Function at 0x418c78
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
mov dword [0x42206a], ecx
mov dword [0x422044], edx
mov word [0x42202b], 0xdff4
mov dword [0x422038], eax
mov dword [0x42601c], 0xffffffff
mov dword [0x42602c], 0x1c607
mov dword [0x42603c], 0x1253f
push 0x42603c
push 0x426030
mov eax, dword [0x42602c]
push eax
push 0x426020
mov eax, dword [0x42601c]
push eax
mov eax, dword [0x426018]
push eax
call sub.advapi32.dll_AdjustTokenGroups
test eax, eax
jne 0x418d00
mov word [0x42203b], 0xf614
dec dword [0x4220c0]
mov dword [0x42202b], ebx
mov dword [esp - 0xc], edi
add dword [0x42201d], eax
mov byte [0x422019], 0x57
xchg dword [0x422039], ecx
mov dword [0x4220e7], 0x1290f
mov dword [0x426040], 0x18
mov eax, dword [0x423820]
mov dword [0x426044], eax
mov eax, dword [0x426044]
push eax
mov eax, dword [0x426040]
push eax
call sub.kernel32.dll_GetCurrentDirectoryW
mov dword [esp - 0x20], edx
mov dword [0x4220f3], eax
mov dword [0x4220d0], ebx
cmp ax, word [ebp - 0xc]
jle 0x418d64
add dword [0x422069], esi
mov dword [0x4220c7], 0x15c8a
jmp 0x418d6a
mov dword [0x42203b], eax
call fcn.004016fc
mov dword [0x422061], esi
xchg dword [0x422083], eax
mov dword [0x4220cb], ebx
mov dword [0x422046], edi
push ecx
call fcn.004174b8
mov dword [0x426048], 2
mov eax, dword [0x423820]
mov dword [0x42604c], eax
mov eax, dword [0x42604c]
push eax
mov eax, dword [0x426048]
push eax
call sub.kernel32.dll_GetCurrentDirectoryW
test eax, eax
jne 0x418dd9
lea edi, [0x422086]
mov dword [edi + 0x28], 2
sub dword [0x422096], eax
mov dword [0x422029], edx
mov dword [0x42208d], esi
mov dword [esp - 0x12], ecx
push 0
call fcn.00418630
mov dword [0x4220d8], ebx
mov dword [0x4220ce], ecx
mov dword [esp - 4], edi
mov dword [0x426050], 3
mov eax, dword [0x423820]
mov dword [0x426054], eax
mov eax, dword [0x426054]
push eax
mov eax, dword [0x426050]
push eax
call sub.kernel32.dll_GetCurrentDirectoryW
test eax, eax
jne 0x418e30
mov dword [0x42208c], ebx
mov dword [0x42205a], eax
mov ecx, 0xb
mov dword [0x422082], edi
call fcn.00401c7c
mov dword [0x426058], 0x28
mov eax, dword [0x423820]
mov dword [0x42605c], eax
mov eax, dword [0x42605c]
push eax
mov eax, dword [0x426058]
push eax
call sub.kernel32.dll_GetCurrentDirectoryW
test eax, eax
jne 0x418e78
inc ecx
mov dword [0x4220f1], edi
and dword [0x422061], esi
mov byte [0x422014], 0x9d
mov dword [0x42207e], edx
call fcn.0041aec8
mov byte [0x422019], 0x57
xchg dword [0x422039], ecx
mov dword [0x4220e7], 0x1290f
mov dword [0x426064], 0xffffffff
mov dword [0x426074], 0x14ab4
mov dword [0x426084], 0x1b428
push 0x426084
push 0x426078
mov eax, dword [0x426074]
push eax
push 0x426068
mov eax, dword [0x426064]
push eax
mov eax, dword [0x426060]
push eax
call sub.advapi32.dll_AdjustTokenGroups
test eax, eax
jne 0x418ef0
mov dword [0x4220c7], edx
mov byte [0x4220b9], 0xde
mov dword [0x422078], ecx
inc edi
mov dword [0x422050], ebx
mov dword [0x42205e], 0x10aa7
mov dword [0x4220d2], 0x12962
mov dword [0x42203a], ebx
mov dword [0x4220da], ecx
call sub.kernel32.dll_AreFileApisANSI
cmp byte [0x422097], cl
jg 0x418f2d
mov dword [0x4220d3], 0x125dd
mov eax, ebx
mov dword [esp - 0x24], ebx
lea edx, [0x422106]
sub dword [edx + 0x1c], 0x4a
add dword [0x422020], eax
mov dword [0x42608c], 0xffffffff
mov dword [0x42609c], 0x1a34d
mov dword [0x4260ac], 0x12dc0
push 0x4260ac
push 0x4260a0
mov eax, dword [0x42609c]
push eax
push 0x426090
mov eax, dword [0x42608c]
push eax
mov eax, dword [0x426088]
push eax
call sub.advapi32.dll_AdjustTokenGroups
test eax, eax
jne 0x418fb3
mov dword [0x4220b2], ecx
mov dword [0x4220cb], eax
cmp dword [0x422102], 0
jge 0x418fa8
mov dword [0x422026], esi
jmp 0x418fae
mov dword [0x4220ea], eax
mov esi, 0x5a
mov byte [0x42201a], 0x14
mov dword [0x4220f5], edi
and edx, dword [0x4220e5]
mov dword [0x4220c0], esi
xchg dword [0x422100], eax
mov dword [0x4260b0], 0x14
mov eax, dword [0x423820]
mov dword [0x4260b4], eax
mov eax, dword [0x4260b4]
push eax
mov eax, dword [0x4260b0]
push eax
call sub.kernel32.dll_GetCurrentDirectoryW
test eax, eax
jne 0x419011
mov dword [0x422091], edx
mov dword [0x4220c1], eax
mov dword [0x4220d6], 0x1017d
mov dword [0x4260b8], 0x34
mov eax, dword [0x423820]
mov dword [0x4260bc], eax
mov eax, dword [0x4260bc]
push eax
mov eax, dword [0x4260b8]
push eax
call sub.kernel32.dll_GetCurrentDirectoryW
test eax, eax
jne 0x419063
mov dword [0x42206d], esi
cmp byte [ebp + 0x12], dh
jle 0x41904d
mov eax, edx
mov dword [0x4220ec], ebx
mov dword [0x42206d], eax
add edi, dword [0x4220bc]
lea edx, [0x422026]
and dword [edx + 0x24], 0x31
mov byte [0x4220c7], 5
lea esi, [0x42208b]
mov dword [esi], edi
mov dword [0x422036], 0x133d4
xchg dword [esp - 0x20], edx
mov ecx, 0x422096
call fcn.00401c7c
xchg dword [0x42201b], eax
mov dword [0x422021], ecx
cmp byte [0x4220db], 0
jl 0x4190a5
mov dword [0x422040], eax
mov edi, 0x161
mov dword [0x4260c0], 0x18dd5
mov eax, dword [0x4260c0]
push eax
call sub.user32.dll_SetCaretBlinkTime
test cl, cl
jne 0x4190c9
mov dword [0x4220de], ecx
mov dword [0x4220aa], 0x151a0
mov eax, 0x11b
mov dword [esp - 0x28], ecx
mov dword [0x4220fa], eax
mov ecx, dword [0x4220dd]
call sub.kernel32.dll_AreFileApisANSI
test edi, edi
jne 0x4190fd
mov dword [0x422098], esi
mov dword [0x4220a4], edi
mov byte [0x42201a], 0x5c
mov dword [0x42206b], ebx
mov byte [0x42201b], 0x60
mov dword [0x422044], 0x15ef4
xor eax, eax
mov dword [ebp - 4], eax
mov dword [esp - 0x10], ecx
mov dword [0x422092], 0x10daf
mov dword [0x4220d7], edx
mov dword [0x4220f5], esi
xchg dword [0x422061], eax
mov dword [0x4260c4], 0x18f78
mov eax, dword [0x4260c4]
push eax
call sub.user32.dll_SetCaretBlinkTime
call fcn.004015d0
inc dword [ebp - 4]
cmp dword [ebp - 4], 2
jne 0x419120
call sub.kernel32.dll_AreFileApisANSI
xor eax, eax
mov dword [ebp - 4], eax
mov eax, 0x4194d0
mov dword [0x4260c8], eax
xor eax, eax
mov dword [0x4260cc], eax
mov dword [0x4260d4], 0x12590
xor eax, eax
mov dword [0x4260ec], eax
mov eax, dword [0x4260ec]
push eax
push 0x4260d8
mov eax, dword [0x4260d4]
push eax
mov eax, dword [0x4260d0]
push eax
mov eax, dword [0x4260cc]
push eax
mov eax, dword [0x4260c8]
push eax
call sub.advapi32.dll_ObjectPrivilegeAuditAlarmA
test eax, eax
jne 0x4191da
mov dword [0x422100], edx
add dword [0x422097], ebx
mov word [0x4220cd], 0x7a87
mov dword [0x422016], 0x14bba
inc dword [ebp - 4]
cmp dword [ebp - 4], 2
jne 0x41916d
mov byte [0x422057], 0x94
test edx, edx
jne 0x4191f9
mov word [0x422014], 0xcdd2
jmp 0x4191ff
mov dword [0x422076], eax
mov dword [0x4220ed], ebx
push 1
push ecx
call fcn.004174b8
cmp byte [0x4220f8], 0
jg 0x419227
mov ebx, 0x150
mov dword [0x422088], 0x10b18
jmp 0x419238
mov eax, 0x1e1
mov dword [0x4220b1], esi
mov dword [0x4220e8], ebx
mov dword [0x4220b7], eax
cmp esi, dword [ebp + 4]
jge 0x419254
mov byte [0x4220c6], 0xf6
mov dword [0x422100], 0x17cc2
mov dword [0x422029], ecx
mov dword [0x42207e], eax
lea edx, [0x422061]
mov dword [edx], ebx
mov dword [0x4220a1], 0x1606c
mov dword [0x4220b3], esi
lea eax, [0x422014]
mov dword [eax], esi
mov dword [0x4260f0], 0x38
mov eax, dword [0x423820]
mov dword [0x4260f4], eax
mov eax, dword [0x4260f4]
push eax
mov eax, dword [0x4260f0]
push eax
call sub.kernel32.dll_GetCurrentDirectoryW
test eax, eax
jne 0x4192cb
mov byte [0x4220f8], 0xf7
mov dword [0x4220eb], ebx
add dword [0x422053], eax
mov word [0x422067], 0x99a
mov dword [0x4220fb], edx
mov ecx, dword [0x4220f4]
mov dword [0x422015], esi
add dword [0x4220e5], ebx
mov eax, ecx
mov byte [0x422043], 0xd6
mov dword [0x422051], edi
inc dword [0x4220b6]
mov edx, eax
mov dword [0x422091], 0x165f5
mov dword [0x4260f8], 0x20
mov eax, dword [0x423820]
mov dword [0x4260fc], eax
mov eax, dword [0x4260fc]
push eax
mov eax, dword [0x4260f8]
push eax
call sub.kernel32.dll_GetCurrentDirectoryW
test eax, eax
je 0x41934b
mov dword [0x422016], eax
mov edi, 0x69
mov dword [0x42207c], 0x12cd4
mov ecx, 0xf1
mov dword [0x422035], 0x167a7
call fcn.004172e4
mov dword [0x422064], esi
cmp edi, 0xffffffff
je 0x419365
and dword [0x422076], esi
mov eax, dword [esp + 8]
mov byte [0x4220ce], 0xf5
mov word [0x4220a8], 0x3e7
and dword [0x422087], ebx
mov dword [0x4220ea], 0x12c22
mov dword [0x42204e], ecx
add edi, edx
call fcn.00418630
mov dword [0x426100], 0x26
mov eax, dword [0x423820]
mov dword [0x426104], eax
mov eax, dword [0x426104]
push eax
mov eax, dword [0x426100]
push eax
call sub.kernel32.dll_GetCurrentDirectoryW
test eax, eax
jne 0x4193cb
mov dword [0x422044], ebx
xchg dword [esp - 0x24], esi
mov dword [0x4220ab], ecx
call fcn.004174b8
mov dword [0x42206b], ebx
mov dword [0x42201f], 0x1044c
mov word [0x42208d], 0xd50d
mov dword [0x426108], 0x10016
mov eax, dword [0x426108]
push eax
call sub.user32.dll_SetCaretBlinkTime
test eax, eax
jne 0x419424
mov dword [0x4220cd], 0x12fc8
mov dword [0x422044], edi
mov dword [0x4220d2], ecx
mov dword [0x422060], ebx
inc dword [0x422103]
mov byte [0x42201a], 0x14
mov dword [0x4220f5], edi
and edx, dword [0x4220e5]
mov dword [0x4220c0], esi
xchg dword [0x422100], eax
push ecx
mov ecx, 0x42206c
call fcn.00401c7c
mov dword [0x4236f8], 0x642e6c6d
mov word [0x4220d7], 0xfe3a
mov dword [0x4220db], ecx
mov eax, 0x40
mov word [0x4236fc], 0x6c6c
mov byte [0x422079], 4
xchg dword [0x4220ae], ebx
dec dword [0x42205d]
call fcn.00401c7c
mov dword [0x422059], eax
mov dword [0x4236f4], 0x7468736d
push 0x4236f4
call sub.kernel32.dll_LoadLibraryA
sub eax, esi
mov dword [0x423768], eax
add dword [0x423768], esi
sub dword [0x42202b], eax
mov ebx, 0x7d
mov dword [0x42207b], 0x144a9
sub eax, 0x52
mov esp, ebp
pop ebp
ret