Function at 0x100662a6
Capabilities:
Get common file path

Disassembly:
mov eax, 0x100a47b5
call fcn.1007c8b4
sub esp, 0x378
lea eax, [ebp - 0x10]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
push eax
push esi
push edi
call fcn.1006a173
add esp, 0xc
test al, al
jne 0x100662f5
push dword [ebp + 0x2c]
push dword [ebp + 0x28]
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push esi
push edi
call dword [0x100d3524]
jmp 0x100666e8
push ebx
mov ebx, dword [ebp - 0x10]
cmp bl, 1
jne 0x1006632d
push dword [0x100d3524]
push 0x100d3118
push dword [ebp + 0x2c]
push dword [ebp + 0x28]
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push esi
push edi
call fcn.10076a87
jmp 0x100666e7
xor eax, eax
mov dword [ebp - 0x30], 0xf
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x44], al
mov dword [ebp - 4], eax
lea eax, [ebp - 0x44]
push eax
push ebx
call fcn.10068546
cmp dword [ebp - 0x30], 0x10
lea edx, [ebp - 0x44]
mov eax, dword [ebp - 0x34]
cmovae edx, dword [ebp - 0x44]
pop ecx
pop ecx
test eax, eax
je 0x1006668c
dec eax
or ecx, 0xffffffff
cmp eax, ecx
cmovb ecx, eax
add ecx, edx
jmp 0x1006637a
cmp ecx, edx
je 0x1006668c
dec ecx
cmp byte [ecx], 0x5c
jne 0x10066371
sub ecx, edx
cmp ecx, 0xffffffff
je 0x1006668c
and dword [ebp - 0x74], 0
lea eax, [ecx + 1]
and dword [ebp - 0x64], 0
lea ecx, [ebp - 0x74]
push 0xffffffffffffffff
push eax
lea eax, [ebp - 0x44]
mov dword [ebp - 0x60], 0xf
push eax
call fcn.1000600f
mov byte [ebp - 0x10], 0
lea eax, [ebp - 0x74]
push dword [ebp - 0x10]
lea ecx, [ebp - 0x44]
push eax
call fcn.10005e62
mov eax, dword [ebp - 0x60]
cmp eax, 0x10
jb 0x100663f5
mov ecx, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], ecx
cmp eax, 0x1000
jb 0x100663ec
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.10001c26
mov eax, dword [ebp - 0x14]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x10]
push eax
push ecx
call fcn.1007c382
pop ecx
pop ecx
push 0x20a
lea eax, [ebp - 0x384]
push 0
push eax
call fcn.1007f880
add esp, 0xc
lea eax, [ebp - 0x384]
push 0x105
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x1006668c
and dword [ebp - 0x5c], 0
lea ecx, [ebp - 0x5c]
and dword [ebp - 0x4c], 0
xor eax, eax
mov word [ebp - 0x5c], ax
lea eax, [ebp - 0x384]
push eax
mov dword [ebp - 0x48], 7
call fcn.10004f55
and dword [ebp - 0x2c], 0
xor eax, eax
and dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 7
mov word [ebp - 0x2c], ax
push 2
pop eax
mov byte [ebp - 4], al
mov ecx, str._system32
test bl, bl
mov eax, str._syswow64
cmove eax, ecx
lea ecx, [ebp - 0x5c]
push eax
call fcn.10008d69
push str._rundll32.exe
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x74]
push eax
call fcn.1005f25b
lea ecx, [ebp - 0x2c]
add esp, 0xc
cmp ecx, eax
je 0x100664a5
mov byte [ebp - 0x10], 0
push dword [ebp - 0x10]
push eax
call fcn.10008d8e
lea ecx, [ebp - 0x74]
call fcn.100050be
cmp dword [ebp - 0x30], 0x10
lea eax, [ebp - 0x44]
lea ecx, [ebp - 0x174]
cmovae eax, dword [ebp - 0x44]
push 3
mov dword [ebp - 0x178], ecx
lea ecx, [ebp - 0x178]
push eax
call fcn.100599a6
push dword [ebp - 0x178]
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 3
call fcn.10008d69
push 2
lea eax, [ebp - 0x174]
pop ebx
mov byte [ebp - 4], bl
cmp dword [ebp - 0x178], eax
je 0x10066504
push dword [ebp - 0x178]
call fcn.1008582f
pop ecx
push str._RunProcWithDll
lea ecx, [ebp - 0x2c]
call fcn.10008d69
push esi
lea ecx, [ebp - 0x2c]
call fcn.10008d69
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
inc eax
mul ebx
push 0x100ae7f8
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1007ca30
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
jne 0x10066563
push dword [ebp + 0x2c]
push dword [ebp + 0x28]
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push esi
push edi
call dword [0x100d3524]
mov esi, eax
jmp 0x100665f3
cmp dword [ebp - 0x18], 8
lea eax, [ebp - 0x2c]
cmovae eax, dword [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x1c]
inc eax
push eax
push ebx
call fcn.1008adf2
add esp, 0xc
call fcn.10079530
test eax, eax
je 0x100665c0
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push str.Wow64DisableWow64FsRedirection
push 0x100aa62c
call edi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call esi
push str.Wow64RevertWow64FsRedirection
push 0x100aa62c
mov dword [ebp - 0x10], eax
call edi
push eax
call esi
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x100665c0
lea ecx, [ebp - 0x14]
push ecx
call eax
push dword [ebp + 0x2c]
cmp dword [ebp - 0x48], 8
lea eax, [ebp - 0x5c]
push dword [ebp + 0x28]
cmovae eax, dword [ebp - 0x5c]
push eax
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push ebx
push 0
call dword [0x100d3524]
push ebx
mov esi, eax
call fcn.1007c98c
pop ecx
mov eax, dword [ebp - 0x18]
cmp eax, 8
jb 0x10066630
mov ecx, dword [ebp - 0x2c]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
cmp eax, 0x1000
jb 0x10066627
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.10001c26
mov eax, dword [ebp - 0x10]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x14]
push eax
push ecx
call fcn.1007c382
pop ecx
pop ecx
and dword [ebp - 0x1c], 0
xor eax, eax
push 7
mov word [ebp - 0x2c], ax
mov eax, dword [ebp - 0x48]
pop ebx
mov dword [ebp - 0x18], ebx
cmp eax, 8
jb 0x1006667d
mov ecx, dword [ebp - 0x5c]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
cmp eax, 0x1000
jb 0x10066674
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.10001c26
mov eax, dword [ebp - 0x10]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x14]
push eax
push ecx
call fcn.1007c382
pop ecx
pop ecx
and dword [ebp - 0x4c], 0
xor eax, eax
mov dword [ebp - 0x48], ebx
mov word [ebp - 0x5c], ax
jmp 0x100666ae
push dword [ebp + 0x2c]
push dword [ebp + 0x28]
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push esi
push edi
call dword [0x100d3524]
mov esi, eax
mov eax, dword [ebp - 0x30]
cmp eax, 0x10
jb 0x100666e5
mov ecx, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
cmp eax, 0x1000
jb 0x100666dc
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.10001c26
mov eax, dword [ebp - 0x10]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x14]
push eax
push ecx
call fcn.1007c382
pop ecx
pop ecx
mov eax, esi
pop ebx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret