Function at 0x1007991c
Capabilities:
Get common file path
Query environment variable

Disassembly:
push ebp
lea ebp, [esp - 0xe1c]
sub esp, 0xe1c
push 0xfffffffffffffffe
push 0x10182df0
push 0x10132540
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x10189710]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp + 0xe18], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov esi, ecx
mov dword [ebp - 0x20], esi
xor edi, edi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x30], edi
mov byte [ebp + 0xa08], 0
push 0x103
push edi
lea eax, [ebp + 0xa09]
push eax
call fcn.1012e060
mov byte [ebp + 0x800], 0
push 0x103
push edi
lea ecx, [ebp + 0x801]
push ecx
call fcn.1012e060
add esp, 0x18
xor ebx, ebx
mov dword [ebp - 0x24], ebx
cmp esi, edi
jne 0x10079840
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
jmp 0x1007a0ab
mov al, 0x25
mov edx, esi
call fcn.100770c0
mov edx, 1
cmp byte [esi], 0x22
jne 0x10079858
mov dword [ebp - 0x24], edx
mov ebx, edx
cmp eax, edi
jbe 0x10079860
test dl, al
je 0x1007988a
mov cl, byte [esi + ebx]
cmp cl, 0x5c
jne 0x10079874
mov al, byte [esi + ebx + 1]
cmp al, 0x73
je 0x1007988a
cmp al, 0x53
je 0x1007988a
cmp cl, 0x73
je 0x1007987e
cmp cl, 0x53
jne 0x10079832
mov al, byte [esi + ebx + 1]
cmp al, 0x79
je 0x1007988a
cmp al, 0x59
jne 0x10079832
mov dword [ebp - 0x30], edx
cmp dword [0x101c970c], edx
jne 0x10079935
cmp byte [0x101c9608], 0
je 0x10079935
cmp dword [ebp + 0xe24], edi
je 0x10079935
mov byte [ebp + 0xc10], 0
push 0x103
push edi
lea edx, [ebp + 0xc11]
push edx
call fcn.1012e060
add esp, 0xc
mov dword [ebp - 0x28], 0x104
lea ecx, [ebp - 0x28]
lea edx, [ebp + 0xc10]
call fcn.1005cb90
test eax, eax
je 0x10079935
mov eax, dword [ebp - 0x28]
mov byte [ebp + eax + 0xc10], 0
lea edi, [ebp + 0xc10]
call fcn.1007aaa0
mov eax, 0x101c9608
mov ecx, edi
call fcn.1005a090
test eax, eax
je 0x10079935
mov dword [0x101c970c], 0
push 0x104
push 0
push 0x101c9608
call fcn.1012e060
add esp, 0xc
mov dword [0x101a46f8], 0x104
cmp dword [0x101c970c], 0
jne 0x10079bc6
mov byte [ebp + 0xd14], 0
push 0x103
push 0
lea ecx, [ebp + 0xd15]
push ecx
call fcn.1012e060
add esp, 0xc
mov ecx, 0x101a46f8
mov edx, 0x101c9608
call fcn.1005cb90
test eax, eax
je 0x10079989
mov edx, dword [0x101a46f8]
mov byte [edx + 0x101c9608], 0
mov edi, 0x101c9608
call fcn.1007aaa0
mov eax, 0x101caec8
call fcn.1005d070
push 0x104
lea ebx, [ebp + 0xd14]
mov esi, 0x101caec8
call fcn.1005f230
add esp, 4
mov eax, ebx
push eax
push esi
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
call edi
mov ecx, 0x104
mov edx, 0x101cafd0
call fcn.10067a50
push 0x104
mov esi, 0x101cafd0
call fcn.1005f230
add esp, 4
mov ecx, ebx
push ecx
push esi
call edi
xor ebx, ebx
mov byte [ebp + 0x800], bl
mov byte [ebp + 0xa08], bl
push ebx
push ebx
push ebx
lea edx, [ebp - 0x34]
push edx
lea eax, [ebp + 0x800]
push eax
lea edx, [ebp + 0xa08]
xor ecx, ecx
call fcn.10076200
cmp eax, ebx
je 0x10079ace
mov byte [ebp + 0x904], bl
push 0x103
push ebx
lea ecx, [ebp + 0x905]
push ecx
call fcn.1012e060
mov byte [ebp + 0xb0c], bl
push 0x103
push ebx
lea edx, [ebp + 0xb0d]
push edx
call fcn.1012e060
mov dword [ebp - 0x2c], 0x104
lea eax, [ebp + 0xa08]
push eax
push str.SOFTWAREMicroWorldComponentWebscanCProducts_s
lea ecx, [ebp + 0x904]
push ecx
call fcn.10127dc0
add esp, 0x24
push str.Path
lea eax, [ebp - 0x2c]
lea edi, [ebp + 0xb0c]
lea ecx, [ebp + 0x904]
mov edx, reloc.WS2_32.dll_bind
call fcn.10059d80
movzx eax, al
cmp eax, ebx
je 0x10079ace
cmp byte [ebp + 0xb0c], bl
je 0x10079ace
push ebx
mov edx, edi
push edx
call fcn.100612a0
add esp, 8
test eax, eax
je 0x10079ace
mov eax, edi
push eax
push 0x101cb0d8
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
call edi
push 0x104
lea ebx, [ebp + 0xd14]
mov esi, 0x101cb0d8
call fcn.1005f230
add esp, 4
mov ecx, ebx
push ecx
push esi
call edi
xor ebx, ebx
push 0x104
push 0x101c9710
call fcn.1005f830
add esp, 8
call fcn.1005f900
push 0x104
push 0x101c9818
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
call fcn.1006b040
test eax, eax
je 0x10079b08
mov esi, 0x101c9920
call fcn.100796a0
push 0x101cadc0
push 0x101cacb8
push 0x101cabb0
push 0x101caaa8
push 0x101ca9a0
push 0x101ca688
push 0x101ca580
mov edx, 0x101ca898
mov ecx, 0x101ca790
call 0x10075e30
add esp, 0x1c
push 0x101ca160
push 0x101c9f50
push 0x101c9e48
push 0x101c9d40
push 0x101c9c38
mov ecx, 0x101ca058
mov edx, 0x101c9b30
call fcn.10075370
cmp byte [0x101c9d40], bl
je 0x10079b83
mov edi, 0x101ca370
mov ecx, 0x101c9d40
call fcn.10060a00
mov esi, edi
call fcn.10065240
cmp byte [0x101ca9a0], bl
je 0x10079ba1
mov edi, 0x101ca268
mov ecx, 0x101ca9a0
call fcn.10060a00
mov esi, edi
call fcn.10065240
push 0x104
push 0x101ca478
push str.TEMP
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov dword [0x101c970c], 1
mov ebx, dword [ebp - 0x24]
mov esi, dword [ebp - 0x20]
add esi, ebx
mov edi, 0x800
lea ebx, [ebp]
call fcn.10068710
push 0xd
push str._SYSTEMDRIVE_
mov edx, ebx
push edx
call fcn.1012abed
add esp, 0xc
test eax, eax
jne 0x10079c4c
push 4
push 0x101c9818
push esi
call fcn.101287f0
add esp, 0xc
mov byte [esi + 2], 0
mov edi, dword [ebp - 0x20]
cmp byte [ebp + 0xd], 0x5c
je 0x10079c0f
mov ecx, edi
call fcn.10065200
lea eax, [ebp + 0xd]
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10079c14
sub eax, edx
dec edi
mov edi, edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x10079c20
mov ecx, eax
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, 1
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0xfffffffe
jmp 0x1007a0ab
push 0xc
push str._ESCANDRIVE_
lea eax, [ebp]
push eax
call fcn.1012abed
add esp, 0xc
test eax, eax
jne 0x10079cad
push 4
push 0x101caec8
push esi
call fcn.101287f0
add esp, 0xc
mov byte [esi + 2], 0
mov edi, dword [ebp - 0x20]
cmp byte [ebp + 0xc], 0x5c
je 0x10079c87
mov ecx, edi
call fcn.10065200
lea eax, [ebp + 0xc]
mov edx, eax
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10079c90
sub eax, edx
dec edi
lea ebx, [ebx]
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x10079ca0
jmp 0x10079c28
mov edi, dword [ebp - 0x20]
push edi
mov ecx, 0x101ca580
mov edx, str._PF_
call fcn.10079340
add esp, 4
mov esi, eax
mov dword [ebp - 0x1c], esi
test esi, esi
jne 0x1007a07e
push edi
mov ecx, 0x101ca268
mov edx, str._UserProfile_
call fcn.10079340
add esp, 4
or esi, eax
mov dword [ebp - 0x1c], esi
jne 0x1007a07e
push edi
mov ecx, 0x101c9710
mov edx, str._windir_
call fcn.10079340
add esp, 4
or esi, eax
mov dword [ebp - 0x1c], esi
jne 0x1007a07e
push edi
mov ecx, 0x101c9818
mov edx, str._sysdir_
call fcn.10079340
add esp, 4
or esi, eax
mov dword [ebp - 0x1c], esi
jne 0x1007a07e
push edi
mov ecx, 0x101ca370
mov edx, str._AllUsersProfile_
call fcn.10079340
add esp, 4
or esi, eax
mov dword [ebp - 0x1c], esi
jne 0x1007a07e
push edi
mov ecx, 0x101ca688
mov edx, str._CommonProgramFiles_
call fcn.10079340
add esp, 4
or esi, eax
mov dword [ebp - 0x1c], esi
jne 0x1007a07e
push edi
mov ecx, 0x101c9d40
mov edx, str._CommonDesktop_
call fcn.10079340
add esp, 4
or esi, eax
mov dword [ebp - 0x1c], esi
jne 0x1007a07e
push edi
mov ecx, 0x101ca478
mov edx, str._TEMP_
call fcn.10079340
add esp, 4
or esi, eax
mov dword [ebp - 0x1c], esi
jne 0x1007a07e
push edi
mov ecx, 0x101c9e48
mov edx, str._CommonPrograms_
call fcn.10079340
add esp, 4
or esi, eax
mov dword [ebp - 0x1c], esi
jne 0x1007a07e
push edi
mov ecx, 0x101c9f50
mov edx, str._CommonStartMenu_
call fcn.10079340
add esp, 4
or esi, eax
mov dword [ebp - 0x1c], esi
jne 0x1007a07e
push edi
mov ecx, 0x101ca790
mov edx, str._AppData_
call fcn.10079340
add esp, 4
or esi, eax
mov dword [ebp - 0x1c], esi
jne 0x1007a07e
push edi
mov ecx, 0x101ca058
mov edx, str._CommonStartup_
call fcn.10079340
add esp, 4
or esi, eax
mov dword [ebp - 0x1c], esi
jne 0x1007a07e
push edi
mov ecx, 0x101ca9a0
mov edx, str._Desktop_
call fcn.10079340
add esp, 4
or esi, eax
mov dword [ebp - 0x1c], esi
jne 0x1007a07e
push edi
mov ecx, 0x101caaa8
mov edx, str._StartMenu_
call fcn.10079340
add esp, 4
or esi, eax
mov dword [ebp - 0x1c], esi
jne 0x1007a07e
push edi
mov ecx, 0x101c9a28
mov edx, str._SYSTEM16DIR_
call fcn.10079340
add esp, 4
or esi, eax
mov dword [ebp - 0x1c], esi
jne 0x1007a07e
push edi
mov ecx, 0x101c9710
mov edx, str.SystemRoot_
call fcn.10079340
add esp, 4
or esi, eax
mov dword [ebp - 0x1c], esi
jne 0x1007a07e
push edi
mov ecx, 0x101c9710
mov edx, str._SystemRoot_
call fcn.10079340
add esp, 4
or esi, eax
mov dword [ebp - 0x1c], esi
jne 0x1007a07e
push edi
mov ecx, 0x101c9818
mov edx, str.System32
call fcn.10079340
add esp, 4
or esi, eax
mov dword [ebp - 0x1c], esi
jne 0x1007a07e
cmp byte [0x101c9920], 0
je 0x10079f04
push edi
mov ecx, 0x101c9920
mov edx, str.SysWOW64
call fcn.10079340
or esi, eax
mov dword [ebp - 0x1c], esi
push edi
mov ecx, 0x101c9920
mov edx, str._SysWOW64_
call fcn.10079340
add esp, 8
or esi, eax
mov dword [ebp - 0x1c], esi
test esi, esi
jne 0x1007a07e
push edi
mov ecx, 0x101c9818
mov edx, str._winsysdir_
call fcn.10079340
add esp, 4
mov esi, eax
mov dword [ebp - 0x1c], esi
test esi, esi
jne 0x1007a07e
push edi
mov ecx, 0x101c9710
mov edx, str._windows_
call fcn.10079340
add esp, 4
or esi, eax
mov dword [ebp - 0x1c], esi
jne 0x1007a07e
push edi
mov ecx, 0x101cacb8
mov edx, str._inetpub_
call fcn.10079340
add esp, 4
or esi, eax
mov dword [ebp - 0x1c], esi
jne 0x1007a07e
push edi
mov ecx, 0x101c9818
mov edx, str._SYSTEMDIR_
call fcn.10079340
add esp, 4
or esi, eax
mov dword [ebp - 0x1c], esi
jne 0x1007a07e
push edi
mov ecx, 0x101c9818
mov edx, str._SYSTEM32DIR_
call fcn.10079340
add esp, 4
or esi, eax
mov dword [ebp - 0x1c], esi
jne 0x1007a07e
push edi
mov ecx, 0x101ca580
mov edx, str._ProgramFiles_
call fcn.10079340
add esp, 4
or esi, eax
mov dword [ebp - 0x1c], esi
jne 0x1007a07e
push edi
mov ecx, 0x101ca580
mov edx, str._ProgramFiles_x86__
call fcn.10079340
add esp, 4
or esi, eax
mov dword [ebp - 0x1c], esi
jne 0x1007a07e
push edi
mov ecx, 0x101ca688
mov edx, str._CommonProgramFiles_x86__
call fcn.10079340
add esp, 4
or esi, eax
mov dword [ebp - 0x1c], esi
jne 0x1007a07e
push edi
mov ecx, 0x101ca9a0
mov edx, str._DesktopDirectory_
call fcn.10079340
add esp, 4
or esi, eax
mov dword [ebp - 0x1c], esi
jne 0x1007a07e
push edi
mov ecx, 0x101c9c38
mov edx, str._CommonAppData_
call fcn.10079340
add esp, 4
or esi, eax
mov dword [ebp - 0x1c], esi
jne 0x1007a07e
push edi
mov ecx, 0x101caec8
mov edx, str._eScanDirectory_
call fcn.10079340
add esp, 4
or esi, eax
mov dword [ebp - 0x1c], esi
jne 0x1007a07e
push edi
mov ecx, 0x101cafd0
mov edx, str._MailScanDirectory_
call fcn.10079340
add esp, 4
or esi, eax
mov dword [ebp - 0x1c], esi
jne 0x1007a07e
push edi
mov ecx, 0x101cb0d8
mov edx, str._WebScanDirectory_
call fcn.10079340
add esp, 4
or esi, eax
mov dword [ebp - 0x1c], esi
mov dword [ebp - 4], 0xfffffffe
jmp 0x1007a0a9
mov eax, esi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0xe18]
xor ecx, ebp
call fcn.10127db1
add ebp, 0xe1c
mov esp, ebp
pop ebp
ret