Function at 0x536760
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x116c
call fcn.005e00d0
mov eax, dword [0x6aae14]
xor eax, esp
mov dword [esp + 0x1168], eax
push ebx
push esi
push edi
xor esi, esi
push 0x124
lea eax, [esp + 0x50]
push esi
push eax
mov dword [esp + 0x54], esi
call fcn.005dfd60
add esp, 0xc
mov dword [esp + 0x10], esi
cmp dword [0x75c7f4], esi
jne 0x5367ba
mov dword [0x75c7f4], 1
call fcn.004d9b00
mov dword [0x75c7f0], eax
push 0x647c1c
call fcn.004f4be0
mov ebx, eax
mov dword [esp + 0x1c], ebx
cmp ebx, esi
je 0x536d54
push 0x643dac
call fcn.004f4be0
mov dword [esp + 0x24], eax
cmp eax, esi
jne 0x536802
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1168]
xor ecx, esp
call fcn.005dfbbe
mov esp, ebp
pop ebp
ret
cmp byte [0x75c3f0], 0
jne 0x5368f2
push 0x400
push 0x75bff0
call fcn.00534010
add esp, 8
cmp byte [0x75bff0], 0
je 0x536837
push 0x75bff0
call fcn.004e24e0
add esp, 4
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x75bff0
push 0x75bbf0
call esi
push 0x75bbf0
call fcn.004e24e0
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
add esp, 4
push str.servicingTrustedInstaller.exe
push 0x75bbf0
call edi
push 0x75bff0
push 0x75b7f0
call esi
push str.WinSxS
push 0x75b7f0
call edi
push 0x75b7f0
call fcn.004e24e0
add esp, 4
push 0x400
push 0x75c3f0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x75c3f0
call fcn.004e24e0
add esp, 4
push 0x75c3f0
push 0x75b3f0
call esi
push str.svchost.exe
push 0x75b3f0
call edi
push 0x75c3f0
push 0x75aff0
call esi
push str.VSSVC.exe
push 0x75aff0
call edi
push 0x75c3f0
push 0x75abf0
call esi
push str.poqexec.exe
push 0x75abf0
call edi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.CreateToolhelp32Snapshot
push ebx
call esi
push str.Process32First
push ebx
mov edi, eax
call esi
mov ecx, dword [esp + 0x1c]
push str.Process32Next
push ecx
mov ebx, eax
call esi
mov edx, dword [esp + 0x24]
push 0x643d10
push edx
mov dword [esp + 0x30], eax
call esi
mov dword [esp + 0x20], eax
test edi, edi
je 0x536d2f
test ebx, ebx
je 0x536d2f
cmp dword [esp + 0x28], 0
je 0x536d2f
test eax, eax
je 0x536d2f
push 0
push 2
call edi
mov dword [esp + 0x10], eax
cmp eax, 0xffffffff
je 0x536d2f
lea ecx, [esp + 0x48]
push ecx
push eax
mov dword [esp + 0x50], 0x128
call ebx
test eax, eax
je 0x536d2f
push 0x753b90
call fcn.004da810
add esp, 4
test eax, eax
je 0x536d2f
push 0x3ff
lea edx, [esp + 0x175]
push 0
push edx
mov byte [esp + 0x17c], 0
call fcn.005dfd60
push 0x3ff
lea eax, [esp + 0x581]
push 0
push eax
mov byte [esp + 0x588], 0
call fcn.005dfd60
add esp, 0x18
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, dword [0x753f34]
mov edx, dword [0x753f1c]
mov esi, eax
mov dword [esp + 0x18], ecx
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x30]
mov dword [esp + 0x18], edx
push ecx
lea edx, [esp + 0x38]
push edx
mov ecx, 0x753f1c
mov dword [esp + 0x38], esi
call fcn.00535a00
mov ecx, eax
call fcn.0053ffe0
test al, al
je 0x536a80
lea eax, [esp + 0x570]
push eax
push esi
call fcn.005327e0
test eax, eax
je 0x536a4c
lea ecx, [esp + 0x2c]
push ecx
lea edx, [esp + 0x34]
push edx
mov ecx, 0x753f1c
call fcn.00536010
push esi
lea eax, [esp + 0x174]
push str.PID_added_to_Whitelist_3_:__u__avpmapp.exe
push eax
call fcn.005dfb23
add esp, 0xc
jmp 0x536a6a
lea ecx, [esp + 0x570]
push ecx
push esi
lea edx, [esp + 0x178]
push str.PID_addition_to_Whitelist_failed:__u___s
push edx
call fcn.005dfb23
add esp, 0x10
lea eax, [esp + 0x170]
push eax
call fcn.00531590
add esp, 4
lea ebx, [ebx]
mov ecx, dword [0x753f34]
mov edx, dword [0x753f1c]
mov dword [esp + 0x18], ecx
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x54]
mov dword [esp + 0x18], edx
push ecx
lea edx, [esp + 0x38]
push edx
mov ecx, 0x753f1c
call fcn.00535a00
mov ecx, eax
call fcn.0053ffe0
test al, al
je 0x536d0c
push 0x7ff
lea eax, [esp + 0x975]
push 0
push eax
mov byte [esp + 0x97c], 0
call fcn.005dfd60
lea ecx, [esp + 0x78]
push str.TPAutoConnect.exe
push ecx
call fcn.005f095a
add esp, 0x14
test eax, eax
jne 0x536b3b
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x50]
lea edx, [esp + 0x970]
push edx
push eax
push ecx
call fcn.00534b30
add esp, 0xc
cmp byte [esp + 0x970], 0
je 0x536c5f
push 0
lea edx, [esp + 0x974]
push str.VMwareVMware_Tools_
push edx
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
je 0x536c5f
jmp 0x536c74
cmp dword [0x75c7f0], 0
je 0x536c5f
lea eax, [esp + 0x6c]
push str.svchost.exe
push eax
call fcn.005f095a
add esp, 8
test eax, eax
je 0x536bba
lea ecx, [esp + 0x6c]
push str.tiworker.exe
push ecx
call fcn.005f095a
add esp, 8
test eax, eax
je 0x536bba
lea edx, [esp + 0x6c]
push str.TrustedInstaller.exe
push edx
call fcn.005f095a
add esp, 8
test eax, eax
je 0x536bba
lea eax, [esp + 0x6c]
push str.VSSVC.exe
push eax
call fcn.005f095a
add esp, 8
test eax, eax
je 0x536bba
lea ecx, [esp + 0x6c]
push str.poqexec.exe
push ecx
call fcn.005f095a
add esp, 8
test eax, eax
jne 0x536c5f
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x50]
lea edx, [esp + 0x970]
push edx
push eax
push ecx
call fcn.00534b30
add esp, 0xc
cmp byte [esp + 0x970], 0
je 0x536c5f
lea edx, [esp + 0x970]
push 0x75b3f0
push edx
call fcn.005f095a
add esp, 8
test eax, eax
je 0x536c74
lea eax, [esp + 0x970]
push 0x75b7f0
push eax
call fcn.004dd6e0
add esp, 8
test eax, eax
je 0x536c74
lea ecx, [esp + 0x970]
push 0x75bbf0
push ecx
call fcn.005f095a
add esp, 8
test eax, eax
je 0x536c74
lea edx, [esp + 0x970]
push 0x75aff0
push edx
call fcn.005f095a
add esp, 8
test eax, eax
je 0x536c74
lea eax, [esp + 0x970]
push 0x75abf0
push eax
call fcn.005f095a
add esp, 8
test eax, eax
je 0x536c74
lea ecx, [esp + 0x6c]
push ecx
call fcn.00534930
add esp, 4
test eax, eax
je 0x536d0c
mov eax, dword [esp + 0x50]
lea edx, [esp + 0x570]
push edx
push eax
call fcn.005327e0
test eax, eax
je 0x536cda
lea ecx, [esp + 0x50]
push ecx
lea edx, [esp + 0x40]
push edx
mov ecx, 0x753f1c
call fcn.00536010
cmp byte [esp + 0x6c], 0
je 0x536cbe
mov ecx, dword [esp + 0x50]
lea eax, [esp + 0x6c]
push eax
push ecx
push str.PID_added_to_Whitelist_4_:__u___s
lea edx, [esp + 0x17c]
push edx
jmp 0x536cf4
mov eax, dword [esp + 0x50]
push eax
lea ecx, [esp + 0x174]
push str.PID_added_to_Whitelist_5_:__u
push ecx
call fcn.005dfb23
add esp, 0xc
jmp 0x536cfc
mov eax, dword [esp + 0x50]
lea edx, [esp + 0x570]
push edx
push eax
push str.PID_addition_to_Whitelist_failed:__u___s
lea ecx, [esp + 0x17c]
push ecx
call fcn.005dfb23
add esp, 0x10
lea edx, [esp + 0x170]
push edx
call fcn.00531590
add esp, 4
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [esp + 0x30]
test eax, eax
jne 0x536a80
mov edx, dword [0x753b90]
push edx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, dword [esp + 0x1c]
mov esi, dword [sym.imp.KERNEL32.dll_FreeLibrary]
push eax
call esi
mov ecx, dword [esp + 0x24]
push ecx
call esi
cmp dword [esp + 0x10], 0
je 0x536d54
lea edx, [esp + 0x10]
push edx
call fcn.004dca10
mov ecx, dword [esp + 0x1174]
pop edi
pop esi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.005dfbbe
mov esp, ebp
pop ebp
ret