Function at 0x10009561
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x134c
call fcn.1003366c
mov eax, dword [0x100440b0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
test esi, esi
je 0x100099c7
cmp dword [ebp + 0x10], 0
jbe 0x100099c7
xor eax, eax
mov edi, str.SOFTWAREPoliciesMicrosoftOffice_i.0CommonGeneral
push 0x25
push edi
mov word [esi], ax
call fcn.10018d09
xor ebx, ebx
pop ecx
inc ebx
test eax, eax
pop ecx
lea eax, [ebp - 0x104]
je 0x100095d0
push dword [ebp + 8]
push edi
push 0x80
push eax
call fcn.10018d09
add esp, 0x10
test eax, eax
jne 0x100095ed
xor edi, edi
mov eax, edi
jmp 0x10009697
push 0xffffffffffffffff
push edi
push 0x80
push eax
call fcn.10018d09
xor ecx, ecx
add esp, 0x10
cmp eax, 0x50
setne cl
test ecx, ecx
jmp 0x100095c5
push dword [ebp + 0x10]
lea edx, [ebp - 0x104]
mov ecx, SysReAllocString
push esi
push str.UserTemplates
call fcn.10018d09
test eax, eax
je 0x10009690
mov ecx, esi
call fcn.100087f2
test al, al
jne 0x10009690
mov ecx, esi
call fcn.10008967
test al, al
je 0x10009690
xor eax, eax
xor edi, edi
cmp ax, word [esi]
je 0x1000968c
mov ecx, esi
call fcn.10018d09
test eax, eax
je 0x1000968c
cmp dword [ebp + 0x10], edi
jle 0x10009682
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, di
jne 0x10009642
sub ecx, edx
sar ecx, 1
call fcn.10018d09
mov ecx, eax
cmp ecx, dword [ebp + 0x10]
jge 0x10009682
test ecx, ecx
jle 0x1000967e
push 0x5c
pop edx
cmp dx, word [esi + ecx*2 - 2]
je 0x1000967e
lea eax, [ecx + 1]
cmp eax, dword [ebp + 0x10]
jge 0x10009682
xor eax, eax
mov word [esi + ecx*2], dx
mov word [esi + ecx*2 + 2], ax
mov eax, ebx
jmp 0x10009684
mov eax, edi
test eax, eax
je 0x1000968c
mov eax, ebx
jmp 0x10009697
xor eax, eax
jmp 0x10009694
xor eax, eax
xor edi, edi
mov word [esi], ax
test eax, eax
jne 0x100099c9
push 0x25
push str.SOFTWAREMicrosoftOffice_i.0CommonGeneral
mov word [esi], ax
call fcn.10018d09
pop ecx
test eax, eax
lea eax, [ebp - 0x204]
pop ecx
je 0x100096d9
push dword [ebp + 8]
push str.SOFTWAREMicrosoftOffice_i.0CommonGeneral
push 0x80
push eax
call fcn.10018d09
add esp, 0x10
test eax, eax
jne 0x100096fe
jmp 0x1000979d
push 0xffffffffffffffff
push str.SOFTWAREMicrosoftOffice_i.0CommonGeneral
push 0x80
push eax
call fcn.10018d09
xor ecx, ecx
add esp, 0x10
cmp eax, 0x50
setne cl
test ecx, ecx
je 0x1000979d
push dword [ebp + 0x10]
lea edx, [ebp - 0x204]
mov ecx, SysReAllocString
push esi
push str.UserTemplates
call fcn.10018d09
test eax, eax
je 0x10009798
mov ecx, esi
call fcn.100087f2
test al, al
jne 0x10009798
mov ecx, esi
call fcn.10008967
test al, al
je 0x10009798
xor eax, eax
cmp ax, word [esi]
je 0x10009798
mov ecx, esi
call fcn.10018d09
test eax, eax
je 0x10009798
cmp dword [ebp + 0x10], 0
jle 0x1000978e
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, di
jne 0x1000974e
sub ecx, edx
sar ecx, 1
call fcn.10018d09
mov ecx, eax
cmp ecx, dword [ebp + 0x10]
jge 0x1000978e
test ecx, ecx
jle 0x1000978a
push 0x5c
pop edx
cmp dx, word [esi + ecx*2 - 2]
je 0x1000978a
lea eax, [ecx + 1]
cmp eax, dword [ebp + 0x10]
jge 0x1000978e
xor eax, eax
mov word [esi + ecx*2], dx
mov word [esi + ecx*2 + 2], ax
mov eax, ebx
jmp 0x10009790
mov eax, edi
test eax, eax
je 0x10009798
mov eax, ebx
jmp 0x1000979f
xor eax, eax
mov word [esi], ax
mov eax, edi
test eax, eax
jne 0x100099c9
push 0x25
push str.SOFTWAREMicrosoftOffice_i.0CommonGeneral
mov word [esi], ax
call fcn.10018d09
pop ecx
test eax, eax
lea eax, [ebp - 0x304]
pop ecx
je 0x100097e1
push dword [ebp + 8]
push str.SOFTWAREMicrosoftOffice_i.0CommonGeneral
push 0x80
push eax
call fcn.10018d09
add esp, 0x10
test eax, eax
jne 0x10009806
jmp 0x100099ba
push 0xffffffffffffffff
push str.SOFTWAREMicrosoftOffice_i.0CommonGeneral
push 0x80
push eax
call fcn.10018d09
xor ecx, ecx
add esp, 0x10
cmp eax, 0x50
setne cl
test ecx, ecx
je 0x100099ba
push dword [ebp + 0x10]
lea edx, [ebp - 0x304]
mov ecx, SysReAllocString
push esi
push str.Templates
call fcn.10018d09
test eax, eax
je 0x1000982e
mov ecx, esi
call fcn.100087f2
test al, al
je 0x10009863
mov ecx, str.Templates
call fcn.100087f2
test al, al
jne 0x100099b5
push 0xffffffffffffffff
push str.Templates
push dword [ebp + 0x10]
push esi
call fcn.10018d09
xor ecx, ecx
add esp, 0x10
cmp eax, 0x50
setne cl
test ecx, ecx
je 0x100099b5
push ebx
push 0x1a
lea eax, [ebp - 0x134c]
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x100099b5
lea ecx, [ebp - 0x134c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, di
jne 0x10009885
sub ecx, edx
sar ecx, 1
call fcn.10018d09
mov ecx, eax
mov edx, 0x824
cmp ecx, edx
jl 0x100098a8
mov eax, edi
jmp 0x100098d7
test ecx, ecx
jle 0x100098d5
push 0x5c
pop eax
cmp ax, word [ebp + ecx*2 - 0x134e]
je 0x100098d5
lea eax, [ecx + 1]
cmp eax, edx
jge 0x100098a4
push 0x5c
pop eax
mov word [ebp + ecx*2 - 0x134c], ax
xor eax, eax
mov word [ebp + ecx*2 - 0x134a], ax
mov eax, ebx
test eax, eax
je 0x100099b5
push 0xffffffffffffffff
push str.Microsoft_
push edx
lea eax, [ebp - 0x134c]
push eax
call fcn.10018d09
xor ecx, ecx
add esp, 0x10
cmp eax, 0x50
setne cl
test ecx, ecx
je 0x100099b5
push 0xffffffffffffffff
push esi
lea eax, [ebp - 0x134c]
push 0x824
push eax
call fcn.10018d09
xor ecx, ecx
add esp, 0x10
cmp eax, 0x50
setne cl
test ecx, ecx
je 0x100099b5
push 0xffffffffffffffff
lea eax, [ebp - 0x134c]
push eax
push dword [ebp + 0x10]
push esi
call fcn.10018d09
xor ecx, ecx
add esp, 0x10
cmp eax, 0x50
setne cl
test ecx, ecx
je 0x100099b5
xor eax, eax
cmp ax, word [esi]
je 0x100099b5
mov ecx, esi
call fcn.10018d09
test eax, eax
je 0x100099b5
cmp dword [ebp + 0x10], 0
jle 0x100099ab
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, di
jne 0x1000996b
sub ecx, edx
sar ecx, 1
call fcn.10018d09
mov ecx, eax
cmp ecx, dword [ebp + 0x10]
jge 0x100099ab
test ecx, ecx
jle 0x100099a7
push 0x5c
pop edx
cmp dx, word [esi + ecx*2 - 2]
je 0x100099a7
lea eax, [ecx + 1]
cmp eax, dword [ebp + 0x10]
jge 0x100099ab
xor eax, eax
mov word [esi + ecx*2], dx
mov word [esi + ecx*2 + 2], ax
mov eax, ebx
jmp 0x100099ad
mov eax, edi
test eax, eax
je 0x100099b5
mov eax, ebx
jmp 0x100099bc
xor eax, eax
mov word [esi], ax
mov eax, edi
test eax, eax
jne 0x100099c9
mov word [esi], ax
mov ebx, edi
jmp 0x100099c9
xor ebx, ebx
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1001eea4
leave
ret 0xc