Function at 0x49065a
Capabilities:
Get common file path

Disassembly:
push 0x14c
mov eax, 0x4cec8c
call fcn.0049a06f
mov esi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x14c], ebx
mov dword [ebp - 0xf4], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0xf0], ebx
mov dword [ebp - 0xec], ebx
mov dword [ebp - 0xe8], ebx
mov dword [ebp - 0xf8], ebx
mov edi, dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
lea eax, [ebp - 0xf4]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 1
lea eax, [ebp - 0x20]
mov byte [ebp - 4], 4
push eax
mov dword [ebp - 0x20], ebx
mov word [ebp - 0x1c], 0x100
mov dword [ebp - 0x18], ebx
mov word [ebp - 0x14], 0x500
call edi
test eax, eax
jne 0x4906e9
push 1
lea eax, [ebp - 0xe1]
mov ecx, esi
push eax
push 0x4d7438
call fcn.004043b0
push 0x14
push ebx
jmp 0x490977
lea eax, [ebp - 0xf0]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea eax, [ebp - 0x18]
push eax
call edi
test eax, eax
je 0x4906cc
lea eax, [ebp - 0xec]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x221
push 0x20
push 2
lea eax, [ebp - 0x18]
push eax
call edi
test eax, eax
je 0x4906cc
push 0x40
lea eax, [ebp - 0x148]
push ebx
push eax
call fcn.0049b6a0
mov eax, dword [ebp - 0xec]
add esp, 0xc
mov dword [ebp - 0x12c], eax
xor edx, edx
mov eax, dword [ebp - 0xf0]
inc edx
mov dword [ebp - 0x10c], eax
lea eax, [ebp - 0xe8]
push 3
pop ecx
push 2
mov dword [ebp - 0x140], ecx
mov dword [ebp - 0x120], ecx
pop ecx
push eax
push ebx
lea eax, [ebp - 0x148]
mov dword [ebp - 0x148], 0x1200a9
push eax
push ecx
mov dword [ebp - 0x144], edx
mov dword [ebp - 0x13c], ebx
mov dword [ebp - 0x138], ebx
mov dword [ebp - 0x134], ebx
mov dword [ebp - 0x130], 5
mov dword [ebp - 0x128], 0x1f01ff
mov dword [ebp - 0x124], edx
mov dword [ebp - 0x11c], ebx
mov dword [ebp - 0x118], ebx
mov dword [ebp - 0x114], ebx
mov dword [ebp - 0x110], ecx
call dword [sym.imp.ADVAPI32.dll_SetEntriesInAclW]
test eax, eax
jne 0x4906cc
push 0x14
call fcn.004996e0
mov edi, eax
pop ecx
test edi, edi
je 0x4907f2
push 0x14
push ebx
call fcn.00499db8
pop ecx
pop ecx
mov dword [ebp - 0xf8], edi
push 1
test edi, edi
je 0x4906ce
push edi
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
test eax, eax
jne 0x490827
lea eax, [ebp - 0xe1]
push 1
push eax
push 0x4d7438
mov ecx, esi
call fcn.004043b0
jmp 0x490974
push ebx
push dword [ebp - 0xe8]
push 1
push edi
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
test eax, eax
lea eax, [ebp - 0xe1]
je 0x490813
push ebx
push eax
lea ecx, [ebp - 0x50]
mov dword [ebp - 0x108], 0xc
mov dword [ebp - 0x104], edi
mov dword [ebp - 0x100], ebx
mov dword [ebp - 0x50], 0x4dd804
mov dword [ebp - 0x28], 0x4dcac4
call fcn.00404c20
mov ebx, 0x104
mov byte [ebp - 4], 5
push ebx
lea eax, [ebp - 0x158]
push eax
lea ecx, [ebp - 0x50]
call fcn.00409e80
mov ecx, dword [eax]
mov byte [ebp - 4], 6
mov byte [eax + 4], 1
call fcn.00404040
push dword [eax]
push ebx
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea ecx, [ebp - 0x158]
mov byte [ebp - 4], 5
call fcn.00409da0
lea eax, [ebp - 0xe0]
push eax
call fcn.0049052c
push eax
lea eax, [ebp - 0xb0]
mov byte [ebp - 4], 7
push 0x4d2880
push eax
call fcn.0040c530
push 0x4d283c
push eax
lea eax, [ebp - 0x80]
mov byte [ebp - 4], 8
push eax
call fcn.0040c740
add esp, 0x1c
push eax
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 9
call fcn.00403510
lea ecx, [ebp - 0x80]
call fcn.00404db0
lea ecx, [ebp - 0xb0]
call fcn.00404db0
lea ecx, [ebp - 0xe0]
mov byte [ebp - 4], 5
call fcn.00404db0
lea eax, [ebp - 0x108]
push eax
sub esp, 0x30
lea eax, [ebp - 0x50]
mov ecx, esp
mov dword [ebp - 0xfc], ecx
push 0
push eax
mov dword [ecx], 0x4dd804
mov dword [ecx + 0x28], 0x4dcac4
call fcn.00407160
call fcn.0048ea93
add esp, 0x34
test eax, eax
jne 0x490963
push 1
lea eax, [ebp - 0xe1]
mov ecx, esi
push eax
push 0x4d7438
call fcn.004043b0
jmp 0x49096c
push esi
lea ecx, [ebp - 0x50]
call fcn.004092a0
lea ecx, [ebp - 0x50]
call fcn.00404db0
push 0x14
push edi
call fcn.00499db8
pop ecx
pop ecx
lea ecx, [ebp - 0xe8]
call fcn.0048e4c7
lea ecx, [ebp - 0xec]
call fcn.0048e4e1
lea ecx, [ebp - 0xf0]
call fcn.0048e4e1
lea ecx, [ebp - 0xf4]
call fcn.0048e4e1
mov eax, esi
call fcn.0049a019
ret