Function at 0x1006efcc
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov ebx, ecx
push 0x3f
pop edx
push 0x5c
mov esi, dword [ebx + 0xf4]
pop edi
mov dword [ebp - 4], edi
movzx eax, word [esi]
mov ecx, eax
cmp ax, di
jne 0x1006f12f
cmp word [esi + 2], di
jne 0x1006f1ca
cmp word [esi + 4], dx
jne 0x1006f0dd
cmp word [esi + 6], di
je 0x1006f128
cmp word [esi + 2], di
jne 0x1006f1ca
lea ecx, [esi + 4]
movzx eax, word [ecx]
cmp ax, di
je 0x1006f1ca
mov edx, eax
test dx, dx
je 0x1006f128
add ecx, 2
movzx eax, word [ecx]
mov edx, eax
cmp ax, di
jne 0x1006f02e
add ecx, 2
push 0x5c
pop edx
mov edi, ecx
movzx eax, word [ecx]
cmp ax, dx
je 0x1006f128
mov edx, eax
test dx, dx
je 0x1006f128
add ecx, 2
movzx eax, word [ecx]
mov edx, eax
cmp ax, word [ebp - 4]
jne 0x1006f05a
cmp ecx, edi
je 0x1006f128
push esi
call dword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__wcsdup]
mov dword [ebp - 4], eax
pop ecx
test eax, eax
je 0x1006f201
mov edx, eax
xor edi, edi
lea ecx, [edx + 2]
mov ax, word [edx]
add edx, 2
cmp ax, di
jne 0x1006f093
sub edx, ecx
lea esi, [ebx + 0xf8]
sar edx, 1
mov ecx, esi
lea edx, [edx*2 + 0x12]
call fcn.10064c43
mov eax, dword [esi]
mov edx, 0x100209a4
push 8
mov ecx, esi
mov dword [ebx + 0xf4], eax
mov dword [ebx + 0xfc], edi
call fcn.10064cec
mov edi, dword [ebp - 4]
lea edx, [edi + 4]
jmp 0x1006f1b1
cmp word [esi + 4], 0x2e
jne 0x1006f013
cmp word [esi + 6], di
jne 0x1006f013
movzx eax, word [esi + 8]
mov ecx, eax
cmp eax, 0x61
jb 0x1006f102
cmp eax, 0x7a
jbe 0x1006f10f
lea eax, [ecx - 0x41]
cmp ax, 0x19
ja 0x1006f013
cmp word [esi + 0xa], 0x3a
jne 0x1006f013
cmp word [esi + 0xc], di
jne 0x1006f013
mov word [esi + 4], dx
xor eax, eax
jmp 0x1006f204
cmp eax, 0x61
jb 0x1006f139
cmp eax, 0x7a
jbe 0x1006f146
lea eax, [ecx - 0x41]
cmp ax, 0x19
ja 0x1006f1ca
cmp word [esi + 2], 0x3a
jne 0x1006f1ca
cmp word [esi + 4], di
jne 0x1006f1ca
push esi
call dword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__wcsdup]
mov dword [ebp - 4], eax
pop ecx
test eax, eax
je 0x1006f201
mov edx, eax
xor edi, edi
lea ecx, [edx + 2]
mov ax, word [edx]
add edx, 2
cmp ax, di
jne 0x1006f16d
sub edx, ecx
lea esi, [ebx + 0xf8]
sar edx, 1
mov ecx, esi
lea edx, [edx*2 + 0xa]
call fcn.10064c43
mov eax, dword [esi]
mov edx, 0x1001fc30
push 4
mov ecx, esi
mov dword [ebx + 0xf4], eax
mov dword [ebx + 0xfc], edi
call fcn.10064cec
mov edi, dword [ebp - 4]
mov edx, edi
push 0x1000000
mov ecx, esi
call fcn.10064cec
push edi
call dword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o_free]
pop ecx
jmp 0x1006f128
xor eax, eax
push eax
push eax
call dword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_GetCurrentDirectoryW]
mov dword [ebp - 4], eax
test eax, eax
je 0x1006f201
lea ecx, [eax + eax]
push ecx
call dword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o_malloc]
pop ecx
mov edi, eax
push edi
push dword [ebp - 4]
call dword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_GetCurrentDirectoryW]
mov dword [ebp - 4], eax
test eax, eax
jne 0x1006f209
push edi
call dword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o_free]
pop ecx
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
push 0x5c
pop eax
push esi
cmp word [esi], ax
jne 0x1006f29b
call dword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__wcsdup]
mov dword [ebp - 4], eax
pop ecx
test eax, eax
je 0x1006f201
mov edx, eax
xor ecx, ecx
lea esi, [edx + 2]
mov ax, word [edx]
add edx, 2
cmp ax, cx
jne 0x1006f22b
sub edx, esi
lea esi, [ebx + 0xf8]
sar edx, 1
mov ecx, esi
lea edx, [edx*2 + 0xe]
call fcn.10064c43
mov eax, dword [esi]
mov edx, 0x1001fc30
and dword [ebx + 0xfc], 0
mov ecx, esi
push 4
mov dword [ebx + 0xf4], eax
call fcn.10064cec
push 2
mov edx, edi
mov ecx, esi
call fcn.10064cec
mov ebx, dword [ebp - 4]
mov ecx, esi
push 0x1000000
mov edx, ebx
call fcn.10064cec
push edi
call dword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o_free]
push ebx
call dword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o_free]
pop ecx
jmp 0x1006f1c4
call dword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__wcsdup]
mov dword [ebp - 8], eax
pop ecx
test eax, eax
je 0x1006f201
mov ecx, eax
xor esi, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0x1006f2b4
mov eax, dword [ebp - 4]
sub ecx, edx
sar ecx, 1
add eax, ecx
lea ecx, [ebx + 0xf8]
lea edx, [eax*2 + 0xc]
call fcn.10064c43
mov eax, dword [ebx + 0xf8]
mov dword [ebx + 0xf4], eax
mov eax, dword [ebp - 4]
cmp eax, 3
jbe 0x1006f313
push 0x5c
pop ecx
cmp word [edi], cx
jne 0x1006f34f
cmp word [edi + 2], cx
jne 0x1006f31b
push 0x3f
pop edx
cmp word [edi + 4], dx
jne 0x1006f31b
cmp word [edi + 6], cx
jne 0x1006f31b
mov dword [ebx + 0xfc], esi
jmp 0x1006f36a
cmp eax, 2
jbe 0x1006f34f
push 0x5c
pop ecx
cmp word [edi], cx
jne 0x1006f34f
cmp word [edi + 2], cx
jne 0x1006f34f
cmp word [edi + 4], cx
je 0x1006f34f
push 8
lea ecx, [ebx + 0xf8]
mov dword [ebx + 0xfc], esi
mov edx, 0x100209a4
call fcn.10064cec
mov eax, dword [ebp - 4]
lea edx, [edi + 4]
add eax, 0xfffffffe
jmp 0x1006f36c
push 4
lea ecx, [ebx + 0xf8]
mov dword [ebx + 0xfc], esi
mov edx, 0x1001fc30
call fcn.10064cec
mov eax, dword [ebp - 4]
mov edx, edi
push eax
lea ecx, [ebx + 0xf8]
call fcn.10064cec
push 1
lea ecx, [ebx + 0xf8]
mov edx, 0x100209b8
call fcn.10064cec
mov esi, dword [ebp - 8]
lea ecx, [ebx + 0xf8]
push 0x1000000
mov edx, esi
call fcn.10064cec
mov eax, dword [ebx + 0xf8]
push edi
mov dword [ebx + 0xf4], eax
call dword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o_free]
push esi
jmp 0x1006f28f