Function at 0x1002c3e0
Capabilities:
Get common file path

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101ab45f
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x310
mov eax, dword [0x10221008]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x10227688], 0
je 0x1002c4f0
push 0
mov ecx, 0x10227688
call fcn.100c1510
mov eax, dword [0x10227688]
cmp byte [eax + 0x54], 0
je 0x1002c4f0
cmp dword [eax + 0x58], 4
jb 0x1002c4f0
mov al, byte [eax + 0x5c]
mov byte [ebp - 0x315], al
xor eax, eax
mov dword [ebp - 0x248], 0
mov dword [ebp - 0x244], 0
mov dword [ebp - 0x248], 0
mov dword [ebp - 0x244], 7
mov word [ebp - 0x258], ax
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x258]
push 0xa
push 0x101ec074
call fcn.10004a60
push 0xac
push str.RC::RCTrojanDriverService::ProcessTrojanDriverSamples
push str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotect_rtpsystem_src_sddefencelogic_srcdrivermonitor_trojandriverclean_rctrojandriverservice.cpp
lea eax, [ebp - 0x258]
mov ecx, 0x10227688
push eax
push 4
call fcn.100c1e70
cmp byte [ebp - 0x315], 0
je 0x1002c4de
lea eax, [ebp - 0x258]
mov ecx, 0x10227688
push eax
call fcn.100c2190
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x258]
call fcn.100049f0
xor eax, eax
mov dword [ebp - 0x2b4], 0
mov dword [ebp - 0x2b0], 0
mov dword [ebp - 0x2b4], 0
mov dword [ebp - 0x2b0], 7
mov word [ebp - 0x2c4], ax
mov dword [ebp - 4], 1
push 0x20c
push eax
lea eax, [ebp - 0x228]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x228]
push 0x105
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
dec eax
cmp eax, 0x103
ja 0x1002c588
xor eax, eax
lea ecx, [ebp - 0x228]
mov word [ebp - 0x1e], ax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1002c566
sub ecx, edx
lea eax, [ebp - 0x228]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x2c4]
call fcn.10004a60
push 7
xor eax, eax
mov dword [ebp - 0x230], 0
mov dword [ebp - 0x22c], 0
lea ecx, [ebp - 0x240]
push str.Temp_f4
mov dword [ebp - 0x230], 0
mov dword [ebp - 0x22c], 7
mov word [ebp - 0x240], ax
call fcn.10004a60
mov byte [ebp - 4], 2
lea eax, [ebp - 0x240]
push eax
lea edx, [ebp - 0x2c4]
lea ecx, [ebp - 0x2f4]
call fcn.10097e70
add esp, 4
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x240]
call fcn.100049f0
xorps xmm0, xmm0
mov dword [ebp - 0x25c], 0
movq qword [ebp - 0x264], xmm0
mov dword [ebp - 0x264], 0
mov dword [ebp - 0x260], 0
mov dword [ebp - 0x25c], 0
mov byte [ebp - 4], 5
lea edx, [ebp - 0x264]
lea ecx, [ebp - 0x2f4]
call fcn.100a2460
mov esi, dword [ebp - 0x264]
mov edi, dword [ebp - 0x260]
cmp esi, edi
je 0x1002cab1
mov ecx, esi
call fcn.100a1b90
test al, al
je 0x1002caa6
lea edx, [ebp - 0x315]
mov byte [ebp - 0x315], 0
mov ecx, esi
call fcn.1000e090
cmp byte [ebp - 0x315], 0
jne 0x1002c68d
mov ecx, esi
call fcn.100b50e0
jmp 0x1002caa6
xor eax, eax
mov dword [ebp - 0x248], 0
mov dword [ebp - 0x244], 0
mov dword [ebp - 0x248], 0
mov dword [ebp - 0x244], 7
mov word [ebp - 0x258], ax
mov byte [ebp - 4], 6
lea eax, [ebp - 0x258]
xorps xmm0, xmm0
lea ecx, [ebp - 0x314]
push eax
push esi
movups xmmword [ebp - 0x314], xmm0
movups xmmword [ebp - 0x304], xmm0
call fcn.10035ad0
xor eax, eax
mov dword [ebp - 0x26c], 0
mov dword [ebp - 0x268], 0
mov dword [ebp - 0x26c], 0
mov dword [ebp - 0x268], 7
mov word [ebp - 0x27c], ax
mov byte [ebp - 4], 7
mov byte [ebp - 0x316], al
mov byte [ebp - 4], 8
lea eax, [ebp - 0x27c]
push eax
push esi
lea ecx, [ebp - 0x316]
call fcn.100369d0
mov edx, esi
lea ecx, [ebp - 0x2dc]
call fcn.100a2340
mov byte [ebp - 4], 9
lea eax, [ebp - 0x2dc]
push eax
lea eax, [ebp - 0x27c]
mov ecx, 0x10227620
push eax
lea eax, [ebp - 0x258]
push eax
call fcn.1002b7d0
test al, al
je 0x1002c85b
cmp dword [0x10227688], 0
jne 0x1002c77d
xor ecx, ecx
jmp 0x1002c7a2
push 0
mov ecx, 0x10227688
call fcn.100c1510
mov eax, dword [0x10227688]
xor ecx, ecx
cmp byte [eax + 0x54], cl
je 0x1002c7a2
cmp dword [eax + 0x58], 4
jb 0x1002c7a2
cmp byte [eax + 0x5c], cl
setne cl
inc ecx
mov dword [ebp - 0x31c], ecx
test ecx, ecx
je 0x1002c84f
xor eax, eax
mov dword [ebp - 0x284], 0
mov dword [ebp - 0x280], 0
mov dword [ebp - 0x284], 0
mov dword [ebp - 0x280], 7
mov word [ebp - 0x294], ax
mov byte [ebp - 4], 0xa
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x1002c7ef
mov eax, dword [esi]
push eax
lea eax, [ebp - 0x294]
push 0x101ec10c
push eax
call fcn.100c2310
add esp, 0xc
lea eax, [ebp - 0x294]
mov ecx, 0x10227688
push 0xcf
push str.RC::RCTrojanDriverService::ProcessTrojanDriverSamples
push str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotect_rtpsystem_src_sddefencelogic_srcdrivermonitor_trojandriverclean_rctrojandriverservice.cpp
push eax
push 4
call fcn.100c1e70
cmp dword [ebp - 0x31c], 1
jbe 0x1002c840
lea eax, [ebp - 0x294]
mov ecx, 0x10227688
push eax
call fcn.100c2190
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x294]
call fcn.100049f0
mov ecx, esi
call fcn.100b50e0
jmp 0x1002ca6e
lea eax, [ebp - 0x2dc]
mov ecx, 0x10227620
push eax
lea eax, [ebp - 0x27c]
push eax
lea eax, [ebp - 0x258]
push eax
call fcn.1002b960
test al, al
je 0x1002c981
cmp dword [0x10227688], 0
jne 0x1002c88f
xor ecx, ecx
jmp 0x1002c8b4
push 0
mov ecx, 0x10227688
call fcn.100c1510
mov eax, dword [0x10227688]
xor ecx, ecx
cmp byte [eax + 0x54], cl
je 0x1002c8b4
cmp dword [eax + 0x58], 4
jb 0x1002c8b4
cmp byte [eax + 0x5c], cl
setne cl
inc ecx
mov dword [ebp - 0x31c], ecx
test ecx, ecx
je 0x1002c961
xor eax, eax
mov dword [ebp - 0x29c], 0
mov dword [ebp - 0x298], 0
mov dword [ebp - 0x29c], 0
mov dword [ebp - 0x298], 7
mov word [ebp - 0x2ac], ax
mov byte [ebp - 4], 0xb
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x1002c901
mov eax, dword [esi]
push eax
lea eax, [ebp - 0x2ac]
push 0x101ec128
push eax
call fcn.100c2310
add esp, 0xc
lea eax, [ebp - 0x2ac]
mov ecx, 0x10227688
push 0xd5
push str.RC::RCTrojanDriverService::ProcessTrojanDriverSamples
push str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotect_rtpsystem_src_sddefencelogic_srcdrivermonitor_trojandriverclean_rctrojandriverservice.cpp
push eax
push 4
call fcn.100c1e70
cmp dword [ebp - 0x31c], 1
jbe 0x1002c952
lea eax, [ebp - 0x2ac]
mov ecx, 0x10227688
push eax
call fcn.100c2190
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x2ac]
call fcn.100049f0
push esi
call fcn.1003c890
push esi
call fcn.1002cbd0
test al, al
je 0x1002ca6e
mov ecx, esi
call fcn.100b50e0
jmp 0x1002ca6e
push esi
call fcn.1002d3d0
test al, al
jne 0x1002ca6e
cmp dword [0x10227688], 0
jne 0x1002c99c
xor ecx, ecx
jmp 0x1002c9c1
push 0
mov ecx, 0x10227688
call fcn.100c1510
mov eax, dword [0x10227688]
xor ecx, ecx
cmp byte [eax + 0x54], cl
je 0x1002c9c1
cmp dword [eax + 0x58], 4
jb 0x1002c9c1
cmp byte [eax + 0x5c], cl
setne cl
inc ecx
mov dword [ebp - 0x31c], ecx
test ecx, ecx
je 0x1002ca6e
xor eax, eax
mov dword [ebp - 0x230], 0
mov dword [ebp - 0x22c], 0
mov dword [ebp - 0x230], 0
mov dword [ebp - 0x22c], 7
mov word [ebp - 0x240], ax
mov byte [ebp - 4], 0xc
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x1002ca0e
mov eax, dword [esi]
push eax
lea eax, [ebp - 0x240]
push 0x101ec150
push eax
call fcn.100c2310
add esp, 0xc
lea eax, [ebp - 0x240]
mov ecx, 0x10227688
push 0xe3
push str.RC::RCTrojanDriverService::ProcessTrojanDriverSamples
push str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotect_rtpsystem_src_sddefencelogic_srcdrivermonitor_trojandriverclean_rctrojandriverservice.cpp
push eax
push 4
call fcn.100c1e70
cmp dword [ebp - 0x31c], 1
jbe 0x1002ca5f
lea eax, [ebp - 0x240]
mov ecx, 0x10227688
push eax
call fcn.100c2190
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x240]
call fcn.100049f0
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x2dc]
call fcn.100049f0
mov byte [ebp - 4], 7
mov byte [ebp - 0x316], 0
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x27c]
call fcn.100049f0
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x258]
call fcn.100049f0
add esi, 0x18
cmp esi, edi
jne 0x1002c655
cmp dword [0x10227688], 0
je 0x1002cb7e
push 0
mov ecx, 0x10227688
call fcn.100c1510
mov eax, dword [0x10227688]
cmp byte [eax + 0x54], 0
je 0x1002cb7e
cmp dword [eax + 0x58], 4
jb 0x1002cb7e
mov al, byte [eax + 0x5c]
mov byte [ebp - 0x315], al
xor eax, eax
mov dword [ebp - 0x230], 0
mov dword [ebp - 0x22c], 0
mov dword [ebp - 0x230], 0
mov dword [ebp - 0x22c], 7
mov word [ebp - 0x240], ax
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x240]
push 0xa
push 0x101ec168
call fcn.10004a60
push 0xe7
push str.RC::RCTrojanDriverService::ProcessTrojanDriverSamples
push str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotect_rtpsystem_src_sddefencelogic_srcdrivermonitor_trojandriverclean_rctrojandriverservice.cpp
lea eax, [ebp - 0x240]
mov ecx, 0x10227688
push eax
push 4
call fcn.100c1e70
cmp byte [ebp - 0x315], 0
je 0x1002cb6f
lea eax, [ebp - 0x240]
mov ecx, 0x10227688
push eax
call fcn.100c2190
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x240]
call fcn.100049f0
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x264]
call fcn.10008850
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x2f4]
call fcn.100049f0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c4]
call fcn.100049f0
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1018b774
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret