
push edx
lea ecx, [ebp - 0xa60]
call fcn.1001f130
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x8a4]
call fcn.10004940
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x88c]
call fcn.10004940
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x85c]
call fcn.10004990
mov dword [ebp - 0xaf0], eax
mov ecx, dword [ebp - 0xaf0]
mov dword [ebp - 0xaec], ecx
mov byte [ebp - 4], 0xd
push str.drivers_sgepsp.sys
mov edx, dword [ebp - 0xaec]
push edx
lea eax, [ebp - 0x874]
push eax
call fcn.10021e70
add esp, 0xc
mov dword [ebp - 0xae8], eax
mov ecx, dword [ebp - 0xae8]
mov dword [ebp - 0xae4], ecx
mov byte [ebp - 4], 0xe
mov edx, dword [ebp - 0xae4]
push edx
lea ecx, [ebp - 0xa60]
call fcn.1001f130
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x874]
call fcn.10004940
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x85c]
call fcn.10004940
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x994]
call fcn.10004990
mov dword [ebp - 0xb24], eax
mov ecx, dword [ebp - 0xb24]
mov dword [ebp - 0xaa0], ecx
mov byte [ebp - 4], 0xf
push str.drivers_sgepkso.sys
mov edx, dword [ebp - 0xaa0]
push edx
lea eax, [ebp - 0xa54]
push eax
call fcn.10021e70
add esp, 0xc
mov dword [ebp - 0xaa4], eax
mov ecx, dword [ebp - 0xaa4]
mov dword [ebp - 0xaa8], ecx
mov byte [ebp - 4], 0x10
mov edx, dword [ebp - 0xaa8]
push edx
lea ecx, [ebp - 0xa60]
call fcn.1001f130
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0xa54]
call fcn.10004940
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x994]
call fcn.10004940
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0xa24]
call fcn.10004990
mov dword [ebp - 0xaac], eax
mov ecx, dword [ebp - 0xaac]
mov dword [ebp - 0xab0], ecx
mov byte [ebp - 4], 0x11
push str.drivers_sgepcdflt.sys
mov edx, dword [ebp - 0xab0]
push edx
lea eax, [ebp - 0xa3c]
push eax
call fcn.10021e70
add esp, 0xc
mov dword [ebp - 0xab4], eax
mov ecx, dword [ebp - 0xab4]
mov dword [ebp - 0xab8], ecx
mov byte [ebp - 4], 0x12
mov edx, dword [ebp - 0xab8]
push edx
lea ecx, [ebp - 0xa60]
call fcn.1001f130
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0xa3c]
call fcn.10004940
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xa24]
call fcn.10004940
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x9f4]
call fcn.10004990
mov dword [ebp - 0xabc], eax
mov ecx, dword [ebp - 0xabc]
mov dword [ebp - 0xac0], ecx
mov byte [ebp - 4], 0x13
push str.drivers_sgeptproxy.sys
mov edx, dword [ebp - 0xac0]
push edx
lea eax, [ebp - 0xa0c]
push eax
call fcn.10021e70
add esp, 0xc
mov dword [ebp - 0xac4], eax
mov ecx, dword [ebp - 0xac4]
mov dword [ebp - 0xac8], ecx
mov byte [ebp - 4], 0x14
mov edx, dword [ebp - 0xac8]
push edx
lea ecx, [ebp - 0xa60]
call fcn.1001f130
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0xa0c]
call fcn.10004940
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x9f4]
call fcn.10004940
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x9c4]
call fcn.10004990
mov dword [ebp - 0xacc], eax
mov ecx, dword [ebp - 0xacc]
mov dword [ebp - 0xad0], ecx
mov byte [ebp - 4], 0x15
push str.drivers_sgepfsfilter.sys
mov edx, dword [ebp - 0xad0]
push edx
lea eax, [ebp - 0x9dc]
push eax
call fcn.10021e70
add esp, 0xc
mov dword [ebp - 0xad4], eax
mov ecx, dword [ebp - 0xad4]
mov dword [ebp - 0xad8], ecx
mov byte [ebp - 4], 0x16
mov edx, dword [ebp - 0xad8]
push edx
lea ecx, [ebp - 0xa60]
call fcn.1001f130
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x9dc]
call fcn.10004940
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x9c4]
call fcn.10004940
mov byte [ebp - 0xa55], 1
lea eax, [ebp - 0xa60]
mov dword [ebp - 0xa88], eax
lea ecx, [ebp - 0xa7c]
push ecx
mov ecx, dword [ebp - 0xa88]
call fcn.1001f070
lea edx, [ebp - 0xadc]
push edx
mov ecx, dword [ebp - 0xa88]
call fcn.1001f010
jmp 0x1001e8e9
lea ecx, [ebp - 0xa7c]
call fcn.1001ef70
lea eax, [ebp - 0xadc]
push eax
lea ecx, [ebp - 0xa7c]
call fcn.100104d0
movzx ecx, al
test ecx, ecx
je 0x1001e9d7
lea ecx, [ebp - 0xa7c]
call fcn.1001ef90
mov dword [ebp - 0xa84], eax
mov byte [ebp - 0x324], 0
push 0x104
push 0
lea edx, [ebp - 0x323]
push edx
call fcn.1002bb10
add esp, 0xc
push 0
push 0
push 0x104
lea eax, [ebp - 0x324]
push eax
push 0xffffffffffffffff
mov ecx, dword [ebp - 0xa84]
call fcn.10004900
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ecx, dword [ebp - 0xa84]
call fcn.10004900
push eax
call fcn.1001df50
add esp, 4
movzx ecx, al
test ecx, ecx
jne 0x1001e9a9
mov byte [ebp - 0xa55], 0
push 0x10007490
lea edx, [ebp - 0x324]
push edx
push str.failed_to_remove
mov ecx, 0x1005dfb8
call fcn.100074c0
mov ecx, eax
call fcn.100074c0
mov ecx, eax
call fcn.10003100
jmp 0x1001e9d2
push 0x10007490
push str._has_been_removed
lea eax, [ebp - 0x324]
push eax
mov ecx, 0x1005dfb8
call fcn.100074c0
mov ecx, eax
call fcn.100074c0
mov ecx, eax
call fcn.10003100
jmp 0x1001e8de
mov cl, byte [ebp - 0xa55]
mov byte [ebp - 0xa56], cl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa60]
call fcn.1001f0e0
mov al, byte [ebp - 0xa56]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100288d1
mov esp, ebp
pop ebp
ret