Function at 0x9a2db0
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x414]
sub esp, 0x414
push 0xfffffffffffffffe
push 0xb14860
push 0xa847a0
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0xb196ec]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp + 0x410], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov esi, ecx
mov eax, dword [ebp + 0x41c]
mov dword [ebp - 0x1c], eax
xor ebx, ebx
mov byte [ebp + 0x30c], bl
push 0x103
push ebx
lea ecx, [ebp + 0x30d]
push ecx
call fcn.00a7ffb0
add esp, 0xc
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 4], ebx
call fcn.00968110
mov edi, eax
cmp edi, ebx
je 0x9a2e81
push 0x104
lea edx, [ebp + 0x30c]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [ebp + 0x30c]
call fcn.00960910
lea eax, [ebp + 0x30c]
dec eax
mov cl, byte [eax + 1]
inc eax
cmp cl, bl
jne 0x9a2e54
mov ecx, dword [str.rundll32.exe]
mov dword [eax], ecx
mov edx, dword [0xacaebc]
mov dword [eax + 4], edx
mov ecx, dword [0xacaec0]
mov dword [eax + 8], ecx
mov dl, byte [0xacaec4]
mov byte [eax + 0xc], dl
jmp 0x9a2eaf
mov eax, dword [str.rundll32.exe]
mov dword [ebp + 0x30c], eax
mov ecx, dword [0xacaebc]
mov dword [ebp + 0x310], ecx
mov edx, dword [0xacaec0]
mov dword [ebp + 0x314], edx
mov al, byte [0xacaec4]
mov byte [ebp + 0x318], al
cmp esi, ebx
je 0x9a2fe2
cmp byte [esi], bl
je 0x9a2fe2
mov ecx, esi
call fcn.00959b80
test eax, eax
jne 0x9a2ee9
mov eax, dword [ebp - 0x1c]
cmp eax, ebx
je 0x9a3002
push esi
push str._s_file_not_present
push eax
call fcn.00a78f30
add esp, 0xc
jmp 0x9a3002
mov ebx, str.mwfsmfltr
call fcn.009605b0
test eax, eax
jne 0x9a2fd4
or ebx, 0xffffffff
mov dword [ebp - 0x24], ebx
push eax
call fcn.00989380
push esi
lea ecx, [ebp + 0x30c]
push ecx
push str._s_setupapi.dll_InstallHinfSection_DefaultInstall_128__s
lea edx, [ebp]
push edx
call fcn.00a78f30
add esp, 0x10
test edi, edi
je 0x9a2f34
lea eax, [ebp - 0x20]
push eax
call fcn.009681c0
add esp, 4
mov esi, eax
jmp 0x9a2f37
mov esi, dword [ebp - 0x28]
xor ecx, ecx
call fcn.009790d0
test eax, eax
je 0x9a2f7d
call fcn.00968d70
test eax, eax
jne 0x9a2f7d
mov byte [ebp + 0x208], al
push 0x103
push eax
lea ecx, [ebp + 0x209]
push ecx
call fcn.00a7ffb0
add esp, 0xc
push 0
push 1
lea edx, [ebp + 0x208]
lea ecx, [ebp]
call fcn.0095d9e0
mov ebx, eax
mov dword [ebp - 0x24], ebx
test ebx, ebx
je 0x9a2f98
push 0
push 1
lea edx, [ebp]
push edx
xor eax, eax
xor ecx, ecx
or edx, 0xffffffff
call fcn.0095dfe0
add esp, 0xc
test esi, esi
je 0x9a2fa8
mov eax, dword [ebp - 0x20]
push eax
call fcn.00968240
add esp, 4
push 1
call fcn.00989380
mov ebx, str.mwfsmfltr
call fcn.009605b0
test eax, eax
jne 0x9a2fd4
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x9a3002
push str.Failed_to_install_mwfsmfltr
push eax
call fcn.00a78f30
add esp, 8
jmp 0x9a3002
mov dword [ebp - 4], 0xfffffffe
mov eax, 1
jmp 0x9a300b
mov eax, dword [ebp - 0x1c]
cmp eax, ebx
je 0x9a3002
push str.Invalid_parameter
push eax
call fcn.00a78f30
add esp, 8
jmp 0x9a3002
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x410]
xor ecx, ebp
call fcn.00a78f21
add ebp, 0x414
mov esp, ebp
pop ebp
ret 4