Function at 0x10054420
Capabilities:
Get common file path
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x100ce805
push eax
mov dword fs:[0], esp
sub esp, 0x1c
cmp dword [0x1010e5cc], 0
jne 0x100549ee
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov bl, byte [ebp + 8]
mov dword [0x1010e5cc], eax
test bl, bl
je 0x1005446e
push dword [ebp + 0xc]
call fcn.10058950
add esp, 4
test al, al
je 0x100549ed
push esi
push edi
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
push 0
push 0
mov dword [0x1010e568], eax
mov byte [0x1010e5c9], bl
call fcn.10054370
add esp, 8
inc eax
mov esi, 0x104
cmp eax, esi
push 0
push 0
cmova esi, eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
add eax, 8
cmp esi, eax
push 0
push 0
cmovb esi, eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
inc eax
mov edx, 2
cmp esi, eax
cmovb esi, eax
xor ecx, ecx
mov eax, esi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.100a5a6b
mov ebx, eax
push esi
push ebx
mov dword [ebp - 0x10], ebx
lea edi, [ebx + 4]
call fcn.10054370
add esp, 0xc
cmp eax, esi
jae 0x10054584
mov ecx, edi
mov dword [ebp - 0x28], 0
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10054512
sub ecx, edx
sar ecx, 1
push ecx
push edi
lea ecx, [ebp - 0x28]
call fcn.10055460
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0
push eax
push 0x10109550
call fcn.10059ab0
mov edx, dword [ebp - 0x14]
add esp, 8
mov dword [ebp - 4], 0xffffffff
cmp edx, 8
jb 0x10054584
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x1005457a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100549fc
push edx
push ecx
call fcn.100a576e
add esp, 8
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
jae 0x10054626
mov ecx, edi
mov dword [ebp - 0x28], 0
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100545b4
sub ecx, edx
sar ecx, 1
push ecx
push edi
lea ecx, [ebp - 0x28]
call fcn.10055460
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 1
push eax
push 0x10109598
call fcn.10059ab0
mov edx, dword [ebp - 0x14]
add esp, 8
mov dword [ebp - 4], 0xffffffff
cmp edx, 8
jb 0x10054626
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x1005461c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100549fc
push edx
push ecx
call fcn.100a576e
add esp, 8
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea ecx, [esi + 8]
cmp eax, ecx
jae 0x100546d7
push str.winsxs
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
mov ecx, edi
mov dword [ebp - 0x28], 0
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10054665
sub ecx, edx
sar ecx, 1
push ecx
push edi
lea ecx, [ebp - 0x28]
call fcn.10055460
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 2
push eax
push 0x10109580
call fcn.10059ab0
mov edx, dword [ebp - 0x14]
add esp, 8
mov dword [ebp - 4], 0xffffffff
cmp edx, 8
jb 0x100546d7
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x100546cd
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100549fc
push edx
push ecx
call fcn.100a576e
add esp, 8
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
cmp eax, esi
jae 0x10054779
mov ecx, edi
mov dword [ebp - 0x28], 0
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10054707
sub ecx, edx
sar ecx, 1
push ecx
push edi
lea ecx, [ebp - 0x28]
call fcn.10055460
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 3
push eax
push 0x10109568
call fcn.10059ab0
mov edx, dword [ebp - 0x14]
add esp, 8
mov dword [ebp - 4], 0xffffffff
cmp edx, 8
jb 0x10054779
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x1005476f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100549fc
push edx
push ecx
call fcn.100a576e
add esp, 8
mov esi, dword [ebp + 0xc]
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10054781
sub ecx, edx
push ecx
push esi
mov ecx, 0x10109520
call fcn.10036340
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push str.kernelbase.dll
mov byte [0x1010e5c8], 1
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100547e7
push 0
push 0x1010e570
push 0x100574f0
push 0x100d63c4
push eax
call esi
push eax
call fcn.100714b0
add esp, 0x10
cmp dword [0x1010e570], 0
jne 0x100547e7
push str.Failed_hooking_kernelbase_free_library_calls_n
call fcn.10084630
add esp, 4
push 0x100d6400
call ebx
push 0
push 0x1010e56c
push 0x10056720
mov edi, eax
push 0x100d63c4
push edi
call esi
push eax
call fcn.100714b0
add esp, 0x10
cmp dword [0x1010e56c], 0
jne 0x1005482c
cmp dword [0x1010e570], 0
jne 0x1005482c
push str.Failed_hooking_free_library_calls_n
call fcn.10084630
add esp, 4
push 0
push 0x1010e574
push 0x10055b20
push 0x100d6434
push edi
call esi
push eax
call fcn.100714b0
add esp, 0x10
push 0
push 0x1010e578
push 0x10055ba0
push 0x100d6440
push edi
call esi
push eax
call fcn.100714b0
add esp, 0x10
push 0
push 0x1010e5a0
push 0x10056a40
push str.GetFinalPathNameByHandleW
push edi
call esi
push eax
call fcn.100714b0
add esp, 0x10
push 0
push 0x1010e57c
push 0x10057060
push str.GetVolumeInformationByHandleW
push edi
call esi
push eax
call fcn.100714b0
add esp, 0x10
push 0
push 0x1010e59c
push fcn.10056740
push str.GetFileInformationByHandle
push edi
call esi
push eax
call fcn.100714b0
add esp, 0x10
push 0
push 0x1010e5a8
push 0x10056430
push str.EnumSystemFirmwareTables
push edi
call esi
push eax
call fcn.100714b0
add esp, 0x10
push 0
push 0x1010e5ac
push 0x10056d60
push str.GetSystemFirmwareTable
push edi
call esi
push eax
call fcn.100714b0
add esp, 0x10
push str.advapi32.dll
call ebx
mov edi, eax
test edi, edi
je 0x1005495b
push 0
push 0x1010e580
push 0x10058380
push str.RegCreateKeyExW
push edi
call esi
push eax
call fcn.100714b0
add esp, 0x10
push 0
push 0x1010e584
push 0x10058570
push 0x100d64f8
push edi
call esi
push eax
call fcn.100714b0
add esp, 0x10
push 0
push 0x1010e588
push 0x10058360
push 0x100d6508
push edi
call esi
push eax
call fcn.100714b0
add esp, 0x10
push str.ntdll.dll
call ebx
mov edi, eax
test edi, edi
je 0x100549e0
push 0
push 0x1010e590
push fcn.10057bb0
push str.NtQueryInformationFile
push edi
call esi
push eax
call fcn.100714b0
add esp, 0x10
push 0
push 0x1010e594
push 0x10057890
push str.NtQueryDirectoryFile
push edi
call esi
push eax
call fcn.100714b0
add esp, 0x10
push 0
push 0x1010e598
push 0x10058030
push str.NtQueryVolumeInformationFile
push edi
call esi
push eax
call fcn.100714b0
add esp, 0x10
push 0
push 0x1010e58c
push 0x10057510
push str.NtCreateFile
push edi
call esi
push eax
call fcn.100714b0
add esp, 0x10
push dword [ebp - 0x10]
call fcn.100a5a74
add esp, 4
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
call fcn.100b477d
int3