Function at 0xa5c820
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0xa9a9ee
mov eax, dword fs:[0]
push eax
sub esp, 0x114
mov eax, dword [0xb196ec]
xor eax, esp
mov dword [esp + 0x110], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0xb196ec]
xor eax, esp
push eax
lea eax, [esp + 0x128]
mov dword fs:[0], eax
mov esi, ecx
or ebp, 0xffffffff
test byte [0xc0fd84], 1
mov dword [esp + 0x18], esi
jne 0xa5c89d
or dword [0xc0fd84], 1
xor ebx, ebx
mov ecx, 0xc0fcf0
mov dword [esp + 0x130], ebx
call fcn.0097f770
push 0xa9d630
call fcn.00a7a607
add esp, 4
mov dword [esp + 0x130], ebp
jmp 0xa5c89f
xor ebx, ebx
cmp dword [0xc0da04], ebx
jne 0xa5cb41
push 0x1f40
push 0xc0fcd8
mov dword [0xc0da04], 1
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
test eax, eax
jne 0xa5c8d4
push 0xc0fcd8
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov edi, 0x104
mov ecx, 0xbe0d78
mov byte [0xbe15b8], bl
mov byte [0xbe14b0], bl
call fcn.00958630
push edi
push 0xbe14b0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
cmp byte [0xbe14b0], bl
je 0xa5c931
mov eax, 0xbe14b0
mov edi, edi
inc eax
cmp byte [eax], bl
jne 0xa5c910
sub eax, 0xbe14b0
je 0xa5c931
cmp byte [eax + 0xbe14af], 0x5c
je 0xa5c931
push 0xaa1564
push 0xbe14b0
call esi
call fcn.00968110
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
test eax, eax
je 0xa5c963
push 0xbe14b0
push 0xbe15b8
call edi
push str._syswow64_
push str._system32_
push 0xbe15b8
call fcn.0095e130
add esp, 0xc
cmp byte [0xbe0d78], bl
je 0xa5c98d
push 0xbe0d78
push str.C:WINDOWSWinSxS_
call edi
mov ecx, str.C:WINDOWSWinSxS_
call fcn.00960910
push str.WinSxS_
push str.C:WINDOWSWinSxS_
call esi
push 0xbe0d78
push str.C:WINDOWS_assembly_
call edi
cmp byte [str.C:WINDOWS_assembly_], bl
je 0xa5c9c7
mov eax, str.C:WINDOWS_assembly_
inc eax
cmp byte [eax], bl
jne 0xa5c9a6
sub eax, str.C:WINDOWS_assembly_
je 0xa5c9c7
cmp byte [eax + 0xbe0e7f], 0x5c
je 0xa5c9c7
push 0xaa1564
push str.C:WINDOWS_assembly_
call esi
push str.assembly_
push str.C:WINDOWS_assembly_
call esi
push 0xbe14b0
push str.C:WINDOWS_system32wdi_
call edi
cmp byte [str.C:WINDOWS_system32wdi_], bl
je 0xa5ca11
mov eax, str.C:WINDOWS_system32wdi_
lea esp, [esp]
inc eax
cmp byte [eax], bl
jne 0xa5c9f0
sub eax, str.C:WINDOWS_system32wdi_
je 0xa5ca11
cmp byte [eax + 0xbe0f87], 0x5c
je 0xa5ca11
push 0xaa1564
push str.C:WINDOWS_system32wdi_
call esi
push str.wdi_
push str.C:WINDOWS_system32wdi_
call esi
push 0xbe14b0
push str.C:WINDOWS_system32LogFiles_
call edi
cmp byte [str.C:WINDOWS_system32LogFiles_], bl
je 0xa5ca57
mov eax, str.C:WINDOWS_system32LogFiles_
inc eax
cmp byte [eax], bl
jne 0xa5ca36
sub eax, str.C:WINDOWS_system32LogFiles_
je 0xa5ca57
cmp byte [eax + 0xbe108f], 0x5c
je 0xa5ca57
push 0xaa1564
push str.C:WINDOWS_system32LogFiles_
call esi
push str.LogFiles_
push str.C:WINDOWS_system32LogFiles_
call esi
push 0xbe14b0
push str.C:WINDOWS_system32wfp_
call edi
cmp byte [str.C:WINDOWS_system32wfp_], bl
je 0xa5caa1
mov eax, str.C:WINDOWS_system32wfp_
lea esp, [esp]
inc eax
cmp byte [eax], bl
jne 0xa5ca80
sub eax, str.C:WINDOWS_system32wfp_
je 0xa5caa1
cmp byte [eax + 0xbe1197], 0x5c
je 0xa5caa1
push 0xaa1564
push str.C:WINDOWS_system32wfp_
call esi
push str.wfp_
push str.C:WINDOWS_system32wfp_
call esi
push 0xbe0d78
push str.C:WINDOWSResCache_
call edi
cmp byte [str.C:WINDOWSResCache_], bl
je 0xa5cae7
mov eax, str.C:WINDOWSResCache_
inc eax
cmp byte [eax], bl
jne 0xa5cac6
sub eax, str.C:WINDOWSResCache_
je 0xa5cae7
cmp byte [eax + 0xbe129f], 0x5c
je 0xa5cae7
push 0xaa1564
push str.C:WINDOWSResCache_
call esi
push str.ResCache_
push str.C:WINDOWSResCache_
call esi
push 0xbe0d78
push str.C:WINDOWSPolicyDefinitions_
call edi
cmp byte [str.C:WINDOWSPolicyDefinitions_], bl
je 0xa5cb31
mov eax, str.C:WINDOWSPolicyDefinitions_
lea esp, [esp]
inc eax
cmp byte [eax], bl
jne 0xa5cb10
sub eax, str.C:WINDOWSPolicyDefinitions_
je 0xa5cb31
cmp byte [eax + 0xbe13a7], 0x5c
je 0xa5cb31
push 0xaa1564
push str.C:WINDOWSPolicyDefinitions_
call esi
push str.PolicyDefinitions_
push str.C:WINDOWSPolicyDefinitions_
call esi
mov esi, dword [esp + 0x18]
cmp dword [0xc0da00], ebx
jne 0xa5cbd3
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x1c], ebx
push str.CMF_TOC_HIT_adml_admx_PRI_ETL_BIN_FX_pckgdep_MUI_so_mab_txt_msstyles_pak_ani_EVTX_EVT_mdl_searchconnector_ms_CI_DIR_WID_DIA_WSB_MDF_LDF_BTR_MAP_VER_DATA_heu_swz_cdf_ms_cat_mum_vdm_ttf_gthr_Crwl_automaticDestinations_ms_customDestinations_ms_regtrans_ms_db_journal_blf_sdf_PNG_gif_JPEG_JPG_BMP_NC_EFI_BMC_SQM_RSS_feedsdb_ms_feed_ms_CUR_DMP_EXTRA_tmp_ODF_winmd_API_LEX_DUB_DIC_OTF_PFB_BUD_GPD_PFM_CAB_down_data_XML_XAML_glox_PSQM_IMM_library_ms_theme_MSF_sbstore_cache_pset_OLB_PKG_h_lib_py_pyc_pyd_MSP_inf_ps1xml_clb_vmx_vmx_ini_pdb_js_x86_config_html_thmx_eftx_css_fae_sdb_JSON_hxd_js_fmt_rsrc_srd_srd_wal_tlb_xsl_ps1_inl_pl_lua_WSQ_xhtml_3mf_luac_ptb_png0_WMF_cdxml_diagpkg_pnf_jfm_node_vol_htm_temp_ffm_m4a_mp4_qml_wma_vsv_acm_rll_mid_xap_wav_chm_dpv_flt_cnv_sam_tps_bundle_elm_xlat_mdmp_mof_mai_mad_gzip_header_dist_sucatalog_mun_qss_store_store_new_bytes_obj_freebsd5_x86_freebsd7_x86_linux_x86_linux_x86_wg_macosx_x86_solaris10_x86
mov bl, 0x2c
lea edi, [esp + 0x24]
mov dword [0xc0da00], 1
call fcn.0095ae80
add esp, 8
cmp dword [esp + 0x18], ebp
je 0xa5cbc7
lea esp, [esp]
push 1
push 0
lea ecx, [esp + 0x24]
mov edx, 0xc0fcf0
call fcn.0097faa0
test eax, eax
jne 0xa5cba9
lea ecx, [esp + 0x1c]
push ecx
push str.DUPLICATE_EXT:__s
push eax
call fcn.0096a780
add esp, 0xc
lea edx, [esp + 0x18]
push edx
push str.CMF_TOC_HIT_adml_admx_PRI_ETL_BIN_FX_pckgdep_MUI_so_mab_txt_msstyles_pak_ani_EVTX_EVT_mdl_searchconnector_ms_CI_DIR_WID_DIA_WSB_MDF_LDF_BTR_MAP_VER_DATA_heu_swz_cdf_ms_cat_mum_vdm_ttf_gthr_Crwl_automaticDestinations_ms_customDestinations_ms_regtrans_ms_db_journal_blf_sdf_PNG_gif_JPEG_JPG_BMP_NC_EFI_BMC_SQM_RSS_feedsdb_ms_feed_ms_CUR_DMP_EXTRA_tmp_ODF_winmd_API_LEX_DUB_DIC_OTF_PFB_BUD_GPD_PFM_CAB_down_data_XML_XAML_glox_PSQM_IMM_library_ms_theme_MSF_sbstore_cache_pset_OLB_PKG_h_lib_py_pyc_pyd_MSP_inf_ps1xml_clb_vmx_vmx_ini_pdb_js_x86_config_html_thmx_eftx_css_fae_sdb_JSON_hxd_js_fmt_rsrc_srd_srd_wal_tlb_xsl_ps1_inl_pl_lua_WSQ_xhtml_3mf_luac_ptb_png0_WMF_cdxml_diagpkg_pnf_jfm_node_vol_htm_temp_ffm_m4a_mp4_qml_wma_vsv_acm_rll_mid_xap_wav_chm_dpv_flt_cnv_sam_tps_bundle_elm_xlat_mdmp_mof_mai_mad_gzip_header_dist_sucatalog_mun_qss_store_store_new_bytes_obj_freebsd5_x86_freebsd7_x86_linux_x86_linux_x86_wg_macosx_x86_solaris10_x86
mov bl, 0x2c
lea edi, [esp + 0x24]
call fcn.0095ae80
add esp, 8
cmp dword [esp + 0x18], ebp
jne 0xa5cb80
mov ecx, 0xc0fcf0
call fcn.00980480
xor ebx, ebx
cmp esi, ebx
je 0xa5cc0f
cmp byte [esi], bl
je 0xa5cc0f
push 0xc0fcd8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push esi
xor ecx, ecx
mov edx, 0xc0fcf0
call fcn.00980160
push 0xc0fcd8
test eax, eax
je 0xa5cc09
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, 1
jmp 0xa5cc11
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
mov ecx, dword [esp + 0x128]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x110]
xor ecx, esp
call fcn.00a78f21
add esp, 0x120
ret