Function at 0x5d28e0
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x60959e
mov eax, dword fs:[0]
push eax
sub esp, 0x10c
mov eax, dword [0x6aae14]
xor eax, esp
mov dword [esp + 0x108], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x6aae14]
xor eax, esp
push eax
lea eax, [esp + 0x120]
mov dword fs:[0], eax
mov esi, dword [esp + 0x130]
xor ebx, ebx
or ebp, 0xffffffff
test byte [0x768124], 1
mov dword [esp + 0x14], esi
jne 0x5d2960
or dword [0x768124], 1
mov ecx, 0x768090
mov dword [esp + 0x128], ebx
call fcn.004f29c0
push 0x60b820
call fcn.005e207e
add esp, 4
mov dword [esp + 0x128], ebp
cmp dword [0x768088], ebx
jne 0x5d2b02
push 0x768070
mov dword [0x768088], 1
call fcn.004da7f0
push 0x104
push 0x7675f8
mov byte [0x767e38], bl
mov byte [0x767d30], bl
call fcn.004ebf90
add esp, 0xc
push 0x104
push 0x767d30
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x767d30
call fcn.004e24e0
add esp, 4
call fcn.004d96c0
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
test eax, eax
je 0x5d29ed
push 0x767d30
push 0x767e38
call esi
push 0x61b114
push 0x61b108
push 0x767e38
call fcn.004e9030
add esp, 0xc
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
cmp byte [0x7675f8], bl
je 0x5d2a20
push 0x7675f8
push 0x767f40
call esi
push 0x767f40
call fcn.004e24e0
add esp, 4
push str.WinSxS_
push 0x767f40
call edi
push 0x7675f8
push 0x767700
call esi
push 0x767700
call fcn.004e24e0
add esp, 4
push str.assembly_
push 0x767700
call edi
push 0x767d30
push 0x767808
call esi
push 0x767808
call fcn.004e24e0
add esp, 4
push str.wdi_
push 0x767808
call edi
push 0x767d30
push 0x767910
call esi
push 0x767910
call fcn.004e24e0
add esp, 4
push str.LogFiles_
push 0x767910
call edi
push 0x767d30
push 0x767a18
call esi
push 0x767a18
call fcn.004e24e0
add esp, 4
push str.wfp_
push 0x767a18
call edi
push 0x7675f8
push 0x767b20
call esi
push 0x767b20
call fcn.004e24e0
add esp, 4
push str.ResCache_
push 0x767b20
call edi
push 0x7675f8
push 0x767c28
call esi
push 0x767c28
call fcn.004e24e0
add esp, 4
push str.PolicyDefinitions_
push 0x767c28
call edi
mov esi, dword [esp + 0x14]
cmp dword [0x76806c], ebx
jne 0x5d2b95
push 1
push ebx
push 0x2c
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x28]
push ecx
push str.CMF_TOC_HIT_adml_admx_PRI_ETL_BIN_FX_pckgdep_MUI_so_mab_txt_msstyles_pak_ani_EVTX_EVT_mdl_searchconnector_ms_CI_DIR_WID_DIA_WSB_MDF_LDF_BTR_MAP_VER_DATA_xrm_ms_heu_swz_cdf_ms_cat_mum_vdm_ttf_gthr_Crwl_automaticDestinations_ms_customDestinations_ms_regtrans_ms_blf_sdf_PNG_JPEG_JPG_BMP_NC_EFI_BMC_SQM_RSS_feedsdb_ms_feed_ms_CUR_DMP_EXTRA_tmp_ODF_winmd_API_LEX_DUB_DIC_OTF_PFB_BUD_GPD_PFM_CAB_down_data_XML_XAML_glox_PSQM_IMM_library_ms_theme_MSF_sbstore_cache_pset_OLB_PKG_h_lib_py_pyc_pyd_MSP_inf_ps1xml_clb_vmx_vmx_ini_pdb_js_x86_config_html_thmx_eftx_css_sdb_JSON_hxd_js_fmt_rsrc_srd_srd_wal_tlb_xsl_ps1_inl_pl_lua_WSQ_xhtml_3mf_luac_ptb_png0_WMF_cdxml_diagpkg_pnf_jfm_node_vol_htm_temp_ffm_m4a_mp4_qml_wma_vsv_acm
mov dword [esp + 0x2c], ebx
mov dword [0x76806c], 1
call fcn.004e1380
add esp, 0x18
cmp dword [esp + 0x14], ebp
je 0x5d2b8b
mov edi, edi
push 1
push ebx
lea edx, [esp + 0x20]
push edx
mov ecx, 0x768090
call fcn.004f2b40
test eax, eax
jne 0x5d2b69
lea eax, [esp + 0x18]
push eax
push str.DUPLICATE_EXT:__s
push ebx
call fcn.004f0f30
add esp, 0xc
push 1
push ebx
push 0x2c
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x28]
push edx
push str.CMF_TOC_HIT_adml_admx_PRI_ETL_BIN_FX_pckgdep_MUI_so_mab_txt_msstyles_pak_ani_EVTX_EVT_mdl_searchconnector_ms_CI_DIR_WID_DIA_WSB_MDF_LDF_BTR_MAP_VER_DATA_xrm_ms_heu_swz_cdf_ms_cat_mum_vdm_ttf_gthr_Crwl_automaticDestinations_ms_customDestinations_ms_regtrans_ms_blf_sdf_PNG_JPEG_JPG_BMP_NC_EFI_BMC_SQM_RSS_feedsdb_ms_feed_ms_CUR_DMP_EXTRA_tmp_ODF_winmd_API_LEX_DUB_DIC_OTF_PFB_BUD_GPD_PFM_CAB_down_data_XML_XAML_glox_PSQM_IMM_library_ms_theme_MSF_sbstore_cache_pset_OLB_PKG_h_lib_py_pyc_pyd_MSP_inf_ps1xml_clb_vmx_vmx_ini_pdb_js_x86_config_html_thmx_eftx_css_sdb_JSON_hxd_js_fmt_rsrc_srd_srd_wal_tlb_xsl_ps1_inl_pl_lua_WSQ_xhtml_3mf_luac_ptb_png0_WMF_cdxml_diagpkg_pnf_jfm_node_vol_htm_temp_ffm_m4a_mp4_qml_wma_vsv_acm
call fcn.004e1380
add esp, 0x18
cmp dword [esp + 0x14], ebp
jne 0x5d2b40
mov ecx, 0x768090
call fcn.004f3210
cmp esi, ebx
je 0x5d2bd1
cmp byte [esi], bl
je 0x5d2bd1
push 0x768070
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push ebx
push ebx
push esi
mov ecx, 0x768090
call fcn.004f2f50
push 0x768070
test eax, eax
je 0x5d2bcb
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, 1
jmp 0x5d2bd3
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
mov ecx, dword [esp + 0x120]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x108]
xor ecx, esp
call fcn.005dfbbe
add esp, 0x118
ret