Function at 0x1005b620
Capabilities:
Get common file path
Query environment variable

Disassembly:
push ebp
lea ebp, [esp - 0xe1c]
sub esp, 0xe1c
push 0xfffffffffffffffe
push 0x1016d540
push 0x10118480
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x1017455c]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp + 0xe18], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov esi, ecx
mov dword [ebp - 0x20], esi
xor edi, edi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x30], edi
mov byte [ebp + 0xa08], 0
push 0x103
push edi
lea eax, [ebp + 0xa09]
push eax
call fcn.10116880
mov byte [ebp + 0x800], 0
push 0x103
push edi
lea ecx, [ebp + 0x801]
push ecx
call fcn.10116880
add esp, 0x18
xor ebx, ebx
mov dword [ebp - 0x24], ebx
cmp esi, edi
jne 0x1005b6c0
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
jmp 0x1005bf2b
mov al, 0x25
mov edx, esi
call fcn.1005a900
mov edx, 1
cmp byte [esi], 0x22
jne 0x1005b6d8
mov dword [ebp - 0x24], edx
mov ebx, edx
cmp eax, edi
jbe 0x1005b6e0
test dl, al
je 0x1005b70a
mov cl, byte [esi + ebx]
cmp cl, 0x5c
jne 0x1005b6f4
mov al, byte [esi + ebx + 1]
cmp al, 0x73
je 0x1005b70a
cmp al, 0x53
je 0x1005b70a
cmp cl, 0x73
je 0x1005b6fe
cmp cl, 0x53
jne 0x1005b6b2
mov al, byte [esi + ebx + 1]
cmp al, 0x79
je 0x1005b70a
cmp al, 0x59
jne 0x1005b6b2
mov dword [ebp - 0x30], edx
cmp dword [0x1019fffc], edx
jne 0x1005b7b5
cmp byte [0x1019fef8], 0
je 0x1005b7b5
cmp dword [ebp + 0xe24], edi
je 0x1005b7b5
mov byte [ebp + 0xc10], 0
push 0x103
push edi
lea edx, [ebp + 0xc11]
push edx
call fcn.10116880
add esp, 0xc
mov dword [ebp - 0x28], 0x104
lea ecx, [ebp - 0x28]
lea edx, [ebp + 0xc10]
call fcn.10037780
test eax, eax
je 0x1005b7b5
mov eax, dword [ebp - 0x28]
mov byte [ebp + eax + 0xc10], 0
lea edi, [ebp + 0xc10]
call fcn.1005daa0
mov eax, 0x1019fef8
mov ecx, edi
call fcn.10031890
test eax, eax
je 0x1005b7b5
mov dword [0x1019fffc], 0
push 0x104
push 0
push 0x1019fef8
call fcn.10116880
add esp, 0xc
mov dword [0x1018ccb0], 0x104
cmp dword [0x1019fffc], 0
jne 0x1005ba41
mov byte [ebp + 0xd14], 0
push 0x103
push 0
lea ecx, [ebp + 0xd15]
push ecx
call fcn.10116880
add esp, 0xc
mov ecx, 0x1018ccb0
mov edx, 0x1019fef8
call fcn.10037780
test eax, eax
je 0x1005b809
mov edx, dword [0x1018ccb0]
mov byte [edx + 0x1019fef8], 0
mov edi, 0x1019fef8
call fcn.1005daa0
mov eax, 0x101a17b8
call fcn.10039e00
push 0x104
lea ebx, [ebp + 0xd14]
mov esi, 0x101a17b8
call fcn.10042910
add esp, 4
mov eax, ebx
push eax
push esi
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
call edi
mov ecx, 0x101a18c0
call fcn.1004c9c0
push 0x104
mov esi, 0x101a18c0
call fcn.10042910
add esp, 4
mov ecx, ebx
push ecx
push esi
call edi
xor ebx, ebx
mov byte [ebp + 0x800], bl
mov byte [ebp + 0xa08], bl
push ebx
push ebx
push ebx
lea edx, [ebp - 0x34]
push edx
lea eax, [ebp + 0x800]
push eax
lea edx, [ebp + 0xa08]
xor ecx, ecx
call fcn.1005a220
cmp eax, ebx
je 0x1005b949
mov byte [ebp + 0x904], bl
push 0x103
push ebx
lea ecx, [ebp + 0x905]
push ecx
call fcn.10116880
mov byte [ebp + 0xb0c], bl
push 0x103
push ebx
lea edx, [ebp + 0xb0d]
push edx
call fcn.10116880
mov dword [ebp - 0x2c], 0x104
lea eax, [ebp + 0xa08]
push eax
push str.SOFTWAREMicroWorldComponentWebscanCProducts_s
lea ecx, [ebp + 0x904]
push ecx
call fcn.1010d6a8
add esp, 0x24
push str.Path
lea eax, [ebp - 0x2c]
lea edi, [ebp + 0xb0c]
lea ecx, [ebp + 0x904]
mov edx, reloc.OLEAUT32.dll_SysReAllocString
call fcn.100315c0
movzx eax, al
cmp eax, ebx
je 0x1005b949
cmp byte [ebp + 0xb0c], bl
je 0x1005b949
push ebx
mov edx, edi
push edx
call fcn.10044cc0
add esp, 8
test eax, eax
je 0x1005b949
mov eax, edi
push eax
push 0x101a19c8
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
call edi
push 0x104
lea ebx, [ebp + 0xd14]
mov esi, 0x101a19c8
call fcn.10042910
add esp, 4
mov ecx, ebx
push ecx
push esi
call edi
xor ebx, ebx
push 0x104
push 0x101a0000
call fcn.10042f40
add esp, 8
call fcn.10043010
push 0x104
push 0x101a0108
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
call fcn.1004f190
test eax, eax
je 0x1005b983
mov esi, 0x101a0210
call fcn.1005b520
push 0x101a16b0
push 0x101a15a8
push 0x101a14a0
push 0x101a1398
push 0x101a1290
push 0x101a0f78
push 0x101a0e70
mov edx, 0x101a1188
mov ecx, 0x101a1080
call fcn.10059de0
add esp, 0x1c
push 0x101a0948
push 0x101a0840
push 0x101a0738
push 0x101a0630
push 0x101a0528
mov ecx, 0x101a0a50
mov edx, 0x101a0420
call fcn.10059340
cmp byte [0x101a0630], bl
je 0x1005b9fe
mov edi, 0x101a0c60
mov ecx, 0x101a0630
call fcn.10044170
mov esi, edi
call fcn.10049c80
cmp byte [0x101a1290], bl
je 0x1005ba1c
mov edi, 0x101a0b58
mov ecx, 0x101a1290
call fcn.10044170
mov esi, edi
call fcn.10049c80
push 0x104
push 0x101a0d68
push str.TEMP
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov dword [0x1019fffc], 1
mov ebx, dword [ebp - 0x24]
mov esi, dword [ebp - 0x20]
add esi, ebx
mov edi, 0x800
lea ebx, [ebp]
call fcn.1004d250
push 0xd
push str._SYSTEMDRIVE_
mov edx, ebx
push edx
call fcn.101109e4
add esp, 0xc
test eax, eax
jne 0x1005bacc
push 4
push 0x101a0108
push esi
call fcn.1010e100
add esp, 0xc
mov byte [esi + 2], 0
mov edi, dword [ebp - 0x20]
cmp byte [ebp + 0xd], 0x5c
je 0x1005ba8a
mov ecx, edi
call fcn.10049c40
lea eax, [ebp + 0xd]
mov edx, eax
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1005ba90
sub eax, edx
dec edi
lea ebx, [ebx]
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x1005baa0
mov ecx, eax
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, 1
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0xfffffffe
jmp 0x1005bf2b
push 0xc
push str._ESCANDRIVE_
lea eax, [ebp]
push eax
call fcn.101109e4
add esp, 0xc
test eax, eax
jne 0x1005bb2d
push 4
push 0x101a17b8
push esi
call fcn.1010e100
add esp, 0xc
mov byte [esi + 2], 0
mov edi, dword [ebp - 0x20]
cmp byte [ebp + 0xc], 0x5c
je 0x1005bb07
mov ecx, edi
call fcn.10049c40
lea eax, [ebp + 0xc]
mov edx, eax
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1005bb10
sub eax, edx
dec edi
lea ebx, [ebx]
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x1005bb20
jmp 0x1005baa8
mov edi, dword [ebp - 0x20]
push edi
mov ecx, 0x101a0e70
mov edx, str._PF_
call fcn.1005b1c0
add esp, 4
mov esi, eax
mov dword [ebp - 0x1c], esi
test esi, esi
jne 0x1005befe
push edi
mov ecx, 0x101a0b58
mov edx, str._UserProfile_
call fcn.1005b1c0
add esp, 4
or esi, eax
mov dword [ebp - 0x1c], esi
jne 0x1005befe
push edi
mov ecx, 0x101a0000
mov edx, str._windir_
call fcn.1005b1c0
add esp, 4
or esi, eax
mov dword [ebp - 0x1c], esi
jne 0x1005befe
push edi
mov ecx, 0x101a0108
mov edx, str._sysdir_
call fcn.1005b1c0
add esp, 4
or esi, eax
mov dword [ebp - 0x1c], esi
jne 0x1005befe
push edi
mov ecx, 0x101a0c60
mov edx, str._AllUsersProfile_
call fcn.1005b1c0
add esp, 4
or esi, eax
mov dword [ebp - 0x1c], esi
jne 0x1005befe
push edi
mov ecx, 0x101a0f78
mov edx, str._CommonProgramFiles_
call fcn.1005b1c0
add esp, 4
or esi, eax
mov dword [ebp - 0x1c], esi
jne 0x1005befe
push edi
mov ecx, 0x101a0630
mov edx, str._CommonDesktop_
call fcn.1005b1c0
add esp, 4
or esi, eax
mov dword [ebp - 0x1c], esi
jne 0x1005befe
push edi
mov ecx, 0x101a0d68
mov edx, str._TEMP_
call fcn.1005b1c0
add esp, 4
or esi, eax
mov dword [ebp - 0x1c], esi
jne 0x1005befe
push edi
mov ecx, 0x101a0738
mov edx, str._CommonPrograms_
call fcn.1005b1c0
add esp, 4
or esi, eax
mov dword [ebp - 0x1c], esi
jne 0x1005befe
push edi
mov ecx, 0x101a0840
mov edx, str._CommonStartMenu_
call fcn.1005b1c0
add esp, 4
or esi, eax
mov dword [ebp - 0x1c], esi
jne 0x1005befe
push edi
mov ecx, 0x101a1080
mov edx, str._AppData_
call fcn.1005b1c0
add esp, 4
or esi, eax
mov dword [ebp - 0x1c], esi
jne 0x1005befe
push edi
mov ecx, 0x101a0948
mov edx, str._CommonStartup_
call fcn.1005b1c0
add esp, 4
or esi, eax
mov dword [ebp - 0x1c], esi
jne 0x1005befe
push edi
mov ecx, 0x101a1290
mov edx, str._Desktop_
call fcn.1005b1c0
add esp, 4
or esi, eax
mov dword [ebp - 0x1c], esi
jne 0x1005befe
push edi
mov ecx, 0x101a1398
mov edx, str._StartMenu_
call fcn.1005b1c0
add esp, 4
or esi, eax
mov dword [ebp - 0x1c], esi
jne 0x1005befe
push edi
mov ecx, 0x101a0318
mov edx, str._SYSTEM16DIR_
call fcn.1005b1c0
add esp, 4
or esi, eax
mov dword [ebp - 0x1c], esi
jne 0x1005befe
push edi
mov ecx, 0x101a0000
mov edx, str.SystemRoot_
call fcn.1005b1c0
add esp, 4
or esi, eax
mov dword [ebp - 0x1c], esi
jne 0x1005befe
push edi
mov ecx, 0x101a0000
mov edx, str._SystemRoot_
call fcn.1005b1c0
add esp, 4
or esi, eax
mov dword [ebp - 0x1c], esi
jne 0x1005befe
push edi
mov ecx, 0x101a0108
mov edx, str.System32
call fcn.1005b1c0
add esp, 4
or esi, eax
mov dword [ebp - 0x1c], esi
jne 0x1005befe
cmp byte [0x101a0210], 0
je 0x1005bd84
push edi
mov ecx, 0x101a0210
mov edx, str.SysWOW64
call fcn.1005b1c0
or esi, eax
mov dword [ebp - 0x1c], esi
push edi
mov ecx, 0x101a0210
mov edx, str._SysWOW64_
call fcn.1005b1c0
add esp, 8
or esi, eax
mov dword [ebp - 0x1c], esi
test esi, esi
jne 0x1005befe
push edi
mov ecx, 0x101a0108
mov edx, str._winsysdir_
call fcn.1005b1c0
add esp, 4
mov esi, eax
mov dword [ebp - 0x1c], esi
test esi, esi
jne 0x1005befe
push edi
mov ecx, 0x101a0000
mov edx, str._windows_
call fcn.1005b1c0
add esp, 4
or esi, eax
mov dword [ebp - 0x1c], esi
jne 0x1005befe
push edi
mov ecx, 0x101a15a8
mov edx, str._inetpub_
call fcn.1005b1c0
add esp, 4
or esi, eax
mov dword [ebp - 0x1c], esi
jne 0x1005befe
push edi
mov ecx, 0x101a0108
mov edx, str._SYSTEMDIR_
call fcn.1005b1c0
add esp, 4
or esi, eax
mov dword [ebp - 0x1c], esi
jne 0x1005befe
push edi
mov ecx, 0x101a0108
mov edx, str._SYSTEM32DIR_
call fcn.1005b1c0
add esp, 4
or esi, eax
mov dword [ebp - 0x1c], esi
jne 0x1005befe
push edi
mov ecx, 0x101a0e70
mov edx, str._ProgramFiles_
call fcn.1005b1c0
add esp, 4
or esi, eax
mov dword [ebp - 0x1c], esi
jne 0x1005befe
push edi
mov ecx, 0x101a0e70
mov edx, str._ProgramFiles_x86__
call fcn.1005b1c0
add esp, 4
or esi, eax
mov dword [ebp - 0x1c], esi
jne 0x1005befe
push edi
mov ecx, 0x101a0f78
mov edx, str._CommonProgramFiles_x86__
call fcn.1005b1c0
add esp, 4
or esi, eax
mov dword [ebp - 0x1c], esi
jne 0x1005befe
push edi
mov ecx, 0x101a1290
mov edx, str._DesktopDirectory_
call fcn.1005b1c0
add esp, 4
or esi, eax
mov dword [ebp - 0x1c], esi
jne 0x1005befe
push edi
mov ecx, 0x101a0528
mov edx, str._CommonAppData_
call fcn.1005b1c0
add esp, 4
or esi, eax
mov dword [ebp - 0x1c], esi
jne 0x1005befe
push edi
mov ecx, 0x101a17b8
mov edx, str._eScanDirectory_
call fcn.1005b1c0
add esp, 4
or esi, eax
mov dword [ebp - 0x1c], esi
jne 0x1005befe
push edi
mov ecx, 0x101a18c0
mov edx, str._MailScanDirectory_
call fcn.1005b1c0
add esp, 4
or esi, eax
mov dword [ebp - 0x1c], esi
jne 0x1005befe
push edi
mov ecx, 0x101a19c8
mov edx, str._WebScanDirectory_
call fcn.1005b1c0
add esp, 4
or esi, eax
mov dword [ebp - 0x1c], esi
mov dword [ebp - 4], 0xfffffffe
jmp 0x1005bf29
mov eax, esi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0xe18]
xor ecx, ebp
call fcn.1010d699
add ebp, 0xe1c
mov esp, ebp
pop ebp
ret