Function at 0x100666f6
Capabilities:
Get common file path

Disassembly:
mov eax, 0x100a47e9
call fcn.1007c8b4
sub esp, 0x378
push ebx
xor ebx, ebx
mov dword [ebp - 0x30], 0xf
push esi
mov dword [ebp - 0x44], ebx
push edi
mov dword [ebp - 0x34], ebx
mov byte [ebp - 0x44], bl
lea eax, [ebp - 0x44]
mov dword [ebp - 4], ebx
push eax
push dword [ebp + 0x34]
call fcn.10068546
cmp dword [ebp - 0x30], 0x10
lea edx, [ebp - 0x44]
mov eax, dword [ebp - 0x34]
mov edi, 0x1000
cmovae edx, dword [ebp - 0x44]
pop ecx
pop ecx
test eax, eax
je 0x10066a6b
dec eax
or esi, 0xffffffff
cmp eax, esi
mov ecx, esi
cmovb ecx, eax
add ecx, edx
jmp 0x1006675f
cmp ecx, edx
je 0x10066a6b
dec ecx
cmp byte [ecx], 0x5c
jne 0x10066756
sub ecx, edx
cmp ecx, esi
je 0x10066a6b
lea eax, [ecx + 1]
mov dword [ebp - 0x74], ebx
push esi
push eax
lea eax, [ebp - 0x44]
mov dword [ebp - 0x64], ebx
push eax
lea ecx, [ebp - 0x74]
mov dword [ebp - 0x60], 0xf
call fcn.1000600f
mov byte [ebp - 0x10], bl
lea eax, [ebp - 0x74]
push dword [ebp - 0x10]
lea ecx, [ebp - 0x44]
push eax
call fcn.10005e62
mov eax, dword [ebp - 0x60]
cmp eax, 0x10
jb 0x100667d2
mov ecx, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x10], ecx
cmp eax, edi
jb 0x100667c9
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.10001c26
mov eax, dword [ebp - 0x2c]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x10]
push eax
push ecx
call fcn.1007c382
pop ecx
pop ecx
push 0x20a
lea eax, [ebp - 0x384]
push ebx
push eax
call fcn.1007f880
add esp, 0xc
lea eax, [ebp - 0x384]
push 0x105
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x10066a6b
xor eax, eax
mov dword [ebp - 0x5c], ebx
push 7
pop esi
mov word [ebp - 0x5c], ax
lea ecx, [ebp - 0x5c]
lea eax, [ebp - 0x384]
mov dword [ebp - 0x4c], ebx
push eax
mov dword [ebp - 0x48], esi
call fcn.10004f55
xor eax, eax
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], esi
mov word [ebp - 0x28], ax
cmp byte [ebp + 0x34], 0
mov ecx, str._syswow64
push 2
pop eax
mov byte [ebp - 4], al
mov eax, str._system32
cmovne eax, ecx
lea ecx, [ebp - 0x5c]
push eax
call fcn.10008d69
push str._rundll32.exe
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x74]
push eax
call fcn.1005f25b
lea ecx, [ebp - 0x28]
add esp, 0xc
cmp ecx, eax
je 0x10066879
mov byte [ebp + 0x34], bl
push dword [ebp + 0x34]
push eax
call fcn.10008d8e
lea ecx, [ebp - 0x74]
call fcn.100050be
cmp dword [ebp - 0x30], 0x10
lea eax, [ebp - 0x44]
lea ecx, [ebp - 0x174]
cmovae eax, dword [ebp - 0x44]
push 3
mov dword [ebp - 0x178], ecx
lea ecx, [ebp - 0x178]
push eax
call fcn.100599a6
push dword [ebp - 0x178]
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 3
call fcn.10008d69
push 2
lea eax, [ebp - 0x174]
pop ebx
mov byte [ebp - 4], bl
cmp dword [ebp - 0x178], eax
je 0x100668d8
push dword [ebp - 0x178]
call fcn.1008582f
pop ecx
push str._RunProcWithDll
lea ecx, [ebp - 0x28]
call fcn.10008d69
push dword [ebp + 0x10]
lea ecx, [ebp - 0x28]
call fcn.10008d69
mov eax, dword [ebp - 0x18]
xor ecx, ecx
inc eax
mul ebx
push 0x100ae7f8
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1007ca30
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
jne 0x10066940
push dword [ebp + 0x30]
push dword [ebp + 0x2c]
push dword [ebp + 0x28]
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [0x100d3528]
mov esi, eax
jmp 0x100669d8
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
mov eax, dword [ebp - 0x18]
inc eax
push eax
push ebx
call fcn.1008adf2
add esp, 0xc
call fcn.10079530
test eax, eax
je 0x100669a2
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push str.Wow64DisableWow64FsRedirection
push 0x100aa62c
call edi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call esi
push str.Wow64RevertWow64FsRedirection
push 0x100aa62c
mov dword [ebp + 0x10], eax
call edi
push eax
call esi
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x1006699d
lea ecx, [ebp + 0x28]
push ecx
call eax
mov edi, 0x1000
push dword [ebp + 0x30]
cmp dword [ebp - 0x48], 8
lea eax, [ebp - 0x5c]
push dword [ebp + 0x2c]
cmovae eax, dword [ebp - 0x5c]
push eax
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push ebx
push 0
push dword [ebp + 8]
call dword [0x100d3528]
push ebx
mov esi, eax
call fcn.1007c98c
pop ecx
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x10066a12
mov ecx, dword [ebp - 0x28]
lea eax, [eax*2 + 2]
mov dword [ebp + 0x30], eax
mov dword [ebp + 0x2c], ecx
cmp eax, edi
jb 0x10066a09
lea eax, [ebp + 0x30]
push eax
lea eax, [ebp + 0x2c]
push eax
call fcn.10001c26
mov eax, dword [ebp + 0x30]
pop ecx
pop ecx
mov ecx, dword [ebp + 0x2c]
push eax
push ecx
call fcn.1007c382
pop ecx
pop ecx
and dword [ebp - 0x18], 0
xor eax, eax
push 7
mov word [ebp - 0x28], ax
mov eax, dword [ebp - 0x48]
pop ebx
mov dword [ebp - 0x14], ebx
cmp eax, 8
jb 0x10066a5c
mov ecx, dword [ebp - 0x5c]
lea eax, [eax*2 + 2]
mov dword [ebp + 0x30], eax
mov dword [ebp + 0x2c], ecx
cmp eax, edi
jb 0x10066a53
lea eax, [ebp + 0x30]
push eax
lea eax, [ebp + 0x2c]
push eax
call fcn.10001c26
mov eax, dword [ebp + 0x30]
pop ecx
pop ecx
mov ecx, dword [ebp + 0x2c]
push eax
push ecx
call fcn.1007c382
pop ecx
pop ecx
and dword [ebp - 0x4c], 0
xor eax, eax
mov dword [ebp - 0x48], ebx
mov word [ebp - 0x5c], ax
jmp 0x10066a94
push dword [ebp + 0x30]
push dword [ebp + 0x2c]
push dword [ebp + 0x28]
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [0x100d3528]
mov esi, eax
mov eax, dword [ebp - 0x30]
cmp eax, 0x10
jb 0x10066ac8
mov ecx, dword [ebp - 0x44]
inc eax
mov dword [ebp + 0x30], eax
mov dword [ebp + 0x2c], ecx
cmp eax, edi
jb 0x10066abf
lea eax, [ebp + 0x30]
push eax
lea eax, [ebp + 0x2c]
push eax
call fcn.10001c26
mov eax, dword [ebp + 0x30]
pop ecx
pop ecx
mov ecx, dword [ebp + 0x2c]
push eax
push ecx
call fcn.1007c382
pop ecx
pop ecx
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0x30