Function at 0x1015ce30
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x278
mov eax, dword [0x102519c8]
xor eax, ebp
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x275]
call fcn.10129b80
push 0x104
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.101e7180
add esp, 8
lea eax, [ebp - 0x20c]
lea ecx, [ebp - 0x23c]
push eax
call fcn.10020470
push 1
push 0x10202944
lea ecx, [ebp - 0x23c]
call fcn.10006d70
push str.smss.exe
lea eax, [ebp - 0x23c]
push eax
lea eax, [ebp - 0x224]
push eax
call fcn.1002db20
add esp, 0xc
mov ecx, 0x1025ab24
push dword [ebp - 0x270]
push eax
push 0
lea eax, [ebp - 0x274]
push eax
call fcn.1002bb40
mov edx, dword [ebp - 0x210]
cmp edx, 8
jb 0x1015cf0d
mov ecx, dword [ebp - 0x224]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x1015cf03
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1015daee
push edx
push ecx
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
add esp, 8
push str.csrss.exe
lea eax, [ebp - 0x23c]
push eax
lea eax, [ebp - 0x224]
push eax
call fcn.1002db20
add esp, 0xc
mov ecx, 0x1025ab24
push dword [ebp - 0x270]
push eax
push 0
lea eax, [ebp - 0x274]
push eax
call fcn.1002bb40
mov edx, dword [ebp - 0x210]
cmp edx, 8
jb 0x1015cf82
mov ecx, dword [ebp - 0x224]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x1015cf78
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1015daf3
push edx
push ecx
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
add esp, 8
push str.winlogon.exe
lea eax, [ebp - 0x23c]
push eax
lea eax, [ebp - 0x224]
push eax
call fcn.1002db20
add esp, 0xc
mov ecx, 0x1025ab24
push dword [ebp - 0x270]
push eax
push 0
lea eax, [ebp - 0x274]
push eax
call fcn.1002bb40
mov edx, dword [ebp - 0x210]
cmp edx, 8
jb 0x1015cff7
mov ecx, dword [ebp - 0x224]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x1015cfed
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1015daf8
push edx
push ecx
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
add esp, 8
push str.services.exe
lea eax, [ebp - 0x23c]
push eax
lea eax, [ebp - 0x224]
push eax
call fcn.1002db20
add esp, 0xc
mov ecx, 0x1025ab24
push dword [ebp - 0x270]
push eax
push 0
lea eax, [ebp - 0x274]
push eax
call fcn.1002bb40
mov edx, dword [ebp - 0x210]
cmp edx, 8
jb 0x1015d06c
mov ecx, dword [ebp - 0x224]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x1015d062
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1015dafd
push edx
push ecx
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
add esp, 8
push str.svchost.exe
lea eax, [ebp - 0x23c]
push eax
lea eax, [ebp - 0x224]
push eax
call fcn.1002db20
add esp, 0xc
mov ecx, 0x1025ab24
push dword [ebp - 0x270]
push eax
push 0
lea eax, [ebp - 0x274]
push eax
call fcn.1002bb40
mov edx, dword [ebp - 0x210]
cmp edx, 8
jb 0x1015d0e1
mov ecx, dword [ebp - 0x224]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x1015d0d7
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1015db02
push edx
push ecx
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
add esp, 8
push str.spoolsv.exe
lea eax, [ebp - 0x23c]
push eax
lea eax, [ebp - 0x224]
push eax
call fcn.1002db20
add esp, 0xc
mov ecx, 0x1025ab24
push dword [ebp - 0x270]
push eax
push 0
lea eax, [ebp - 0x274]
push eax
call fcn.1002bb40
mov edx, dword [ebp - 0x210]
cmp edx, 8
jb 0x1015d156
mov ecx, dword [ebp - 0x224]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x1015d14c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1015db07
push edx
push ecx
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
add esp, 8
push str.rundll32.exe
lea eax, [ebp - 0x23c]
push eax
lea eax, [ebp - 0x224]
push eax
call fcn.1002db20
add esp, 0xc
mov ecx, 0x1025ab24
push dword [ebp - 0x270]
push eax
push 0
lea eax, [ebp - 0x274]
push eax
call fcn.1002bb40
mov edx, dword [ebp - 0x210]
cmp edx, 8
jb 0x1015d1cb
mov ecx, dword [ebp - 0x224]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x1015d1c1
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1015db0c
push edx
push ecx
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
add esp, 8
push str.regsvr32.exe
lea eax, [ebp - 0x23c]
push eax
lea eax, [ebp - 0x224]
push eax
call fcn.1002db20
add esp, 0xc
mov ecx, 0x1025ab24
push dword [ebp - 0x270]
push eax
push 0
lea eax, [ebp - 0x274]
push eax
call fcn.1002bb40
mov edx, dword [ebp - 0x210]
cmp edx, 8
jb 0x1015d240
mov ecx, dword [ebp - 0x224]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x1015d236
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1015db11
push edx
push ecx
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
add esp, 8
push str.shdocvw.dll
lea eax, [ebp - 0x23c]
push eax
lea eax, [ebp - 0x224]
push eax
call fcn.1002db20
add esp, 0xc
mov ecx, 0x1025ab24
push dword [ebp - 0x270]
push eax
push 0
lea eax, [ebp - 0x274]
push eax
call fcn.1002bb40
mov edx, dword [ebp - 0x210]
cmp edx, 8
jb 0x1015d2b5
mov ecx, dword [ebp - 0x224]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x1015d2ab
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1015db16
push edx
push ecx
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
add esp, 8
push str.shell32.dll
lea eax, [ebp - 0x23c]
push eax
lea eax, [ebp - 0x224]
push eax
call fcn.1002db20
add esp, 0xc
mov ecx, 0x1025ab24
push dword [ebp - 0x270]
push eax
push 0
lea eax, [ebp - 0x274]
push eax
call fcn.1002bb40
mov edx, dword [ebp - 0x210]
cmp edx, 8
jb 0x1015d32a
mov ecx, dword [ebp - 0x224]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x1015d320
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1015db1b
push edx
push ecx
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
add esp, 8
push str.oleaut32.dll
lea eax, [ebp - 0x23c]
push eax
lea eax, [ebp - 0x224]
push eax
call fcn.1002db20
add esp, 0xc
mov ecx, 0x1025ab24
push dword [ebp - 0x270]
push eax
push 0
lea eax, [ebp - 0x274]
push eax
call fcn.1002bb40
mov edx, dword [ebp - 0x210]
cmp edx, 8
jb 0x1015d39f
mov ecx, dword [ebp - 0x224]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x1015d395
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1015db20
push edx
push ecx
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
add esp, 8
push str.actxprxy.dll
lea eax, [ebp - 0x23c]
push eax
lea eax, [ebp - 0x224]
push eax
call fcn.1002db20
add esp, 0xc
mov ecx, 0x1025ab24
push dword [ebp - 0x270]
push eax
push 0
lea eax, [ebp - 0x274]
push eax
call fcn.1002bb40
mov edx, dword [ebp - 0x210]
cmp edx, 8
jb 0x1015d414
mov ecx, dword [ebp - 0x224]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x1015d40a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1015db25
push edx
push ecx
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
add esp, 8
push str.mshtml.dll
lea eax, [ebp - 0x23c]
push eax
lea eax, [ebp - 0x224]
push eax
call fcn.1002db20
add esp, 0xc
mov ecx, 0x1025ab24
push dword [ebp - 0x270]
push eax
push 0
lea eax, [ebp - 0x274]
push eax
call fcn.1002bb40
mov edx, dword [ebp - 0x210]
cmp edx, 8
jb 0x1015d489
mov ecx, dword [ebp - 0x224]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x1015d47f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1015db2a
push edx
push ecx
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
add esp, 8
push str.urlmon.dll
lea eax, [ebp - 0x23c]
push eax
lea eax, [ebp - 0x224]
push eax
call fcn.1002db20
add esp, 0xc
mov ecx, 0x1025ab24
push dword [ebp - 0x270]
push eax
push 0
lea eax, [ebp - 0x274]
push eax
call fcn.1002bb40
mov edx, dword [ebp - 0x210]
cmp edx, 8
jb 0x1015d4fe
mov ecx, dword [ebp - 0x224]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x1015d4f4
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1015db2f
push edx
push ecx
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
add esp, 8
push str.msjava.dll
lea eax, [ebp - 0x23c]
push eax
lea eax, [ebp - 0x224]
push eax
call fcn.1002db20
add esp, 0xc
mov ecx, 0x1025ab24
push dword [ebp - 0x270]
push eax
push 0
lea eax, [ebp - 0x274]
push eax
call fcn.1002bb40
mov edx, dword [ebp - 0x210]
cmp edx, 8
jb 0x1015d573
mov ecx, dword [ebp - 0x224]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x1015d569
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1015db34
push edx
push ecx
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
add esp, 8
push str.browseui.dll
lea eax, [ebp - 0x23c]
push eax
lea eax, [ebp - 0x224]
push eax
call fcn.1002db20
add esp, 0xc
mov ecx, 0x1025ab24
push dword [ebp - 0x270]
push eax
push 0
lea eax, [ebp - 0x274]
push eax
call fcn.1002bb40
mov edx, dword [ebp - 0x210]
cmp edx, 8
jb 0x1015d5e8
mov ecx, dword [ebp - 0x224]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x1015d5de
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1015db39
push edx
push ecx
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
add esp, 8
push str.user32.dll
lea eax, [ebp - 0x23c]
push eax
lea eax, [ebp - 0x224]
push eax
call fcn.1002db20
add esp, 0xc
mov ecx, 0x1025ab24
push dword [ebp - 0x270]
push eax
push 0
lea eax, [ebp - 0x274]
push eax
call fcn.1002bb40
mov edx, dword [ebp - 0x210]
cmp edx, 8
jb 0x1015d65d
mov ecx, dword [ebp - 0x224]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x1015d653
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1015db3e
push edx
push ecx
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
add esp, 8
push 0x104
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.101e7180
add esp, 8
lea eax, [ebp - 0x20c]
lea ecx, [ebp - 0x224]
push eax
call fcn.10020470
push 1
push 0x10202944
lea ecx, [ebp - 0x224]
call fcn.10006d70
push str.explorer.exe
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x26c]
push eax
call fcn.1002db20
add esp, 0xc
mov ecx, 0x1025ab24
push dword [ebp - 0x270]
push eax
push 0
lea eax, [ebp - 0x274]
push eax
call fcn.1002bb40
mov edx, dword [ebp - 0x258]
cmp edx, 8
jb 0x1015d71c
mov ecx, dword [ebp - 0x26c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x1015d712
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1015db43
push edx
push ecx
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
add esp, 8
call fcn.10009c50
test eax, eax
je 0x1015da59
push str.GetSystemWow64DirectoryW
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1015da19
push 0x104
lea ecx, [ebp - 0x20c]
push ecx
call eax
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.101e7180
add esp, 8
lea eax, [ebp - 0x20c]
lea ecx, [ebp - 0x26c]
push eax
call fcn.10020470
push 1
push 0x10202944
lea ecx, [ebp - 0x26c]
call fcn.10006d70
push str.svchost.exe
lea eax, [ebp - 0x26c]
push eax
lea eax, [ebp - 0x254]
push eax
call fcn.1002db20
add esp, 0xc
mov ecx, 0x1025ab24
push dword [ebp - 0x270]
push eax
push 0
lea eax, [ebp - 0x274]
push eax
call fcn.1002bb40
lea ecx, [ebp - 0x254]
call fcn.10005250
push str.regsvr32.exe
lea eax, [ebp - 0x26c]
push eax
lea eax, [ebp - 0x254]
push eax
call fcn.1002db20
add esp, 0xc
mov ecx, 0x1025ab24
push dword [ebp - 0x270]
push eax
push 0
lea eax, [ebp - 0x274]
push eax
call fcn.1002bb40
lea ecx, [ebp - 0x254]
call fcn.10005250
push str.shdocvw.dll
lea eax, [ebp - 0x26c]
push eax
lea eax, [ebp - 0x254]
push eax
call fcn.1002db20
add esp, 0xc
mov ecx, 0x1025ab24
push dword [ebp - 0x270]
push eax
push 0
lea eax, [ebp - 0x274]
push eax
call fcn.1002bb40
lea ecx, [ebp - 0x254]
call fcn.10005250
push str.shell32.dll
lea eax, [ebp - 0x26c]
push eax
lea eax, [ebp - 0x254]
push eax
call fcn.1002db20
add esp, 0xc
mov ecx, 0x1025ab24
push dword [ebp - 0x270]
push eax
push 0
lea eax, [ebp - 0x274]
push eax
call fcn.1002bb40
lea ecx, [ebp - 0x254]
call fcn.10005250
push str.oleaut32.dll
lea eax, [ebp - 0x26c]
push eax
lea eax, [ebp - 0x254]
push eax
call fcn.1002db20
add esp, 0xc
mov ecx, 0x1025ab24
push dword [ebp - 0x270]
push eax
push 0
lea eax, [ebp - 0x274]
push eax
call fcn.1002bb40
lea ecx, [ebp - 0x254]
call fcn.10005250
push str.actxprxy.dll
lea eax, [ebp - 0x26c]
push eax
lea eax, [ebp - 0x254]
push eax
call fcn.1002db20
add esp, 0xc
mov ecx, 0x1025ab24
push dword [ebp - 0x270]
push eax
push 0
lea eax, [ebp - 0x274]
push eax
call fcn.1002bb40
lea ecx, [ebp - 0x254]
call fcn.10005250
push str.mshtml.dll
lea eax, [ebp - 0x26c]
push eax
lea eax, [ebp - 0x254]
push eax
call fcn.1002db20
add esp, 0xc
mov ecx, 0x1025ab24
push dword [ebp - 0x270]
push eax
push 0
lea eax, [ebp - 0x274]
push eax
call fcn.1002bb40
lea ecx, [ebp - 0x254]
call fcn.10005250
push str.urlmon.dll
lea eax, [ebp - 0x26c]
push eax
lea eax, [ebp - 0x254]
push eax
call fcn.1002db20
add esp, 0xc
mov ecx, 0x1025ab24
push dword [ebp - 0x270]
push eax
push 0
lea eax, [ebp - 0x274]
push eax
call fcn.1002bb40
lea ecx, [ebp - 0x254]
call fcn.10005250
push str.browseui.dll
lea eax, [ebp - 0x26c]
push eax
lea eax, [ebp - 0x254]
push eax
call fcn.1002db20
add esp, 0xc
mov ecx, 0x1025ab24
push dword [ebp - 0x270]
push eax
push 0
lea eax, [ebp - 0x274]
push eax
call fcn.1002bb40
lea ecx, [ebp - 0x254]
call fcn.10005250
push str.explorer.exe
lea eax, [ebp - 0x26c]
push eax
lea eax, [ebp - 0x254]
push eax
call fcn.1002db20
add esp, 0xc
mov ecx, 0x1025ab24
push dword [ebp - 0x270]
push eax
push 0
lea eax, [ebp - 0x274]
push eax
call fcn.1002bb40
lea ecx, [ebp - 0x254]
call fcn.10005250
lea ecx, [ebp - 0x26c]
call fcn.10005250
push str.explorer.exe
lea eax, [ebp - 0x23c]
push eax
lea eax, [ebp - 0x254]
push eax
call fcn.1002db20
add esp, 0xc
mov ecx, 0x1025ab24
push dword [ebp - 0x270]
push eax
push 0
lea eax, [ebp - 0x274]
push eax
call fcn.1002bb40
lea ecx, [ebp - 0x254]
call fcn.10005250
mov edx, dword [ebp - 0x210]
cmp edx, 8
jb 0x1015da99
mov ecx, dword [ebp - 0x224]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x1015da8f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1015db48
push edx
push ecx
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
add esp, 8
mov edx, dword [ebp - 0x228]
cmp edx, 8
jb 0x1015dad5
mov ecx, dword [ebp - 0x23c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x1015dacb
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1015db48
push edx
push ecx
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
add esp, 8
lea ecx, [ebp - 0x275]
call fcn.10129ba0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101f99c6
mov esp, ebp
pop ebp
ret
call fcn.101e6c40
call fcn.101e6c40
call fcn.101e6c40
call fcn.101e6c40
call fcn.101e6c40
call fcn.101e6c40
call fcn.101e6c40
call fcn.101e6c40
call fcn.101e6c40
call fcn.101e6c40
call fcn.101e6c40
call fcn.101e6c40
call fcn.101e6c40
call fcn.101e6c40
call fcn.101e6c40
call fcn.101e6c40
call fcn.101e6c40
call fcn.101e6c40
call fcn.101e6c40
int3