Function at 0x977830
Capabilities:
Get common file path
Query environment variable

Disassembly:
push ebp
lea ebp, [esp - 0xe1c]
sub esp, 0xe1c
push 0xfffffffffffffffe
push 0xb137a0
push 0xa847a0
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0xb196ec]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp + 0xe18], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov esi, ecx
mov dword [ebp - 0x20], esi
xor edi, edi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x30], edi
mov byte [ebp + 0xa08], 0
push 0x103
push edi
lea eax, [ebp + 0xa09]
push eax
call fcn.00a7ffb0
mov byte [ebp + 0x800], 0
push 0x103
push edi
lea ecx, [ebp + 0x801]
push ecx
call fcn.00a7ffb0
add esp, 0x18
xor ebx, ebx
mov dword [ebp - 0x24], ebx
cmp esi, edi
jne 0x9778d0
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
jmp 0x97812b
mov al, 0x25
mov edx, esi
call fcn.00975920
mov edx, 1
cmp byte [esi], 0x22
jne 0x9778e8
mov dword [ebp - 0x24], edx
mov ebx, edx
cmp eax, edi
jbe 0x9778f0
test dl, al
je 0x97791a
mov cl, byte [esi + ebx]
cmp cl, 0x5c
jne 0x977904
mov al, byte [esi + ebx + 1]
cmp al, 0x73
je 0x97791a
cmp al, 0x53
je 0x97791a
cmp cl, 0x73
je 0x97790e
cmp cl, 0x53
jne 0x9778c2
mov al, byte [esi + ebx + 1]
cmp al, 0x79
je 0x97791a
cmp al, 0x59
jne 0x9778c2
mov dword [ebp - 0x30], edx
cmp dword [0xbfeb1c], edx
jne 0x9779c5
cmp byte [0xbfea18], 0
je 0x9779c5
cmp dword [ebp + 0xe24], edi
je 0x9779c5
mov byte [ebp + 0xc10], 0
push 0x103
push edi
lea edx, [ebp + 0xc11]
push edx
call fcn.00a7ffb0
add esp, 0xc
mov dword [ebp - 0x28], 0x104
lea ecx, [ebp - 0x28]
lea edx, [ebp + 0xc10]
call fcn.00951c00
test eax, eax
je 0x9779c5
mov eax, dword [ebp - 0x28]
mov byte [ebp + eax + 0xc10], 0
lea edi, [ebp + 0xc10]
call fcn.00979080
mov eax, 0xbfea18
mov ecx, edi
call fcn.0094c330
test eax, eax
je 0x9779c5
mov dword [0xbfeb1c], 0
push 0x104
push 0
push 0xbfea18
call fcn.00a7ffb0
add esp, 0xc
mov dword [0xb4c87c], 0x104
cmp dword [0xbfeb1c], 0
jne 0x977c43
mov byte [ebp + 0xd14], 0
push 0x103
push 0
lea ecx, [ebp + 0xd15]
push ecx
call fcn.00a7ffb0
add esp, 0xc
mov ecx, 0xb4c87c
mov edx, 0xbfea18
call fcn.00951c00
test eax, eax
je 0x977a19
mov edx, dword [0xb4c87c]
mov byte [edx + 0xbfea18], 0
mov edi, 0xbfea18
call fcn.00979080
mov eax, 0xc002d8
call fcn.00954170
push 0x104
lea ebx, [ebp + 0xd14]
mov esi, 0xc002d8
call fcn.00957fa0
add esp, 4
mov eax, ebx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ecx, 0x104
mov edi, str.C:Program_Files__x86_eScan_
call fcn.00963880
push 0x104
mov esi, edi
call fcn.00957fa0
add esp, 4
mov ecx, ebx
push ecx
push edi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
call esi
xor ebx, ebx
mov byte [ebp + 0x800], bl
mov byte [ebp + 0xa08], bl
lea edx, [ebp + 0xa08]
push edx
lea edx, [ebp - 0x34]
lea ecx, [ebp + 0x800]
call fcn.00974cf0
cmp eax, ebx
je 0x977b50
mov byte [ebp + 0x904], bl
push 0x103
push ebx
lea eax, [ebp + 0x905]
push eax
call fcn.00a7ffb0
mov byte [ebp + 0xb0c], bl
push 0x103
push ebx
lea ecx, [ebp + 0xb0d]
push ecx
call fcn.00a7ffb0
mov dword [ebp - 0x2c], 0x104
lea edx, [ebp + 0xa08]
push edx
push str.SOFTWAREMicroWorldComponentWebscanCProducts_s
lea eax, [ebp + 0x904]
push eax
call fcn.00a78f30
add esp, 0x24
push 0xae906c
lea eax, [ebp - 0x2c]
lea edi, [ebp + 0xb0c]
lea ecx, [ebp + 0x904]
mov edx, 0x80000002
call fcn.0094c020
movzx eax, al
cmp eax, ebx
je 0x977b50
cmp byte [ebp + 0xb0c], bl
je 0x977b50
xor ecx, ecx
call fcn.0095a6d0
test eax, eax
je 0x977b50
mov ecx, edi
push ecx
push 0xc004e8
call esi
push 0x104
lea ebx, [ebp + 0xd14]
mov esi, 0xc004e8
call fcn.00957fa0
add esp, 4
mov edx, ebx
push edx
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edi, 0x104
mov ecx, 0xbfeb20
call fcn.00958630
call fcn.009586f0
push edi
push 0xbfec28
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
call fcn.00968110
test eax, eax
je 0x977b83
mov esi, str.C:WINDOWSSysWOW64
call fcn.00977720
push 0xc001d0
push str._SystemDrive_inetpubwwwroot
push str.C:ProgramDataMicrosoftWindowsStart_MenuPrograms
push 0xbffeb8
push str.C:WINDOWS_system32config_systemprofileDesktop
push str.C:Program_Files__x86_
mov edx, 0xbffca8
mov ecx, str.C:WINDOWS_system32config_systemprofileAppDataRoaming
mov ebx, str.C:Program_Files__x86_Common_Files
call fcn.009748c0
add esp, 0x18
push 0xbff570
push str.C:ProgramDataMicrosoftWindowsStart_Menu
push 0xbff258
push str.C:UsersPublicDesktop
push str.C:ProgramData
mov edx, str.C:ProgramDataMicrosoftWindowsStart_MenuProgramsStartup
mov ecx, str.C:ProgramDataMicrosoftWindowsStart_MenuProgramsAdministrative_Tools
call fcn.00973e00
cmp byte [str.C:UsersPublicDesktop], 0
je 0x977bff
mov edi, str.C:UsersPublic
mov ecx, str.C:UsersPublicDesktop
call fcn.00959920
mov esi, edi
call fcn.00960950
cmp byte [str.C:WINDOWS_system32config_systemprofileDesktop], 0
je 0x977c1e
mov edi, str.C:WINDOWS_system32config_systemprofile
mov ecx, str.C:WINDOWS_system32config_systemprofileDesktop
call fcn.00959920
mov esi, edi
call fcn.00960950
push 0x104
push str.C:WINDOWSTEMP
push str.TEMP
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov dword [0xbfeb1c], 1
mov esi, dword [ebp - 0x20]
mov ebx, dword [ebp - 0x24]
add esi, ebx
mov edi, 0x800
lea ebx, [ebp]
call fcn.009653b0
push 0xd
push str._SYSTEMDRIVE_
mov eax, ebx
push eax
call fcn.00a7be09
add esp, 0xc
test eax, eax
jne 0x977ccc
push 4
push 0xbfec28
push esi
call fcn.00a7a620
add esp, 0xc
mov byte [esi + 2], 0
mov edi, dword [ebp - 0x20]
cmp byte [ebp + 0xd], 0x5c
je 0x977c8c
mov ecx, edi
call fcn.00960910
lea eax, [ebp + 0xd]
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x977c91
sub eax, edx
dec edi
jmp 0x977ca0
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x977ca0
mov ecx, eax
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, 1
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0xfffffffe
jmp 0x97812b
push 0xc
push str._ESCANDRIVE_
lea ecx, [ebp]
push ecx
call fcn.00a7be09
add esp, 0xc
test eax, eax
jne 0x977d2d
push 4
push 0xc002d8
push esi
call fcn.00a7a620
add esp, 0xc
mov byte [esi + 2], 0
mov edi, dword [ebp - 0x20]
cmp byte [ebp + 0xc], 0x5c
je 0x977d07
mov ecx, edi
call fcn.00960910
lea eax, [ebp + 0xc]
mov edx, eax
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x977d10
sub eax, edx
dec edi
lea ebx, [ebx]
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x977d20
jmp 0x977ca8
mov edi, dword [ebp - 0x20]
push edi
mov ecx, str.C:Program_Files__x86_
mov edx, str._PF_
call fcn.009772f0
add esp, 4
mov esi, eax
mov dword [ebp - 0x1c], esi
test esi, esi
jne 0x9780fe
push edi
mov ecx, str.C:WINDOWS_system32config_systemprofile
mov edx, str._UserProfile_
call fcn.009772f0
add esp, 4
or esi, eax
mov dword [ebp - 0x1c], esi
jne 0x9780fe
push edi
mov ecx, 0xbfeb20
mov edx, str._windir_
call fcn.009772f0
add esp, 4
or esi, eax
mov dword [ebp - 0x1c], esi
jne 0x9780fe
push edi
mov ecx, 0xbfec28
mov edx, str._sysdir_
call fcn.009772f0
add esp, 4
or esi, eax
mov dword [ebp - 0x1c], esi
jne 0x9780fe
push edi
mov ecx, str.C:UsersPublic
mov edx, str._AllUsersProfile_
call fcn.009772f0
add esp, 4
or esi, eax
mov dword [ebp - 0x1c], esi
jne 0x9780fe
push edi
mov ecx, str.C:Program_Files__x86_Common_Files
mov edx, str._CommonProgramFiles_
call fcn.009772f0
add esp, 4
or esi, eax
mov dword [ebp - 0x1c], esi
jne 0x9780fe
push edi
mov ecx, str.C:UsersPublicDesktop
mov edx, str._CommonDesktop_
call fcn.009772f0
add esp, 4
or esi, eax
mov dword [ebp - 0x1c], esi
jne 0x9780fe
push edi
mov ecx, str.C:WINDOWSTEMP
mov edx, str._TEMP_
call fcn.009772f0
add esp, 4
or esi, eax
mov dword [ebp - 0x1c], esi
jne 0x9780fe
push edi
mov ecx, 0xbff258
mov edx, str._CommonPrograms_
call fcn.009772f0
add esp, 4
or esi, eax
mov dword [ebp - 0x1c], esi
jne 0x9780fe
push edi
mov ecx, str.C:ProgramDataMicrosoftWindowsStart_Menu
mov edx, str._CommonStartMenu_
call fcn.009772f0
add esp, 4
or esi, eax
mov dword [ebp - 0x1c], esi
jne 0x9780fe
push edi
mov ecx, str.C:WINDOWS_system32config_systemprofileAppDataRoaming
mov edx, str._AppData_
call fcn.009772f0
add esp, 4
or esi, eax
mov dword [ebp - 0x1c], esi
jne 0x9780fe
push edi
mov ecx, str.C:ProgramDataMicrosoftWindowsStart_MenuProgramsStartup
mov edx, str._CommonStartup_
call fcn.009772f0
add esp, 4
or esi, eax
mov dword [ebp - 0x1c], esi
jne 0x9780fe
push edi
mov ecx, str.C:WINDOWS_system32config_systemprofileDesktop
mov edx, str._Desktop_
call fcn.009772f0
add esp, 4
or esi, eax
mov dword [ebp - 0x1c], esi
jne 0x9780fe
push edi
mov ecx, 0xbffeb8
mov edx, str._StartMenu_
call fcn.009772f0
add esp, 4
or esi, eax
mov dword [ebp - 0x1c], esi
jne 0x9780fe
push edi
mov ecx, str.C:WINDOWSSYSTEM
mov edx, str._SYSTEM16DIR_
call fcn.009772f0
add esp, 4
or esi, eax
mov dword [ebp - 0x1c], esi
jne 0x9780fe
push edi
mov ecx, 0xbfeb20
mov edx, str.SystemRoot_
call fcn.009772f0
add esp, 4
or esi, eax
mov dword [ebp - 0x1c], esi
jne 0x9780fe
push edi
mov ecx, 0xbfeb20
mov edx, str._SystemRoot_
call fcn.009772f0
add esp, 4
or esi, eax
mov dword [ebp - 0x1c], esi
jne 0x9780fe
push edi
mov ecx, 0xbfec28
mov edx, 0xac87b0
call fcn.009772f0
add esp, 4
or esi, eax
mov dword [ebp - 0x1c], esi
jne 0x9780fe
cmp byte [str.C:WINDOWSSysWOW64], 0
je 0x977f84
push edi
mov ecx, str.C:WINDOWSSysWOW64
mov edx, str.SysWOW64
call fcn.009772f0
or esi, eax
mov dword [ebp - 0x1c], esi
push edi
mov ecx, str.C:WINDOWSSysWOW64
mov edx, str._SysWOW64_
call fcn.009772f0
add esp, 8
or esi, eax
mov dword [ebp - 0x1c], esi
test esi, esi
jne 0x9780fe
push edi
mov ecx, 0xbfec28
mov edx, str._winsysdir_
call fcn.009772f0
add esp, 4
mov esi, eax
mov dword [ebp - 0x1c], esi
test esi, esi
jne 0x9780fe
push edi
mov ecx, 0xbfeb20
mov edx, str._windows_
call fcn.009772f0
add esp, 4
or esi, eax
mov dword [ebp - 0x1c], esi
jne 0x9780fe
push edi
mov ecx, str._SystemDrive_inetpubwwwroot
mov edx, str._inetpub_
call fcn.009772f0
add esp, 4
or esi, eax
mov dword [ebp - 0x1c], esi
jne 0x9780fe
push edi
mov ecx, 0xbfec28
mov edx, str._SYSTEMDIR_
call fcn.009772f0
add esp, 4
or esi, eax
mov dword [ebp - 0x1c], esi
jne 0x9780fe
push edi
mov ecx, 0xbfec28
mov edx, str._SYSTEM32DIR_
call fcn.009772f0
add esp, 4
or esi, eax
mov dword [ebp - 0x1c], esi
jne 0x9780fe
push edi
mov ecx, str.C:Program_Files__x86_
mov edx, str._ProgramFiles_
call fcn.009772f0
add esp, 4
or esi, eax
mov dword [ebp - 0x1c], esi
jne 0x9780fe
push edi
mov ecx, str.C:Program_Files__x86_
mov edx, str._ProgramFiles_x86__
call fcn.009772f0
add esp, 4
or esi, eax
mov dword [ebp - 0x1c], esi
jne 0x9780fe
push edi
mov ecx, str.C:Program_Files__x86_Common_Files
mov edx, str._CommonProgramFiles_x86__
call fcn.009772f0
add esp, 4
or esi, eax
mov dword [ebp - 0x1c], esi
jne 0x9780fe
push edi
mov ecx, str.C:WINDOWS_system32config_systemprofileDesktop
mov edx, str._DesktopDirectory_
call fcn.009772f0
add esp, 4
or esi, eax
mov dword [ebp - 0x1c], esi
jne 0x9780fe
push edi
mov ecx, str.C:ProgramData
mov edx, str._CommonAppData_
call fcn.009772f0
add esp, 4
or esi, eax
mov dword [ebp - 0x1c], esi
jne 0x9780fe
push edi
mov ecx, 0xc002d8
mov edx, str._eScanDirectory_
call fcn.009772f0
add esp, 4
or esi, eax
mov dword [ebp - 0x1c], esi
jne 0x9780fe
push edi
mov ecx, str.C:Program_Files__x86_eScan_
mov edx, str._MailScanDirectory_
call fcn.009772f0
add esp, 4
or esi, eax
mov dword [ebp - 0x1c], esi
jne 0x9780fe
push edi
mov ecx, 0xc004e8
mov edx, str._WebScanDirectory_
call fcn.009772f0
add esp, 4
or esi, eax
mov dword [ebp - 0x1c], esi
mov dword [ebp - 4], 0xfffffffe
jmp 0x978129
mov eax, esi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0xe18]
xor ecx, ebp
call fcn.00a78f21
add ebp, 0xe1c
mov esp, ebp
pop ebp
ret