Function at 0x10005f2c
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0xd1c]
sub esp, 0xd1c
push 0xffffffffffffffff
push 0x1003c480
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x10050040]
xor eax, ebp
mov dword [ebp + 0xd18], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, 0x100528a4
mov dword [ebp - 0x28], 0x100528a4
call fcn.1000500f
xor ebx, ebx
push 0x10052844
mov dword [ebp - 4], ebx
call dword [sym.imp.ole32.dll_CoCreateGuid]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [ebp - 0x24]
call fcn.100064c9
push eax
mov ecx, 0x10050b10
call fcn.10002c4b
lea ecx, [ebp - 0x24]
call fcn.1000200e
xor eax, eax
mov esi, 0x400
mov word [ebp + 0x118], ax
lea eax, [ebp + 0x118]
push esi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [ebp + 0x118]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x10005fd2
sub ecx, edx
lea eax, [ebp + 0x118]
sar ecx, 1
push ecx
push eax
mov ecx, 0x10050af8
call fcn.10006b18
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [0x10052854], eax
xor eax, eax
mov word [ebp + 0x118], ax
lea eax, [ebp + 0x118]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea ecx, [ebp + 0x118]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x1000601e
sub ecx, edx
lea eax, [ebp + 0x118]
sar ecx, 1
push ecx
push eax
mov ecx, 0x10050ae0
call fcn.10006b18
push 0x110
lea eax, [ebp + 4]
mov byte [0x10052842], 1
push ebx
push eax
call fcn.1001e5b0
add esp, 0xc
mov dword [ebp], 0x114
mov ecx, 0x100470c4
call fcn.10014b1b
mov ecx, eax
call fcn.10014ccf
mov esi, eax
test esi, esi
je 0x100060bd
mov ecx, 0x1004714c
call fcn.10014a5d
mov edx, eax
mov ecx, esi
call fcn.10014d7d
test eax, eax
je 0x100060bd
lea ecx, [ebp]
push ecx
call eax
test eax, eax
jne 0x100060bd
mov ecx, dword [ebp + 4]
mov al, byte [ebp + 8]
mov byte [0x10052841], cl
mov byte [0x10052843], al
cmp cl, 0xa
jne 0x100060bd
cmp dword [ebp + 0xc], 0x55f0
jb 0x100060bd
mov byte [0x10052841], 0xb
lea ecx, [ebp + 0x918]
call fcn.10015915
test eax, eax
jne 0x10006221
lea ecx, [ebp + 0x918]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100060d9
sub ecx, edx
lea eax, [ebp + 0x918]
push ecx
push eax
mov ecx, 0x10050b40
call fcn.10006bbf
lea ecx, [ebp + 0x918]
call fcn.10015971
push ebx
push 0x10047121
mov ecx, 0x10050b28
mov esi, eax
call fcn.10006bbf
test esi, esi
je 0x10006221
mov eax, dword [esi + 0xc]
mov edi, ebx
cmp dword [eax], ebx
je 0x10006221
mov ecx, ebx
mov ebx, dword [ecx + eax]
test edi, edi
je 0x10006140
push 1
push 0x10047160
mov ecx, 0x10050b28
call fcn.10006b66
movzx edx, byte [ebx]
lea ecx, [ebp - 0x24]
call fcn.10005ec5
push eax
mov ecx, 0x10050b28
mov byte [ebp - 4], 1
call fcn.10006aca
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 0
call fcn.10002037
push 1
push 0x10047164
mov ecx, 0x10050b28
call fcn.10006b66
movzx edx, byte [ebx + 1]
lea ecx, [ebp - 0x24]
call fcn.10005ec5
push eax
mov ecx, 0x10050b28
mov byte [ebp - 4], 2
call fcn.10006aca
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 0
call fcn.10002037
push 1
push 0x10047164
mov ecx, 0x10050b28
call fcn.10006b66
movzx edx, byte [ebx + 2]
lea ecx, [ebp - 0x24]
call fcn.10005ec5
push eax
mov ecx, 0x10050b28
mov byte [ebp - 4], 3
call fcn.10006aca
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 0
call fcn.10002037
push 1
push 0x10047164
mov ecx, 0x10050b28
call fcn.10006b66
movzx edx, byte [ebx + 3]
lea ecx, [ebp - 0x24]
call fcn.10005ec5
push eax
mov ecx, 0x10050b28
mov byte [ebp - 4], 4
call fcn.10006aca
xor ebx, ebx
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], bl
call fcn.10002037
mov eax, dword [esi + 0xc]
inc edi
mov ecx, edi
shl ecx, 2
cmp dword [ecx + eax], ebx
jne 0x10006128
push str.kernel32
mov byte [0x10052858], bl
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edx, str.IsWow64Process
mov ecx, eax
call fcn.10014d7d
xor ecx, ecx
mov esi, eax
inc ecx
mov dword [ebp + 0x114], ecx
test esi, esi
je 0x10006263
lea eax, [ebp + 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
mov ecx, dword [ebp + 0x114]
test ecx, ecx
push 0x100528a4
setne byte [0x10052840]
call fcn.1001ad7b
pop ecx
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0xd18]
xor ecx, ebp
call fcn.1001c8e8
add ebp, 0xd1c
leave
ret