Function at 0x10001090
Capabilities:
Get common file path

Disassembly:
sub esp, 0x104
push esi
mov esi, ecx
cmp dword [esi + 4], 1
jne 0x100010bb
push str.ALREADY_API_HOOKED
push 0x10027760
call fcn.1000b440
add esp, 8
xor eax, eax
pop esi
add esp, 0x104
ret
push 0x1f
call fcn.10014f20
test eax, eax
mov dword [esi + 8], eax
je 0x100010b1
push edi
push str.wrmk.dll
push eax
call fcn.10014f60
mov eax, dword [esi + 8]
push str.DSEDCO00.dll
push eax
call fcn.10014f60
mov ecx, dword [esi + 8]
push str.DSCOPipe.dll
push ecx
call fcn.10014f60
mov edx, dword [esi + 8]
push str.DSIpcAg.dll
push edx
call fcn.10014f60
mov eax, dword [esi + 8]
push str.libapihook.dll
push eax
call fcn.10014f60
mov ecx, dword [esi + 8]
push str.msdrm.dll
push ecx
call fcn.10014f60
mov edx, dword [esi + 8]
push str.msxml5.dll
push edx
call fcn.10014f60
mov eax, dword [esi + 8]
push str.mscoree.dll
push eax
call fcn.10014f60
mov ecx, dword [esi + 8]
push str.AddinLoader.dll
push ecx
call fcn.10014f60
mov edx, dword [esi + 8]
push str.SK.HPW.Approval.dll
push edx
call fcn.10014f60
mov eax, dword [esi + 8]
push str.SK.HPW.Approval.TMForm.dll
push eax
call fcn.10014f60
mov ecx, dword [esi + 8]
push str.SK.HPW.Approval.TMForms.dll
push ecx
call fcn.10014f60
mov edx, dword [esi + 8]
push str.SK.HPW.Approval.TMForm.Stamp.dll
push edx
call fcn.10014f60
mov eax, dword [esi + 8]
push str.SK.HPW.Approval.TMForm.StampData.dll
push eax
call fcn.10014f60
mov ecx, dword [esi + 8]
push str.SK.HPW.Approval.TMForm.StampData.XmlSerializers.dll
push ecx
call fcn.10014f60
mov edx, dword [esi + 8]
push str.SK.HPW.Approval.TMForm.Utils.dll
push edx
call fcn.10014f60
mov eax, dword [esi + 8]
push str.SK.HPW.Approval.TMForm.Win.dll
push eax
call fcn.10014f60
mov ecx, dword [esi + 8]
push str.SK.HPW.Approval.TMForm.Win.XmlSerializers.dll
push ecx
call fcn.10014f60
mov edx, dword [esi + 8]
push str.ezXFileUploader.dll
push edx
call fcn.10014f60
mov eax, dword [esi + 8]
push str.Interop.EZXFILEUPLOADERLib.dll
push eax
call fcn.10014f60
push str.AxInterop.EZXFILEUPLOADERLib.dll
mov ecx, dword [esi + 8]
push ecx
call fcn.10014f60
mov edx, dword [esi + 8]
push str.AxInterop.PersonaControlsLib.dll
push edx
call fcn.10014f60
mov eax, dword [esi + 8]
push str.Interop.PersonaControlsLib.dlll
push eax
call fcn.10014f60
mov ecx, dword [esi + 8]
push str.SK.HPW.Approval.TMForms.dll.manifest
push ecx
call fcn.10014f60
mov edx, dword [esi + 8]
push str.SK.HPW.Approval.TMForm.DReport.dll
push edx
call fcn.10014f60
mov eax, dword [esi + 8]
push str.SK.HPW.Approval.TMForm.Letter.dll
push eax
call fcn.10014f60
mov ecx, dword [esi + 8]
push str.SK.HPW.Approval.TMForm.Report.dll
push ecx
call fcn.10014f60
mov edx, dword [esi + 8]
push str.SK.HPW.Approval.TMForm.AppData.dll
push edx
call fcn.10014f60
mov eax, dword [esi + 8]
push str.SK.HPW.Approval.TMForm.AppData.XmlSerializers.dll
push eax
call fcn.10014f60
mov ecx, dword [esi + 8]
push str.SK.HPW.Mail.Orgchart.WinCtrl.dll
push ecx
call fcn.10014f60
mov edx, dword [esi + 8]
push str.SK.HPW.Mail.Orgchart.WinCtrl.XmlSerializers.dll
push edx
call fcn.10014f60
mov eax, dword [esi + 8]
push str.sysfer.dll
push eax
call fcn.10014f60
mov ecx, dword [esi + 8]
push fcn.10001700
push str.CreateFileA
push str.Kernel32.dll
push ecx
call fcn.10014f80
mov edx, dword [esi + 8]
push 0x100039a0
push str.CreateFileW
push str.Kernel32.dll
push edx
call fcn.10014f80
mov eax, dword [esi + 8]
push 0x10004cb0
push str.CloseHandle
push str.Kernel32.dll
push eax
call fcn.10014f80
mov ecx, dword [esi + 8]
push 0x10004b30
push str.SetEndOfFile
push str.Kernel32.dll
push ecx
call fcn.10014f80
mov edx, dword [esi + 8]
push 0x10003b80
push str.WriteFile
push str.Kernel32.dll
push edx
call fcn.10014f80
mov eax, dword [esi + 8]
push 0x10004af0
push str.DeleteFileA
push str.Kernel32.dll
push eax
call fcn.10014f80
mov ecx, dword [esi + 8]
push 0x10004b10
push str.DeleteFileW
push str.Kernel32.dll
push ecx
call fcn.10014f80
mov edx, dword [esi + 8]
push fcn.10003f90
push str.MoveFileA
push str.Kernel32.dll
push edx
call fcn.10014f80
mov eax, dword [esi + 8]
push 0x10003df0
push str.MoveFileW
push str.Kernel32.dll
push eax
call fcn.10014f80
mov ecx, dword [esi + 8]
push fcn.10004600
push str.MoveFileExA
push str.Kernel32.dll
push ecx
call fcn.10014f80
mov edx, dword [esi + 8]
push 0x100044d0
push str.MoveFileExW
push str.Kernel32.dll
push edx
call fcn.10014f80
mov eax, dword [esi + 8]
push fcn.10003cd0
push str.ReplaceFileA
push str.Kernel32.dll
push eax
call fcn.10014f80
mov ecx, dword [esi + 8]
push 0x10003bc0
push str.ReplaceFileW
push str.Kernel32.dll
push ecx
call fcn.10014f80
mov edx, dword [esi + 8]
push 0x10006640
push str.CreateWindowExA
push str.User32.dll
push edx
call fcn.10014f80
mov eax, dword [esi + 8]
push 0x100069f0
push str.CreateWindowExW
push str.User32.dll
push eax
call fcn.10014f80
mov ecx, dword [esi + 8]
push 0x10007e10
push str.DialogBoxIndirectParamA
push str.User32.dll
push ecx
call fcn.10014f80
mov edx, dword [esi + 8]
push 0x10007c10
push str.DialogBoxIndirectParamW
push str.User32.dll
push edx
call fcn.10014f80
mov eax, dword [esi + 8]
push 0x100080c0
push str.MessageBoxA
push str.User32.dll
push eax
call fcn.10014f80
mov ecx, dword [esi + 8]
push 0x100080f0
push str.MessageBoxW
push str.User32.dll
push ecx
call fcn.10014f80
push 0x10006da0
mov edx, dword [esi + 8]
push str.EndDialog
push str.User32.dll
push edx
call fcn.10014f80
mov eax, dword [esi + 8]
push 0x10007190
push str.SetWindowPos
push str.User32.dll
push eax
call fcn.10014f80
mov ecx, dword [esi + 8]
push 0x10007c00
push str.SetClipboardViewer
push str.User32.dll
push ecx
call fcn.10014f80
mov edx, dword [esi + 8]
push 0x10004ec0
push str.StgOpenStorage
push str.OLE32.DLL
push edx
call fcn.10014f80
mov eax, dword [esi + 8]
push 0x10005e90
push str.StgIsStorageFile
push str.OLE32.DLL
push eax
call fcn.10014f80
mov ecx, dword [esi + 8]
push 0x10005f20
push str.StgCreateDocfile
push str.OLE32.DLL
push ecx
call fcn.10014f80
mov edx, dword [esi + 8]
push 0x10006360
push str.OleCreateFromFile
push str.OLE32.DLL
push edx
call fcn.10014f80
mov eax, dword [esi + 8]
push 0x10006160
push str.OleCreateLinkToFile
push str.OLE32.DLL
push eax
call fcn.10014f80
mov ecx, dword [esi + 8]
push 0x10006090
push str.OleCreateLink
push str.OLE32.DLL
push ecx
call fcn.10014f80
mov edx, dword [esi + 8]
push 0x10006550
push str.OleCreateFromData
push str.OLE32.DLL
push edx
call fcn.10014f80
mov eax, dword [esi + 8]
push 0x10008140
push str.InternetConnectA
push str.wininet.dll
push eax
call fcn.10014f80
mov ecx, dword [esi + 8]
push 0x100081e0
push str.InternetConnectW
push str.wininet.dll
push ecx
call fcn.10014f80
mov edx, dword [esi + 8]
push 0x10008120
push str.InternetWriteFile
push str.wininet.dll
push edx
call fcn.10014f80
mov eax, dword [esi + 8]
push 0x10008280
push str.OpenPrinterA
push str.Winspool.drv
push eax
call fcn.10014f80
mov ecx, dword [esi + 8]
push 0x100084b0
push str.OpenPrinterW
push str.Winspool.drv
push ecx
call fcn.10014f80
mov edx, dword [esi + 8]
push 0x100086e0
push str.StartDocA
push str.Gdi32.dll
push edx
call fcn.10014f80
mov eax, dword [esi + 8]
push 0x10008910
push str.StartDocW
push str.Gdi32.dll
push eax
call fcn.10014f80
mov ecx, dword [esi + 8]
push 0x10008b40
push str.StartPage
push str.Gdi32.dll
push ecx
call fcn.10014f80
mov edx, dword [esi + 8]
push 0x10008b80
push str.EndPage
push str.Gdi32.dll
push edx
call fcn.10014f80
mov eax, dword [esi + 8]
push 0x10008bf0
push str.EndDoc
push str.Gdi32.dll
push eax
call fcn.10014f80
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 9]
mov byte [esp + 8], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 8]
push 0x104
push ecx
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea edx, [esp + 8]
push 0x10027108
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edi, eax
test edi, edi
je 0x100016b1
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.ReplaceFileA
push edi
call ebx
push str.ReplaceFileW
push edi
mov dword [0x10030b74], eax
call ebx
mov ecx, dword [0x10030b74]
push eax
push ecx
push str.GetProcAddress:_ReplaceFileA__0x___0x_
push 0x10027760
mov dword [0x10030b78], eax
call fcn.1000b440
add esp, 0x10
pop ebx
mov edx, dword [esi + 8]
push edx
call fcn.10014fb0
cmp eax, 1
pop edi
jne 0x100010b1
mov dword [esi + 4], eax
pop esi
add esp, 0x104
ret