Function at 0x11ca0ed0
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x11f9e4c3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
push ebx
push ebp
push esi
push edi
xor esi, esi
push 0x12119948
lea ecx, [esp + 0x14]
mov dword [esp + 0x228], esi
call fcn.11e7eae0
mov eax, dword [esp + 0x240]
push 0x12025ce8
push eax
mov byte [esp + 0x22c], 1
call fcn.11e67e01
add esp, 8
cmp eax, esi
jne 0x11ca0f2e
push str.TSafeWordAddin.dll
jmp 0x11ca0f6c
mov ecx, dword [esp + 0x240]
push 0x12025cb8
push ecx
call fcn.11e67e01
add esp, 8
cmp eax, esi
jne 0x11ca0f4e
push str.TSafeExcelAddin.dll
jmp 0x11ca0f6c
mov edx, dword [esp + 0x240]
push 0x12025c88
push edx
call fcn.11e67e01
add esp, 8
cmp eax, esi
jne 0x11ca0f75
push str.TSafePPTAddin.dll
lea ecx, [esp + 0x14]
call fcn.11e7f500
mov eax, dword [esp + 0x10]
cmp dword [eax - 8], esi
je 0x11ca0fd2
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x16]
mov word [esp + 0x14], si
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x14]
push 0x103
push ecx
stosw word es:[edi], ax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea edx, [esp + 0x14]
push edx
call fcn.11e67d05
add esp, 4
test eax, eax
jbe 0x11ca0fd2
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x230]
lea ecx, [esp + 0x14]
push eax
push ecx
push 0x12025c58
push edx
call fcn.11e82200
add esp, 0x10
mov eax, dword [0x12133f80]
cmp eax, esi
je 0x11ca0ffe
mov eax, dword [esp + 0x230]
mov edx, dword [esp + 0x10]
mov ecx, dword [eax]
push ecx
push edx
push str.GetWPSRegItemRoute:_strDllName__s__strModulePath__s_
push str.CurrentFileMgr
push 1
call fcn.11ca5810
add esp, 0x14
mov eax, dword [esp + 0x240]
push 0x12025ce8
push eax
call fcn.11e67e01
mov edi, dword [esp + 0x240]
mov ebp, dword [esp + 0x23c]
mov ebx, dword [esp + 0x234]
add esp, 8
cmp eax, esi
mov esi, dword [esp + 0x23c]
jne 0x11ca1061
push str.D77E2F43_BA5D_4BF5_8204_F2FA2C5EA2CB
mov ecx, ebx
call fcn.11e7f500
push str.TSafeWordAddin.Addin.1
mov ecx, ebp
call fcn.11e7f500
push str.19497662_61CD_4938_86DD_D13681B4DAA0
mov ecx, edi
call fcn.11e7f500
push str.TSafeWord_Addin
jmp 0x11ca10e7
mov ecx, dword [esp + 0x240]
push 0x12025cb8
push ecx
call fcn.11e67e01
add esp, 8
test eax, eax
jne 0x11ca10a5
push str.9FBA480C_2C08_48F4_8C71_6B5C5A41A9B2
mov ecx, ebx
call fcn.11e7f500
push str.TSafeExcelAddin.Addin.1
mov ecx, ebp
call fcn.11e7f500
push str.F2E3F548_B85D_4731_940C_4536A530220D
mov ecx, edi
call fcn.11e7f500
push str.TSafeExcel_Addin
jmp 0x11ca10e7
mov edx, dword [esp + 0x240]
push 0x12025c88
push edx
call fcn.11e67e01
add esp, 8
test eax, eax
jne 0x11ca10ee
push str.A814E58B_C192_4F6E_B659_6B82D6194DA6
mov ecx, ebx
call fcn.11e7f500
push str.TSafePPTAddin.Addin.1
mov ecx, ebp
call fcn.11e7f500
push str.F2B3B99B_E67E_48B7_9A91_4544483E7772
mov ecx, edi
call fcn.11e7f500
push str.TSafePPT_Addin
mov ecx, esi
call fcn.11e7f500
mov eax, dword [0x12133f80]
test eax, eax
je 0x11ca1122
mov eax, dword [esi]
mov ecx, dword [edi]
mov edx, dword [ebp]
push eax
mov eax, dword [esp + 0x234]
push ecx
push edx
mov edx, dword [ebx]
mov ecx, dword [eax]
push ecx
push edx
push str.GetWPSRegItemRoute:_strCLSID__s__strModulePath__s__strCurVer__s__strTypeLib__s__strComDescription__s_
push str.CurrentFileMgr
push 1
call fcn.11ca5810
add esp, 0x20
lea ecx, [esp + 0x10]
mov byte [esp + 0x224], 0
call fcn.11e7f280
lea ecx, [esp + 0x240]
mov dword [esp + 0x224], 0xffffffff
call fcn.11e7f280
mov ecx, dword [esp + 0x21c]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x218
ret 0x18