Function at 0x8cccc0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
push 0x5c
push ebx
call fcn.00a7aa50
mov edi, eax
add esp, 8
mov esi, 1
test edi, edi
je 0x8ccce3
add edi, esi
mov dword [ebp - 4], edi
jmp 0x8ccce8
mov dword [ebp - 4], ebx
mov edi, ebx
cmp byte [0xbf33f8], 0
jne 0x8ccd9f
push 0x104
push 0xbf33f8
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp byte [0xbf33f8], 0
je 0x8ccd3a
mov eax, 0xbf33f8
add eax, esi
cmp byte [eax], 0
jne 0x8ccd13
sub eax, 0xbf33f8
je 0x8ccd3a
cmp byte [eax + 0xbf33f7], 0x5c
je 0x8ccd3a
push 0xaa1564
push 0xbf33f8
call dword [sym.imp.KERNEL32.dll_lstrcatA]
call fcn.00968110
test eax, eax
je 0x8ccd54
mov esi, str.C:WINDOWSSysWOW64_
call fcn.00977720
mov ecx, esi
call fcn.00960910
mov edi, 0x104
mov ecx, 0xbf3608
call fcn.00958630
cmp byte [0xbf3608], 0
je 0x8ccd97
mov eax, 0xbf3608
inc eax
cmp byte [eax], 0
jne 0x8ccd71
sub eax, 0xbf3608
je 0x8ccd97
cmp byte [eax + 0xbf3607], 0x5c
je 0x8ccd97
push 0xaa1564
push 0xbf3608
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov edi, dword [ebp - 4]
mov esi, 1
test ebx, ebx
je 0x8ccf70
cmp byte [ebx], 0
je 0x8ccf70
cmp byte [0xbf3608], 0
je 0x8cce1a
mov eax, 0xbf3608
mov ecx, ebx
call fcn.0094c3e0
test eax, eax
jne 0x8cce1a
mov eax, dword [ebp + 8]
mov dword [eax + 0x838], esi
cmp byte [0xbf33f8], 0
je 0x8ccdeb
mov eax, 0xbf33f8
mov ecx, ebx
call fcn.0094c3e0
test eax, eax
je 0x8cce0c
cmp byte [str.C:WINDOWSSysWOW64_], 0
je 0x8ccf01
mov eax, str.C:WINDOWSSysWOW64_
mov ecx, ebx
call fcn.0094c3e0
test eax, eax
jne 0x8ccf01
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x834], esi
jmp 0x8ccf01
push 0
push 0xacc4ac
push ebx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x8cce61
mov eax, str.HxTsr.exe
mov ecx, edi
call fcn.0094c330
test eax, eax
je 0x8cce53
mov eax, str.LocalBridge.exe
mov ecx, edi
call fcn.0094c330
test eax, eax
jne 0x8ccf01
mov edx, dword [ebp + 8]
mov dword [edx + 0x84c], esi
jmp 0x8ccf01
push 0
push 0xacc4d8
push ebx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x8cce84
mov eax, dword [ebp + 8]
mov dword [eax + 0x84c], esi
jmp 0x8ccf01
push 0
push 0xaa154c
push ebx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x8ccef8
push 0
push 0xaa1ab8
push ebx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x8ccef8
push 0
push str.programdata_
push ebx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x8cced8
push 0
push str.users_
push ebx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x8ccf01
push 0
push str.desktop_
push ebx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x8ccf01
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x850], esi
jmp 0x8ccf01
mov edx, dword [ebp + 8]
mov dword [edx + 0x848], esi
mov eax, dword [ebp + 8]
cmp dword [eax + 0x834], 0
je 0x8ccf70
push 0x5c
push ebx
call fcn.00a7aa50
mov esi, eax
add esp, 8
test esi, esi
je 0x8ccf21
inc esi
jmp 0x8ccf23
mov esi, ebx
mov eax, str.notepad.exe
mov ecx, esi
call fcn.0094c330
test eax, eax
je 0x8ccf63
mov eax, 0xacaea4
mov ecx, esi
call fcn.0094c330
test eax, eax
je 0x8ccf63
mov eax, str.mspaint.exe
mov ecx, esi
call fcn.0094c330
test eax, eax
je 0x8ccf63
mov eax, str.mstsc.exe
mov ecx, esi
call fcn.0094c330
test eax, eax
jne 0x8ccf70
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x83c], 1
push edi
mov ecx, ebx
call fcn.009032c0
mov edx, dword [ebp + 8]
add esp, 4
pop edi
mov dword [edx + 0x854], eax
pop esi
mov esp, ebp
pop ebp
ret