Function at 0x10021d20
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x1474
call fcn.1007e4b0
mov eax, dword [0x100b0380]
xor eax, esp
mov dword [esp + 0x1470], eax
push ebx
push esi
push edi
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x32]
push ecx
mov word [esp + 0x34], ax
call fcn.1007dcf0
add esp, 0xc
xor edx, edx
push 0x206
push edx
lea eax, [esp + 0x23a]
push eax
mov word [esp + 0x23c], dx
call fcn.1007dcf0
mov ecx, dword [ebp + 8]
add esp, 0xc
cmp dword [0x100daf38], 0
mov dword [0x100dee30], ecx
jne 0x10021dc3
push str.IsWow64Process
push str.kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x10021db8
push 0x100daf34
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov dword [0x100daf38], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov esi, eax
imul esi, esi, 0x64
call dword [sym.imp.KERNEL32.dll_GetTickCount]
add eax, esi
push eax
call fcn.10079c3c
add esp, 4
call fcn.10079c4e
mov dword [0x100db7e4], eax
call fcn.10079c4e
mov dword [0x100db7e8], eax
call fcn.10079c4e
mov dword [0x100db7ec], eax
call fcn.10079c4e
mov dword [0x100db7f0], eax
call fcn.10079c4e
mov dword [0x100db7f4], eax
call fcn.10079c4e
mov dword [0x100db7f8], eax
call fcn.10079c4e
mov dword [0x100db7fc], eax
call fcn.10079c4e
mov dword [0x100db800], eax
call fcn.10079c4e
mov dword [0x100db804], eax
call fcn.10079c4e
mov dword [0x100db808], eax
call fcn.10079c4e
mov dword [0x100db80c], eax
call fcn.10079c4e
mov ecx, dword [0x100e1368]
mov dword [0x100db810], eax
test ecx, ecx
jne 0x10021ea2
mov edx, dword [0x100e38a0]
xor edx, dword [0x100e389c]
mov dword [esp + 0x10], ecx
mov ecx, dword [0x100e394c]
cmp ecx, edx
je 0x10021ea0
mov eax, dword [0x100e3898]
xor eax, dword [0x100e3894]
add eax, ecx
lea ecx, [esp + 0x10]
push ecx
push fcn.10048200
push 4
call eax
test eax, eax
je 0x10021ea0
mov ecx, dword [esp + 0x10]
jmp 0x10021ea2
xor ecx, ecx
mov edx, 0x100dd3c8
call fcn.10048250
mov edx, dword [0x100e38a0]
xor edx, dword [0x100e389c]
mov eax, dword [0x100e3940]
cmp eax, edx
je 0x10021edd
mov ecx, dword [0x100e3898]
xor ecx, dword [0x100e3894]
push 0x104
push 0x100dd5d0
push 0
add ecx, eax
call ecx
call fcn.10048590
mov ecx, 0x13
mov esi, str.E997A5D9_35D1_46b0_ADED_A456A140DC90
lea edi, [esp + 0x640]
rep movsd dword es:[edi], dword [esi]
push 0x1ba
lea edx, [esp + 0x692]
push 0
push edx
movsw word es:[edi], word [esi]
call fcn.1007dcf0
add esp, 0xc
push 0x100dd9e0
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov ebx, dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [esp + 0x640]
push eax
push 0x100dd9e0
call ebx
mov ecx, 0x13
mov esi, str.C0363902_25D5_4e11_8389_8675890DB74E
lea edi, [esp + 0x1068]
rep movsd dword es:[edi], dword [esi]
push 0x1ba
lea ecx, [esp + 0x10ba]
push 0
push ecx
movsw word es:[edi], word [esi]
call fcn.1007dcf0
add esp, 0xc
push 0x100dd7d8
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea edx, [esp + 0x1068]
push edx
push 0x100dd7d8
call ebx
mov ecx, 0x13
mov esi, str.C8924A25_3AB4_407a_81B2_3387FCD95A32
lea edi, [esp + 0xc58]
rep movsd dword es:[edi], dword [esi]
push 0x1ba
lea eax, [esp + 0xcaa]
push 0
push eax
movsw word es:[edi], word [esi]
call fcn.1007dcf0
add esp, 0xc
push 0x100dec28
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea ecx, [esp + 0xc58]
push ecx
push 0x100dec28
call ebx
push 0x1e0
lea edx, [esp + 0x874]
push 0
mov ecx, 0xa
mov esi, str.Ft_InjectDll_ok.tmp
lea edi, [esp + 0x850]
push edx
rep movsd dword es:[edi], dword [esi]
call fcn.1007dcf0
add esp, 0xc
xor eax, eax
jmp 0x10022000
movzx ecx, word [eax + str.C:WindowsTemp_]
mov word [eax + 0x100dea20], cx
add eax, 2
test cx, cx
jne 0x10022000
lea eax, [esp + 0x848]
push eax
push 0x100dea20
call ebx
mov ecx, 0xc
mov esi, str.Ft_InjectDll_Finish.tmp
lea edi, [esp + 0xa50]
push 0x1d8
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0xa84]
push 0
push ecx
call fcn.1007dcf0
add esp, 0xc
xor eax, eax
movzx ecx, word [eax + str.C:WindowsTemp_]
mov word [eax + 0x100de818], cx
add eax, 2
test cx, cx
jne 0x10022051
lea edx, [esp + 0xa50]
push edx
push 0x100de818
call ebx
push 0x1d8
lea eax, [esp + 0xe94]
push 0
mov ecx, 0xc
mov esi, str.Ft_InjectDll_Failed.tmp
lea edi, [esp + 0xe68]
push eax
rep movsd dword es:[edi], dword [esi]
call fcn.1007dcf0
add esp, 0xc
xor eax, eax
movzx ecx, word [eax + str.C:WindowsTemp_]
mov word [eax + 0x100de610], cx
add eax, 2
test cx, cx
jne 0x100220a2
lea ecx, [esp + 0xe60]
push ecx
push 0x100de610
call ebx
mov ecx, 0x13
mov esi, str.E1ECD784_7440_429a_97B3_2E6A9487C8FF
lea edi, [esp + 0x1270]
rep movsd dword es:[edi], dword [esi]
push 0x1ba
lea edx, [esp + 0x12c2]
push 0
push edx
movsw word es:[edi], word [esi]
call fcn.1007dcf0
mov esi, dword [sym.imp.KERNEL32.dll_GetTempPathW]
add esp, 0xc
push 0x100dddf0
push 0x104
call esi
lea eax, [esp + 0x1270]
push eax
push 0x100dddf0
call ebx
push 0x100dddf0
push 0x100ddff8
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
push str.extdll.dll
push 0x100ddff8
call ebx
push 0x100dcd70
push 0x104
call esi
xor eax, eax
mov edi, edi
movzx ecx, word [eax + 0x100dcd70]
mov word [eax + 0x100dcb68], cx
add eax, 2
test cx, cx
jne 0x10022140
mov esi, 0x10
lea edi, [esp + 0x230]
call fcn.100484d0
mov ecx, edi
push ecx
push 0x100dcd70
push str._s_s.tmp
push 0x100dcd70
mov ecx, 0x104
call fcn.10018220
call fcn.100484d0
mov edx, edi
push edx
push 0x100dcb68
push str._s_s64.tmp
push 0x100dcb68
mov ecx, 0x104
call fcn.10018220
mov esi, dword [sym.imp.KERNEL32.dll_GetTempPathW]
add esp, 0x20
push 0x100dbb28
push 0x104
call esi
push str.offline514.exe
push 0x100dbb28
call ebx
push 0x100dbd30
push 0x104
call esi
push str.offline1312.cab
push 0x100dbd30
call ebx
push 0x100dbf38
push 0x104
call esi
push str.lhp728.cab
push 0x100dbf38
call ebx
push 0x100dc140
push 0x104
call esi
mov edi, 0x80
lea esi, [esp + 0x28]
call fcn.100483d0
mov eax, esi
push eax
push 0x100dc140
call ebx
push 0x100dc140
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
lea esi, [edi - 0x70]
lea edi, [esp + 0x230]
call fcn.100484d0
mov eax, edi
add eax, 0xfffffffe
lea ebx, [ebx]
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x10022240
mov ecx, dword [str..exe]
mov edx, dword [0x1009ede0]
mov dword [eax], ecx
mov cx, word [0x1009ede4]
mov dword [eax + 4], edx
lea edx, [esp + 0x230]
push edx
push 0x100dc140
mov word [eax + 8], cx
call ebx
push 0x100dc348
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov edi, 0x80
lea esi, [esp + 0x28]
call fcn.100483d0
mov eax, esi
push eax
push 0x100dc348
call ebx
push 0x100dc348
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
call fcn.100483d0
mov eax, esi
add eax, 0xfffffffe
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x100222b6
mov ecx, dword [0x1009f82c]
mov edx, dword [0x1009f830]
mov dword [eax], ecx
mov cx, word [0x1009f834]
mov dword [eax + 4], edx
lea edx, [esp + 0x28]
push edx
push 0x100dc348
mov word [eax + 8], cx
call ebx
push 0x100dc550
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea esi, [esp + 0x28]
call fcn.100483d0
mov eax, esi
push eax
push 0x100dc550
call ebx
push 0x100dc550
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
call fcn.100483d0
mov eax, esi
add eax, 0xfffffffe
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x10022324
mov ecx, dword [0x1009f82c]
mov edx, dword [0x1009f830]
mov dword [eax], ecx
mov cx, word [0x1009f834]
mov dword [eax + 4], edx
lea edx, [esp + 0x28]
push edx
push 0x100dc550
mov word [eax + 8], cx
call ebx
mov esi, 0x10
lea edi, [esp + 0x230]
call fcn.100484d0
mov esi, dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0x100ddbe8
push 0x104
call esi
mov eax, edi
push eax
push 0x100ddbe8
call ebx
push 0x100dc960
push 0x104
call esi
xor eax, eax
jmp 0x100223a0
movzx ecx, word [eax + 0x100dc960]
mov word [eax + 0x100dc758], cx
add eax, 2
test cx, cx
jne 0x100223a0
mov esi, 0x10
lea edi, [esp + 0x230]
call fcn.100484d0
mov ecx, edi
push ecx
push 0x100dc960
push str._s_s.tmp
push 0x100dc960
mov ecx, 0x104
call fcn.10018220
call fcn.100484d0
mov edx, edi
push edx
push 0x100dc758
push str._s_s64.tmp
push 0x100dc758
mov ecx, 0x104
call fcn.10018220
mov esi, dword [sym.imp.KERNEL32.dll_GetTempPathW]
add esp, 0x20
push 0x100de200
push 0x104
call esi
push str.offline1127.exe
push 0x100de200
call ebx
push 0x100de408
push 0x104
call esi
mov edi, 0x80
lea esi, [esp + 0x28]
call fcn.100483d0
mov eax, esi
push eax
push 0x100de408
call ebx
push 0x100de408
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
call fcn.100483d0
mov eax, esi
add eax, 0xfffffffe
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x10022460
mov ecx, dword [0x1009f82c]
mov edx, dword [0x1009f830]
mov dword [eax], ecx
mov cx, word [0x1009f834]
mov dword [eax + 4], edx
lea edx, [esp + 0x28]
push edx
push 0x100de408
mov word [eax + 8], cx
call ebx
call fcn.1004fae0
push 0
call fcn.10030ae0
add esp, 4
test eax, eax
je 0x100224b3
call fcn.10079c4e
mov ecx, 7
jmp 0x100224bd
call fcn.10079c4e
mov ecx, 0x17
cdq
idiv ecx
push 0xa
push 0xa
lea eax, [esp + 0x1c]
push eax
add edx, 8
push edx
mov dword [0x100dee34], edx
call fcn.1007a74b
add esp, 0x10
xor eax, eax
lea ecx, [ecx]
movzx ecx, word [eax + str.vmsafe]
mov word [eax + 0x100dd180], cx
add eax, 2
test cx, cx
jne 0x100224e0
mov esi, 8
lea edi, [esp + 0x230]
call fcn.100484d0
mov eax, edi
mov edx, edi
jmp 0x10022510
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10022510
mov edi, 0x100dd180
sub eax, edx
add edi, 0xfffffffe
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x10022525
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [esp + 0x14]
rep movsb byte es:[edi], byte [esi]
mov edx, eax
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10022547
mov edi, 0x100dd180
sub eax, edx
add edi, 0xfffffffe
lea esp, [esp]
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x10022560
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
mov eax, 0x100dd180
rep movsb byte es:[edi], byte [esi]
add eax, 0xfffffffe
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x10022584
mov ecx, dword [str..exe]
mov edx, dword [0x1009ede0]
mov dword [eax], ecx
mov cx, word [0x1009ede4]
mov dword [eax + 4], edx
xor edx, edx
push 0x206
mov word [eax + 8], cx
push edx
lea eax, [esp + 0x442]
push eax
mov word [esp + 0x444], dx
call fcn.1007dcf0
add esp, 0xc
lea ecx, [esp + 0x438]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
xor eax, eax
movzx ecx, word [esp + eax + 0x438]
mov word [eax + 0x100dd1c0], cx
add eax, 2
test cx, cx
jne 0x100225e1
mov esi, 0x10
lea edi, [esp + 0x230]
call fcn.100484d0
mov edx, edi
push edx
push 0x100dd1c0
call ebx
mov esi, dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
push 0x100dd1c0
call esi
test eax, eax
jne 0x10022630
push 0x100dd1c0
push eax
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
push 0x100dd180
push 0x100dd1c0
call ebx
push 0x100dcf78
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push str.959867F3_C866_4b8c_B21B_D167C5F7252A
push 0x100dcf78
call ebx
push 0x100dcf78
call esi
test eax, eax
jne 0x1002266f
push 0x100dcf78
push eax
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
push str.svchost.exe
push 0x100dcf78
call ebx
mov ecx, dword [esp + 0x147c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10079a05
mov esp, ebp
pop ebp
ret