Function at 0x676520
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x72cfd0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x55c
push ebx
xor ebx, ebx
push ebp
push esi
mov dword [esp + 0x10], ebx
mov eax, dword [esp + 0x57c]
mov ebp, 1
mov dword [esp + 0x570], ebp
cmp dword [eax - 8], ebx
jne 0x676578
mov esi, dword [esp + 0x578]
push 0x8c33fc
mov ecx, esi
call fcn.006efc30
mov dword [esp + 0x10], ebp
jmp 0x67675d
push 0x5c
lea ecx, [esp + 0x580]
call fcn.006eb7ba
cmp eax, 0xffffffff
jne 0x6765a7
mov esi, dword [esp + 0x578]
push 0x8c33fc
mov ecx, esi
call fcn.006efc30
mov dword [esp + 0x10], ebp
jmp 0x67675d
mov ecx, dword [esp + 0x57c]
lea edx, [esp + 0xc]
mov ecx, dword [ecx - 8]
sub ecx, eax
dec ecx
push ecx
push edx
lea ecx, [esp + 0x584]
call fcn.006eb69b
push 0x2e
lea ecx, [esp + 0x10]
mov byte [esp + 0x574], 2
call fcn.006f00b0
cmp eax, 0xffffffff
jne 0x6765fa
mov esi, dword [esp + 0x578]
push 0x8c33fc
mov ecx, esi
call fcn.006efc30
mov dword [esp + 0x10], ebp
jmp 0x67674c
push eax
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x14]
call fcn.006eb717
lea ecx, [esp + 0x168]
mov byte [esp + 0x570], 3
push ecx
push 0x400
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jne 0x676644
mov esi, dword [esp + 0x578]
push 0x8c33fc
mov ecx, esi
call fcn.006efc30
mov dword [esp + 0x10], ebp
jmp 0x67673b
lea edx, [esp + 0x168]
lea ecx, [esp + 0x14]
push edx
call fcn.006efc30
lea eax, [esp + 0x18]
push str..rtf
lea ecx, [esp + 0x38]
push eax
push ecx
mov byte [esp + 0x57c], 4
call fcn.006efe57
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x574], 5
call fcn.006effda
lea ecx, [esp + 0x34]
mov byte [esp + 0x570], 4
call fcn.006efbc2
lea ecx, [esp + 0x1c]
call fcn.00711ab1
lea ecx, [esp + 0x24]
mov byte [esp + 0x570], 6
call fcn.00711ab1
lea ecx, [esp + 0x24]
mov byte [esp + 0x570], 7
call fcn.00711bc2
push ebx
push str.Word.Application
lea ecx, [esp + 0x24]
mov dword [esp + 0x28], ebp
call fcn.00711b6f
test eax, eax
jne 0x676777
push 0x2010
call fcn.005640d0
push eax
push 0x85cd70
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
mov esi, dword [esp + 0x578]
push 0x8c33fc
mov ecx, esi
call fcn.006efc30
lea ecx, [esp + 0x24]
mov dword [esp + 0x10], ebp
mov byte [esp + 0x570], 6
call fcn.00711bc2
lea ecx, [esp + 0x1c]
mov byte [esp + 0x570], 4
call fcn.00711bc2
lea ecx, [esp + 0x14]
mov byte [esp + 0x570], 3
call fcn.006efbc2
lea ecx, [esp + 0x18]
mov byte [esp + 0x570], 2
call fcn.006efbc2
lea ecx, [esp + 0xc]
mov byte [esp + 0x570], 1
call fcn.006efbc2
lea ecx, [esp + 0x57c]
mov byte [esp + 0x570], bl
call fcn.006efbc2
mov eax, esi
jmp 0x676b7f
lea edx, [esp + 0x57c]
push edi
push edx
lea ecx, [esp + 0xd0]
mov word [esp + 0xd0], bx
call fcn.005c36b7
push 0x8c33fc
lea ecx, [esp + 0x40]
mov byte [esp + 0x578], 8
mov word [esp + 0x40], bx
call fcn.005c3649
push 2
push ebx
lea ecx, [esp + 0x154]
mov byte [esp + 0x57c], 9
call fcn.005c358c
mov esi, 0xb
lea ecx, [esp + 0x4c]
push esi
push ebp
mov byte [esp + 0x57c], 0xa
call fcn.005c358c
push esi
push ebx
lea ecx, [esp + 0x64]
mov byte [esp + 0x57c], 0xb
call fcn.005c358c
push ebp
lea ecx, [esp + 0x24]
mov byte [esp + 0x578], 0xc
call fcn.006d8cd0
push eax
lea ecx, [esp + 0x30]
call fcn.00711ba9
lea eax, [esp + 0x4c]
lea ecx, [esp + 0x4c]
push eax
lea edx, [esp + 0x50]
push ecx
lea eax, [esp + 0x44]
push edx
lea ecx, [esp + 0x48]
push eax
lea edx, [esp + 0x6c]
push ecx
lea eax, [esp + 0x50]
push edx
lea ecx, [esp + 0x54]
push eax
lea edx, [esp + 0x78]
push ecx
lea eax, [esp + 0x6c]
push edx
lea ecx, [esp + 0x80]
push eax
lea edx, [esp + 0xf4]
push ecx
push edx
lea ecx, [esp + 0x58]
call fcn.006d8d40
lea ecx, [esp + 0x20]
call fcn.006d8cf0
push ebp
push eax
lea ecx, [esp + 0x38]
call fcn.00711abe
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0xac]
push eax
mov byte [esp + 0x578], 0xd
mov word [esp + 0xb0], bx
call fcn.00676bb0
mov word [esp + 0x8c], 3
mov dword [esp + 0x94], 6
mov word [esp + 0x7c], si
mov word [esp + 0x84], bx
push 0x8c33fc
lea ecx, [esp + 0x120]
mov byte [esp + 0x578], 0x10
mov word [esp + 0x120], bx
call fcn.00676bb0
mov word [esp + 0xdc], si
mov word [esp + 0xe4], 0xffff
push 0x8c33fc
lea ecx, [esp + 0x100]
mov byte [esp + 0x578], 0x12
mov word [esp + 0x100], bx
call fcn.00676bb0
mov word [esp + 0xbc], si
mov word [esp + 0xc4], bx
mov word [esp + 0xec], si
mov word [esp + 0xf4], bx
mov word [esp + 0x6c], si
mov word [esp + 0x74], bx
mov word [esp + 0x10c], si
mov word [esp + 0x114], bx
mov word [esp + 0x9c], si
mov word [esp + 0xa4], bx
lea ecx, [esp + 0x9c]
lea edx, [esp + 0x10c]
push ecx
lea eax, [esp + 0x70]
push edx
lea ecx, [esp + 0xf4]
push eax
lea edx, [esp + 0xc8]
push ecx
lea eax, [esp + 0x10c]
push edx
lea ecx, [esp + 0xf0]
push eax
lea edx, [esp + 0x134]
push ecx
lea eax, [esp + 0x98]
push edx
lea ecx, [esp + 0xac]
push eax
lea edx, [esp + 0xd0]
push ecx
push edx
lea ecx, [esp + 0x5c]
mov byte [esp + 0x5a0], 0x18
call fcn.006d8da0
lea ecx, [esp + 0x30]
call fcn.00711bc2
lea ecx, [esp + 0x28]
call fcn.00711bc2
push 0xa
push 0x80020004
lea ecx, [esp + 0x144]
call fcn.005c35c2
mov esi, eax
push 0xa
push 0x80020004
lea ecx, [esp + 0x164]
mov byte [esp + 0x57c], 0x19
call fcn.005c35c2
mov edi, eax
push 0xa
push 0x80020004
lea ecx, [esp + 0x134]
mov byte [esp + 0x57c], 0x1a
call fcn.005c35c2
push esi
push edi
push eax
lea ecx, [esp + 0x2c]
mov byte [esp + 0x580], 0x1b
call fcn.006d8d10
mov esi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
lea eax, [esp + 0x12c]
push eax
call esi
lea ecx, [esp + 0x15c]
push ecx
call esi
lea edx, [esp + 0x13c]
mov byte [esp + 0x574], 0x18
push edx
call esi
lea ecx, [esp + 0x20]
call fcn.00711bc2
mov edi, dword [esp + 0x57c]
lea eax, [esp + 0x18]
push eax
mov ecx, edi
call fcn.006ef937
lea ecx, [esp + 0x9c]
mov dword [esp + 0x14], ebp
push ecx
call esi
lea edx, [esp + 0x10c]
push edx
call esi
lea eax, [esp + 0x6c]
push eax
call esi
lea ecx, [esp + 0xec]
push ecx
call esi
lea edx, [esp + 0xbc]
push edx
call esi
lea eax, [esp + 0xfc]
push eax
call esi
lea ecx, [esp + 0xdc]
push ecx
call esi
lea edx, [esp + 0x11c]
push edx
call esi
lea eax, [esp + 0x7c]
push eax
call esi
lea ecx, [esp + 0x8c]
push ecx
call esi
lea edx, [esp + 0xac]
push edx
call esi
lea ecx, [esp + 0x30]
mov byte [esp + 0x574], 0xc
call fcn.00711bc2
lea eax, [esp + 0x5c]
push eax
call esi
lea ecx, [esp + 0x4c]
push ecx
call esi
lea edx, [esp + 0x14c]
push edx
call esi
lea eax, [esp + 0x3c]
push eax
call esi
lea ecx, [esp + 0xcc]
push ecx
call esi
lea ecx, [esp + 0x28]
mov byte [esp + 0x574], 6
call fcn.00711bc2
mov byte [esp + 0x574], 4
lea ecx, [esp + 0x20]
call fcn.00711bc2
lea ecx, [esp + 0x18]
mov byte [esp + 0x574], 3
call fcn.006efbc2
lea ecx, [esp + 0x1c]
mov byte [esp + 0x574], 2
call fcn.006efbc2
lea ecx, [esp + 0x10]
mov byte [esp + 0x574], 1
call fcn.006efbc2
lea ecx, [esp + 0x580]
mov byte [esp + 0x574], bl
call fcn.006efbc2
mov eax, edi
pop edi
mov ecx, dword [esp + 0x568]
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x568
ret