Function at 0xa691a0
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0xa9b45e
mov eax, dword fs:[0]
push eax
sub esp, 0x824
mov eax, dword [0xb196ec]
xor eax, esp
mov dword [esp + 0x820], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0xb196ec]
xor eax, esp
push eax
lea eax, [esp + 0x838]
mov dword fs:[0], eax
test byte [0xc11704], 1
mov eax, dword [esp + 0x848]
mov esi, ecx
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], esi
jne 0xa69229
or dword [0xc11704], 1
xor ebp, ebp
mov ecx, 0xc11670
mov dword [esp + 0x840], ebp
call fcn.0097f770
push 0xa9d650
call fcn.00a7a607
add esp, 4
mov dword [esp + 0x840], 0xffffffff
jmp 0xa6922b
xor ebp, ebp
push 0x207
lea ecx, [esp + 0x29]
push ebp
push ecx
mov dword [esp + 0x24], ebp
mov byte [esp + 0x30], 0
call fcn.00a7ffb0
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
add esp, 0xc
cmp byte [str.C:WINDOWS_], 0
jne 0xa69309
mov edi, 0x104
mov ecx, str.C:WINDOWS_
call fcn.00958630
cmp byte [str.C:WINDOWS_], 0
je 0xa69299
mov eax, str.C:WINDOWS_
inc eax
cmp byte [eax], 0
jne 0xa69277
sub eax, str.C:WINDOWS_
je 0xa69299
cmp byte [eax + 0xc0e287], 0x5c
je 0xa69299
push 0xaa1564
push str.C:WINDOWS_
call ebx
push 0x104
push str.C:WINDOWS_system32_
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp byte [str.C:WINDOWS_system32_], 0
je 0xa692d9
mov eax, str.C:WINDOWS_system32_
inc eax
cmp byte [eax], 0
jne 0xa692b7
sub eax, str.C:WINDOWS_system32_
je 0xa692d9
cmp byte [eax + 0xc0e38f], 0x5c
je 0xa692d9
push 0xaa1564
push str.C:WINDOWS_system32_
call ebx
call fcn.00968110
test eax, eax
je 0xa69309
push str.C:WINDOWS_system32_
push str.C:WINDOWS_syswow64_
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str._syswow64_
push str._system32_
push str.C:WINDOWS_syswow64_
call fcn.0095e130
add esp, 0xc
push str.C:WINDOWS_
push str.C:WINDOWSSystemApps_
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp byte [str.C:WINDOWSSystemApps_], 0
je 0xa69349
mov eax, str.C:WINDOWSSystemApps_
inc eax
cmp byte [eax], 0
jne 0xa69327
sub eax, str.C:WINDOWSSystemApps_
je 0xa69349
cmp byte [eax + 0xc0e17f], 0x5c
je 0xa69349
push 0xaa1564
push str.C:WINDOWSSystemApps_
call ebx
push str.SystemApps_
push str.C:WINDOWSSystemApps_
call ebx
cmp dword [0xc0e174], ebp
jne 0xa69386
push 0x1f40
push 0xc11658
mov dword [0xc0e174], 1
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
test eax, eax
jne 0xa69386
push 0xc11658
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
cmp esi, ebp
je 0xa6938c
mov dword [esi], ebp
push 0xc11658
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0xb50fec]
cmp eax, 0xffffffff
jne 0xa69432
cmp byte [str.C:PROGRA2eScan_sysfiles.avs], 0
jne 0xa69463
mov esi, str.C:PROGRA2eScan_sysfiles.avs
call fcn.009899d0
mov ecx, esi
call fcn.00960910
push str.sysfiles.avs
push esi
call ebx
push 1
push ebp
xor edx, edx
mov ecx, esi
call fcn.0095a0f0
add esp, 8
test eax, eax
je 0xa693f4
mov esi, dword [esp + 0x1c]
mov dword [0xb50fec], ebp
mov dword [str.userinit.exe_winlogon.exe_windowsupdate.exe_conhost.exe_taskhost.exe_DllHost.exe_svchost.exe_taskeng.exe_spoolsv.exe_logonui.exe_smss.exe_csrss.exe_wininit.exe_lsass.exe_services.exe_wmiprvse.exe_rundll32.exe], 0xb50f18
jmp 0xa69463
push str.C:PROGRA2eScan_sysfiles.avs
push 0xc0e5a0
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 1
mov ecx, 0xc0e5a0
call fcn.00978530
test eax, eax
je 0xa693de
mov eax, dword [0xc0e7a8]
cmp eax, ebp
je 0xa693de
mov esi, dword [esp + 0x1c]
mov dword [0xb50fec], 1
mov dword [str.userinit.exe_winlogon.exe_windowsupdate.exe_conhost.exe_taskhost.exe_DllHost.exe_svchost.exe_taskeng.exe_spoolsv.exe_logonui.exe_smss.exe_csrss.exe_wininit.exe_lsass.exe_services.exe_wmiprvse.exe_rundll32.exe], eax
jmp 0xa69463
cmp eax, 1
jne 0xa69463
push eax
mov ecx, 0xc0e5a0
call fcn.00978530
cmp eax, 1
jne 0xa69463
mov ecx, 0xc11670
mov dword [0xc0e170], ebp
call fcn.0097f8c0
mov edx, dword [0xc0e7a8]
mov dword [str.userinit.exe_winlogon.exe_windowsupdate.exe_conhost.exe_taskhost.exe_DllHost.exe_svchost.exe_taskeng.exe_spoolsv.exe_logonui.exe_smss.exe_csrss.exe_wininit.exe_lsass.exe_services.exe_wmiprvse.exe_rundll32.exe], edx
cmp dword [0xc0e170], ebp
jne 0xa6954c
mov eax, dword [0xc0e178]
mov dword [0xc0e170], 1
test eax, eax
je 0xa69495
push eax
call fcn.00a78fec
add esp, 4
mov dword [0xc0e178], 0
mov ecx, dword [str.userinit.exe_winlogon.exe_windowsupdate.exe_conhost.exe_taskhost.exe_DllHost.exe_svchost.exe_taskeng.exe_spoolsv.exe_logonui.exe_smss.exe_csrss.exe_wininit.exe_lsass.exe_services.exe_wmiprvse.exe_rundll32.exe]
lea eax, [esp + 0x18]
push eax
push ecx
mov bl, 0x2c
lea edi, [esp + 0x234]
call fcn.0095ae80
or ebp, 0xffffffff
add esp, 8
cmp dword [esp + 0x18], ebp
je 0xa69526
jmp 0xa694c0
lea edx, [esp + 0x22c]
push 0x5c
push edx
call fcn.00a7a2c0
add esp, 8
test eax, eax
je 0xa694ee
push 0
push 0x2c
lea eax, [esp + 0x234]
push eax
mov edi, 0xc0e178
call fcn.0098d640
jmp 0xa69503
push 1
push 0
lea ecx, [esp + 0x234]
mov edx, 0xc11670
call fcn.0097faa0
mov edx, dword [str.userinit.exe_winlogon.exe_windowsupdate.exe_conhost.exe_taskhost.exe_DllHost.exe_svchost.exe_taskeng.exe_spoolsv.exe_logonui.exe_smss.exe_csrss.exe_wininit.exe_lsass.exe_services.exe_wmiprvse.exe_rundll32.exe]
lea ecx, [esp + 0x18]
push ecx
push edx
mov bl, 0x2c
lea edi, [esp + 0x234]
call fcn.0095ae80
add esp, 8
cmp dword [esp + 0x18], ebp
jne 0xa694c0
mov ecx, 0xc11670
call fcn.00980480
mov eax, dword [0xc0e7a8]
test eax, eax
je 0xa6954c
push eax
call fcn.00a78fec
add esp, 4
mov dword [0xc0e7a8], 0
mov eax, dword [esp + 0x84c]
test eax, eax
je 0xa69602
cmp byte [eax], 0
je 0xa69602
lea edx, [esp + 0x24]
sub edx, eax
lea ebx, [ebx]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0xa69570
push 1
lea eax, [esp + 0x28]
push eax
call fcn.00977760
lea ecx, [esp + 0x24]
push 0x7e
push ecx
call fcn.00a7a2c0
add esp, 8
test eax, eax
je 0xa695eb
push 0x3ff
lea edx, [esp + 0x231]
push 0
push edx
call fcn.00a7ffb0
add esp, 0xc
push 0x400
lea eax, [esp + 0x230]
push eax
lea ecx, [esp + 0x2c]
push ecx
mov byte [esp + 0x238], 0
call dword [str.__0uBlocked]
dec eax
cmp eax, 0x206
ja 0xa695eb
lea edx, [esp + 0x22c]
push edx
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [esp + 0x24]
push 0x25
push ecx
call fcn.00a7a2c0
add esp, 8
test eax, eax
jne 0xa697c2
mov ebp, dword [esp + 0x20]
test ebp, ebp
je 0xa69738
cmp byte [ebp], 0
je 0xa69738
cmp byte [esp + 0x24], 0
je 0xa69660
push str.ShellExperienceHost.exe
push ebp
call fcn.00a88f66
add esp, 8
test eax, eax
jne 0xa69660
test esi, esi
je 0xa6964b
mov eax, str.C:WINDOWSSystemApps_
lea ecx, [esp + 0x24]
call fcn.0094c3e0
neg eax
sbb eax, eax
neg eax
mov dword [esi], eax
push 0xc11658
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, 1
jmp 0xa697c4
cmp byte [ebp], 0
je 0xa69738
cmp byte [esp + 0x24], 0
je 0xa696d6
push str.MsMpEng.exe
push ebp
call fcn.00a88f66
add esp, 8
test eax, eax
je 0xa69695
push str.MpCmdRun.exe
push ebp
call fcn.00a88f66
add esp, 8
test eax, eax
jne 0xa696d6
test esi, esi
je 0xa6964b
push 0
lea edx, [esp + 0x28]
push 0xacc4d8
push edx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0xa6972d
push 0
lea eax, [esp + 0x28]
push str.Microsoft_Security_Client_
push eax
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0xa6972d
mov dword [esi], 1
jmp 0xa6964b
cmp byte [ebp], 0
je 0xa69738
cmp byte [esp + 0x24], 0
je 0xa697b7
push ebp
xor ecx, ecx
mov edx, 0xc11670
call fcn.00980160
test eax, eax
je 0xa69738
test esi, esi
je 0xa6964b
mov eax, str.C:WINDOWS_system32_
lea ecx, [esp + 0x24]
call fcn.0094c3e0
test eax, eax
je 0xa6972d
cmp byte [str.C:WINDOWS_syswow64_], 0
je 0xa696cb
mov eax, str.C:WINDOWS_syswow64_
lea ecx, [esp + 0x24]
call fcn.0094c3e0
test eax, eax
jne 0xa696cb
mov dword [esi], 0
jmp 0xa6964b
cmp byte [esp + 0x24], 0
je 0xa697b7
mov eax, dword [0xc0e178]
test eax, eax
je 0xa697b7
lea ecx, [esp + 0x18]
push ecx
push eax
mov bl, 0x2c
lea edi, [esp + 0x634]
mov dword [esp + 0x20], 0
call fcn.0095ae80
add esp, 8
cmp dword [esp + 0x18], 0xffffffff
je 0xa697b7
lea edx, [esp + 0x62c]
push 0x5c
push edx
call fcn.00a7aa50
add esp, 8
test eax, eax
je 0xa69793
inc eax
push ebp
push eax
call fcn.00a88f66
add esp, 8
test eax, eax
je 0xa697ec
mov ecx, dword [0xc0e178]
lea eax, [esp + 0x18]
push eax
push ecx
mov bl, 0x2c
lea edi, [esp + 0x634]
call fcn.0095ae80
add esp, 8
cmp dword [esp + 0x18], 0xffffffff
jne 0xa6976e
push 0xc11658
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
mov ecx, dword [esp + 0x838]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x820]
xor ecx, esp
call fcn.00a78f21
add esp, 0x830
ret
test esi, esi
je 0xa6964b
push 0
lea edx, [esp + 0x630]
push edx
lea eax, [esp + 0x2c]
push eax
call fcn.0095c8c0
xor ecx, ecx
add esp, 0xc
cmp eax, 0xffffffff
sete cl
mov dword [esi], ecx
jmp 0xa6964b