Function at 0x100cdb9b
Capabilities:
Get common file path

Disassembly:
push 0x218
mov eax, 0x1016e5b3
call fcn.1012b6ae
mov esi, ecx
lea edi, [esi + 4]
mov ecx, edi
call fcn.10015f3e
add esi, 0x10
mov ecx, esi
call fcn.10015f3e
push 0x208
xor ebx, ebx
lea eax, [ebp - 0x218]
push ebx
push eax
call fcn.1012db70
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryW]
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x220]
call fcn.100088c7
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x224]
call fcn.100088c7
mov byte [ebp - 4], 1
lea eax, [ebp - 0x224]
push eax
mov ecx, edi
call fcn.10008790
mov byte [ebp - 4], bl
mov ecx, dword [ebp - 0x224]
lea ecx, [ecx - 0x10]
call fcn.100078bc
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x224]
call fcn.100088c7
mov byte [ebp - 4], 3
lea eax, [ebp - 0x224]
push eax
mov ecx, esi
call fcn.10008790
mov byte [ebp - 4], bl
mov ecx, dword [ebp - 0x224]
lea ecx, [ecx - 0x10]
call fcn.100078bc
call fcn.1012998f
mov ebx, dword [sym.imp.SHLWAPI.dll_PathAppendW]
mov eax, dword [eax + 4]
test eax, eax
mov dword [ebp - 0x224], eax
lea eax, [ebp - 0x218]
je 0x100cdd91
push dword [ebp - 0x220]
push 0x208
push eax
call fcn.100100b8
push str.syswow64
lea eax, [ebp - 0x218]
push eax
call ebx
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x21c]
call fcn.100088c7
mov byte [ebp - 4], 5
lea eax, [ebp - 0x21c]
push eax
mov ecx, edi
call fcn.10008790
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x21c]
lea ecx, [ecx - 0x10]
call fcn.100078bc
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x21c]
call fcn.100088c7
mov byte [ebp - 4], 7
lea eax, [ebp - 0x21c]
push eax
mov ecx, esi
call fcn.10008790
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x21c]
lea ecx, [ecx - 0x10]
call fcn.100078bc
push 1
lea eax, [ebp - 0x21c]
push 0
push eax
call fcn.100d49a9
add esp, 0xc
mov byte [ebp - 4], 9
mov ecx, edi
push eax
call fcn.10008790
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x21c]
lea ecx, [ecx - 0x10]
call fcn.100078bc
push dword [ebp - 0x220]
lea eax, [ebp - 0x218]
push 0x208
push eax
call fcn.100100b8
push 0x1018f794
lea eax, [ebp - 0x218]
push eax
call ebx
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x21c]
call fcn.100088c7
mov byte [ebp - 4], 0xb
lea eax, [ebp - 0x21c]
push eax
mov ecx, esi
call fcn.10008790
jmp 0x100cde0d
push 0x208
push 0
push eax
call fcn.1012db70
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x21c]
call fcn.100088c7
mov byte [ebp - 4], 0xd
lea eax, [ebp - 0x21c]
push eax
mov ecx, edi
call fcn.10008790
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x21c]
lea ecx, [ecx - 0x10]
call fcn.100078bc
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x21c]
call fcn.100088c7
mov byte [ebp - 4], 0xf
lea eax, [ebp - 0x21c]
push eax
mov ecx, esi
call fcn.10008790
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x21c]
lea ecx, [ecx - 0x10]
call fcn.100078bc
push dword [ebp - 0x220]
lea eax, [ebp - 0x218]
push 0x208
push eax
call fcn.100100b8
push str.system
lea eax, [ebp - 0x218]
push eax
call ebx
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x21c]
call fcn.100088c7
mov byte [ebp - 4], 0x11
lea eax, [ebp - 0x21c]
push eax
mov ecx, edi
call fcn.10008790
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x21c]
lea ecx, [ecx - 0x10]
call fcn.100078bc
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x21c]
call fcn.100088c7
mov byte [ebp - 4], 0x13
lea eax, [ebp - 0x21c]
push eax
mov ecx, esi
call fcn.10008790
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x21c]
lea ecx, [ecx - 0x10]
call fcn.100078bc
push dword [ebp - 0x220]
lea eax, [ebp - 0x218]
push 0x208
push eax
call fcn.100100b8
push str.fonts
lea eax, [ebp - 0x218]
push eax
call ebx
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x21c]
call fcn.100088c7
mov byte [ebp - 4], 0x15
lea eax, [ebp - 0x21c]
push eax
mov ecx, edi
call fcn.10008790
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x21c]
lea ecx, [ecx - 0x10]
call fcn.100078bc
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x21c]
call fcn.100088c7
mov byte [ebp - 4], 0x17
lea eax, [ebp - 0x21c]
push eax
mov ecx, esi
call fcn.10008790
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x21c]
lea ecx, [ecx - 0x10]
call fcn.100078bc
push dword [ebp - 0x220]
lea eax, [ebp - 0x218]
push 0x208
push eax
call fcn.100100b8
cmp dword [ebp - 0x224], 0
je 0x100ce05e
push 1
lea eax, [ebp - 0x21c]
push 0x1019dd18
push eax
call fcn.100d49a9
add esp, 0xc
mov byte [ebp - 4], 0x19
mov ecx, edi
push eax
call fcn.10008790
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x21c]
lea ecx, [ecx - 0x10]
call fcn.100078bc
push str.syswow64drivers
lea eax, [ebp - 0x218]
push eax
call ebx
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x21c]
call fcn.100088c7
mov byte [ebp - 4], 0x1b
lea eax, [ebp - 0x21c]
push eax
mov ecx, edi
call fcn.10008790
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x21c]
lea ecx, [ecx - 0x10]
call fcn.100078bc
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x21c]
call fcn.100088c7
mov byte [ebp - 4], 0x1d
lea eax, [ebp - 0x21c]
push eax
mov ecx, esi
call fcn.10008790
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x21c]
lea ecx, [ecx - 0x10]
call fcn.100078bc
push dword [ebp - 0x220]
lea eax, [ebp - 0x218]
push 0x208
push eax
call fcn.100100b8
push str.System32drivers
lea eax, [ebp - 0x218]
push eax
call ebx
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x21c]
call fcn.100088c7
mov byte [ebp - 4], 0x1f
lea eax, [ebp - 0x21c]
push eax
mov ecx, esi
call fcn.10008790
jmp 0x100ce0c6
push str.system32drivers
lea eax, [ebp - 0x218]
push eax
call ebx
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x21c]
call fcn.100088c7
mov byte [ebp - 4], 0x21
lea eax, [ebp - 0x21c]
push eax
mov ecx, edi
call fcn.10008790
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x21c]
lea ecx, [ecx - 0x10]
call fcn.100078bc
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x21c]
call fcn.100088c7
mov byte [ebp - 4], 0x23
lea eax, [ebp - 0x21c]
push eax
mov ecx, esi
call fcn.10008790
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x21c]
lea ecx, [ecx - 0x10]
call fcn.100078bc
push dword [ebp - 0x220]
lea eax, [ebp - 0x218]
push 0x208
push eax
call fcn.100100b8
cmp dword [ebp - 0x224], 0
lea eax, [ebp - 0x218]
je 0x100ce1f5
push str.syswow64wbem
push eax
call ebx
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x21c]
call fcn.100088c7
mov byte [ebp - 4], 0x25
lea eax, [ebp - 0x21c]
push eax
mov ecx, edi
call fcn.10008790
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x21c]
lea ecx, [ecx - 0x10]
call fcn.100078bc
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x21c]
call fcn.100088c7
mov byte [ebp - 4], 0x27
lea eax, [ebp - 0x21c]
push eax
mov ecx, esi
call fcn.10008790
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x21c]
lea ecx, [ecx - 0x10]
call fcn.100078bc
push 1
lea eax, [ebp - 0x21c]
push str.wbem
push eax
call fcn.100d49a9
add esp, 0xc
mov byte [ebp - 4], 0x29
mov ecx, edi
push eax
call fcn.10008790
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x21c]
lea ecx, [ecx - 0x10]
call fcn.100078bc
push dword [ebp - 0x220]
lea eax, [ebp - 0x218]
push 0x208
push eax
call fcn.100100b8
push str.System32wbem
lea eax, [ebp - 0x218]
push eax
call ebx
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x21c]
call fcn.100088c7
mov byte [ebp - 4], 0x2b
lea eax, [ebp - 0x21c]
push eax
mov ecx, esi
call fcn.10008790
jmp 0x100ce257
push str.System32wbem
push eax
call ebx
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x21c]
call fcn.100088c7
mov byte [ebp - 4], 0x2d
lea eax, [ebp - 0x21c]
push eax
mov ecx, edi
call fcn.10008790
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x21c]
lea ecx, [ecx - 0x10]
call fcn.100078bc
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x21c]
call fcn.100088c7
mov byte [ebp - 4], 0x2f
lea eax, [ebp - 0x21c]
push eax
mov ecx, esi
call fcn.10008790
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x21c]
lea ecx, [ecx - 0x10]
call fcn.100078bc
push dword [ebp - 0x220]
lea eax, [ebp - 0x218]
push 0x208
push eax
call fcn.100100b8
push str.temp
lea eax, [ebp - 0x218]
push eax
call ebx
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x21c]
call fcn.100088c7
mov byte [ebp - 4], 0x31
lea eax, [ebp - 0x21c]
push eax
mov ecx, edi
call fcn.10008790
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x21c]
lea ecx, [ecx - 0x10]
call fcn.100078bc
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x21c]
call fcn.100088c7
mov byte [ebp - 4], 0x33
lea eax, [ebp - 0x21c]
push eax
mov ecx, esi
call fcn.10008790
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x21c]
lea ecx, [ecx - 0x10]
call fcn.100078bc
push dword [ebp - 0x220]
lea eax, [ebp - 0x218]
push 0x208
push eax
call fcn.100100b8
push str.tasks
lea eax, [ebp - 0x218]
push eax
call ebx
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x21c]
call fcn.100088c7
mov byte [ebp - 4], 0x35
lea eax, [ebp - 0x21c]
push eax
mov ecx, edi
call fcn.10008790
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x21c]
lea ecx, [ecx - 0x10]
call fcn.100078bc
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x21c]
call fcn.100088c7
mov byte [ebp - 4], 0x37
lea eax, [ebp - 0x21c]
push eax
mov ecx, esi
call fcn.10008790
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x21c]
lea ecx, [ecx - 0x10]
call fcn.100078bc
push dword [ebp - 0x220]
lea eax, [ebp - 0x218]
push 0x208
push eax
call fcn.100100b8
push str.intel
lea eax, [ebp - 0x218]
push eax
call ebx
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x21c]
call fcn.100088c7
mov byte [ebp - 4], 0x39
lea eax, [ebp - 0x21c]
push eax
mov ecx, edi
call fcn.10008790
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x21c]
lea ecx, [ecx - 0x10]
call fcn.100078bc
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x21c]
call fcn.100088c7
mov byte [ebp - 4], 0x3b
lea eax, [ebp - 0x21c]
push eax
mov ecx, esi
call fcn.10008790
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x21c]
lea ecx, [ecx - 0x10]
call fcn.100078bc
push dword [ebp - 0x220]
lea eax, [ebp - 0x218]
push 0x208
push eax
call fcn.100100b8
cmp dword [ebp - 0x224], 0
je 0x100ce539
push 1
lea eax, [ebp - 0x21c]
push 0x1019ddb4
push eax
call fcn.100d49a9
add esp, 0xc
mov byte [ebp - 4], 0x3d
mov ecx, edi
push eax
call fcn.10008790
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x21c]
lea ecx, [ecx - 0x10]
call fcn.100078bc
push str.syswow64com
lea eax, [ebp - 0x218]
push eax
call ebx
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x21c]
call fcn.100088c7
mov byte [ebp - 4], 0x3f
lea eax, [ebp - 0x21c]
push eax
mov ecx, edi
call fcn.10008790
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x21c]
lea ecx, [ecx - 0x10]
call fcn.100078bc
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x21c]
call fcn.100088c7
mov byte [ebp - 4], 0x41
lea eax, [ebp - 0x21c]
push eax
mov ecx, esi
call fcn.10008790
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x21c]
lea ecx, [ecx - 0x10]
call fcn.100078bc
push dword [ebp - 0x220]
lea eax, [ebp - 0x218]
push 0x208
push eax
call fcn.100100b8
push str.System32com
lea eax, [ebp - 0x218]
push eax
call ebx
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x21c]
call fcn.100088c7
mov byte [ebp - 4], 0x43
lea eax, [ebp - 0x21c]
push eax
mov ecx, esi
call fcn.10008790
jmp 0x100ce5a1
push str.system32com
lea eax, [ebp - 0x218]
push eax
call ebx
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x21c]
call fcn.100088c7
mov byte [ebp - 4], 0x45
lea eax, [ebp - 0x21c]
push eax
mov ecx, edi
call fcn.10008790
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x21c]
lea ecx, [ecx - 0x10]
call fcn.100078bc
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x21c]
call fcn.100088c7
mov byte [ebp - 4], 0x47
lea eax, [ebp - 0x21c]
push eax
mov ecx, esi
call fcn.10008790
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x21c]
lea ecx, [ecx - 0x10]
call fcn.100078bc
push dword [ebp - 0x220]
lea eax, [ebp - 0x218]
push 0x208
push eax
call fcn.100100b8
push 0x1019de10
lea eax, [ebp - 0x218]
push eax
call ebx
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x21c]
call fcn.100088c7
mov byte [ebp - 4], 0x49
lea eax, [ebp - 0x21c]
push eax
mov ecx, edi
call fcn.10008790
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x21c]
lea ecx, [ecx - 0x10]
call fcn.100078bc
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x21c]
call fcn.100088c7
mov byte [ebp - 4], 0x4b
lea eax, [ebp - 0x21c]
push eax
mov ecx, esi
call fcn.10008790
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x21c]
lea ecx, [ecx - 0x10]
call fcn.100078bc
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x220]
add ecx, 0xfffffff0
call fcn.100078bc
xor eax, eax
inc eax
call fcn.1012b658
ret