Function at 0x10002710
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xe54
mov eax, dword [0x1017455c]
xor eax, esp
mov dword [esp + 0xe50], eax
push ebx
push esi
push edi
xor ebx, ebx
push 0x207
lea eax, [esp + 0x42d]
push ebx
push eax
mov dword [esp + 0x18], ebx
mov byte [esp + 0x434], bl
call fcn.10116880
add esp, 0xc
push 0x207
lea ecx, [esp + 0x945]
push ebx
push ecx
mov byte [esp + 0x94c], bl
call fcn.10116880
add esp, 0xc
push 0x103
lea edx, [esp + 0x11d]
push ebx
push edx
mov byte [esp + 0x124], bl
call fcn.10116880
add esp, 0xc
push 0x103
lea eax, [esp + 0x15]
push ebx
push eax
mov byte [esp + 0x1c], bl
call fcn.10116880
add esp, 0xc
push 0x207
lea ecx, [esp + 0xb4d]
push ebx
push ecx
mov byte [esp + 0xb54], bl
call fcn.10116880
add esp, 0xc
push 0x207
lea edx, [esp + 0x73d]
push ebx
push edx
mov byte [esp + 0x744], bl
call fcn.10116880
add esp, 0xc
push 0x104
lea eax, [esp + 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea esi, [esp + 0x118]
call fcn.10049c80
lea ecx, [esp + 0x10]
push 0x104
push ecx
call fcn.10042f40
lea esi, [esp + 0x18]
call fcn.10049c80
push 1
lea edx, [esp + 0x18]
push 0x2c
push edx
lea edx, [esp + 0x43c]
mov ecx, str.ACCWIZ.EXE_Accessibility_Wizard_CALC.EXE_Calculator_CHARMAP.EXE_Character_Map_CLEANMGR.EXE_Disk_Space_Cleanup_Manager_CLICONFG.EXE_SQL_Client_Configuration_Utlity_CLIPBRD.EXE_Clipbook_Viewer_CLSPACK.EXE_Class_Package_Export_Tool_CMSTP.EXE_Connection_Manager_Profile_Installer_CONTROL.EXE_Control_Panel_DCOMCNFG.EXE_Component_Services_DDESHARE.EXE_DDE_Share_DVDPLAY.EXE_DVD_Player_DXDIAG.EXE_DirectX_Diagnostics_EUDCEDIT.EXE_Private_Character_Editor_EVENTVWR.EXE_Event_Viewer_FREECELL.EXE_Free_Cell_FXSCLNT.EXE_Fax_Console_FXSCOVER.EXE_Fax_Cover_Page_Editor_FXSEND.EXE_MS_Fax_Send_Note_Utility_IEXPRESS.EXE_IExpress_2.0_LOGOFF.EXE_System_Logoff_MAGNIFY.EXE_Microsoft_Magnifier_MMC.EXE_Microsoft_Management_Console_MOBSYNC.EXE_Microsoft_Synchronization_Manager_MPLAY32.EXE_Windows_Media_Player_version_5.1_MSHEARTS.EXE_Hearts_MSPAINT.EXE_Paint_MSTSC.EXE_Remote_Desktop_Connection_NARRATOR.EXE_Microsoft_Narrator_NETSETUP.EXE_Network_Setup_Wizard_NOTEPAD.EXE_Notepad_NSLOOKUP.EXE_NSLookup_Application_NTSD.EXE_Symbolic_Debugger_for_Windows_2000_ODBCAD32.EXE_ODBC_Data_Source_Administrator_OSK.EXE_On_Screen_Keyboard_OSUNINST.EXE_Windows_Uninstall_Utility_PACKAGER.EXE_Object_Packager_PERFMON.EXE_Performance_Monitor_PROGMAN.EXE_Program_Manager_RASPHONE.EXE_Remote_Access_Phonebook_REGEDIT.EXE_Registry_Editor_REGEDT32.EXE_Registry_Editor_RESET.EXE_Resets_Session_RSTRUI.EXE_System_Restore_RTCSHARE.EXE_RTC_Application_Sharing_SHRPUBW.EXE_Create_Shared_Folder_SHUTDOWN.EXE_System_Shutdown_SIGVERIF.EXE_File_Signature_Verification_SNDREC32.EXE_Sound_Recorder_SNDVOL32.EXE_Sound_Volume_SOL.EXE_Solitaire_SPIDER.EXE_Spider_Solitaire_SYNCAPP.EXE_Create_A_Briefcase_SYSEDIT.EXE_System_Configuration_Editor_SYSKEY.EXE_SAM_Lock_Tool_TELNET.EXE_MS_Telnet_Client_TSSHUTDN.EXE_System_Shutdown_TOURSTART.EXE_Windows_Tour_Launcher_UTILMAN.EXE_System_Utility_Manager_VERIFIER.EXE_Driver_Verifier_Manager_WIAACMGR.EXE_Scanner_and_Camera_Wizard_WINCHAT.EXE_Windows_for_Workgroups_Chat_WINHELP.EXE_Windows_Help_Engine_WINHLP32.EXE_Help_WINMINE.EXE_Minesweeper_WINVER.EXE_Windows_Version_Information_WMPLAYER.EXE_Windows_Media_Player_WORDPAD.EXE_WordPad_MFC_Application_WRITE.EXE_WordPad_WSCRIPT.EXE_Windows_Script_Host_Settings_WUPDMGR.EXE_Windows_Update_
call fcn.10045850
or esi, 0xffffffff
add esp, 0x14
cmp dword [esp + 0xc], esi
je 0x10002a14
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 1
lea eax, [esp + 0x10]
push 0x2c
push eax
lea edx, [esp + 0x94c]
mov ecx, str.ACCWIZ.EXE_Accessibility_Wizard_CALC.EXE_Calculator_CHARMAP.EXE_Character_Map_CLEANMGR.EXE_Disk_Space_Cleanup_Manager_CLICONFG.EXE_SQL_Client_Configuration_Utlity_CLIPBRD.EXE_Clipbook_Viewer_CLSPACK.EXE_Class_Package_Export_Tool_CMSTP.EXE_Connection_Manager_Profile_Installer_CONTROL.EXE_Control_Panel_DCOMCNFG.EXE_Component_Services_DDESHARE.EXE_DDE_Share_DVDPLAY.EXE_DVD_Player_DXDIAG.EXE_DirectX_Diagnostics_EUDCEDIT.EXE_Private_Character_Editor_EVENTVWR.EXE_Event_Viewer_FREECELL.EXE_Free_Cell_FXSCLNT.EXE_Fax_Console_FXSCOVER.EXE_Fax_Cover_Page_Editor_FXSEND.EXE_MS_Fax_Send_Note_Utility_IEXPRESS.EXE_IExpress_2.0_LOGOFF.EXE_System_Logoff_MAGNIFY.EXE_Microsoft_Magnifier_MMC.EXE_Microsoft_Management_Console_MOBSYNC.EXE_Microsoft_Synchronization_Manager_MPLAY32.EXE_Windows_Media_Player_version_5.1_MSHEARTS.EXE_Hearts_MSPAINT.EXE_Paint_MSTSC.EXE_Remote_Desktop_Connection_NARRATOR.EXE_Microsoft_Narrator_NETSETUP.EXE_Network_Setup_Wizard_NOTEPAD.EXE_Notepad_NSLOOKUP.EXE_NSLookup_Application_NTSD.EXE_Symbolic_Debugger_for_Windows_2000_ODBCAD32.EXE_ODBC_Data_Source_Administrator_OSK.EXE_On_Screen_Keyboard_OSUNINST.EXE_Windows_Uninstall_Utility_PACKAGER.EXE_Object_Packager_PERFMON.EXE_Performance_Monitor_PROGMAN.EXE_Program_Manager_RASPHONE.EXE_Remote_Access_Phonebook_REGEDIT.EXE_Registry_Editor_REGEDT32.EXE_Registry_Editor_RESET.EXE_Resets_Session_RSTRUI.EXE_System_Restore_RTCSHARE.EXE_RTC_Application_Sharing_SHRPUBW.EXE_Create_Shared_Folder_SHUTDOWN.EXE_System_Shutdown_SIGVERIF.EXE_File_Signature_Verification_SNDREC32.EXE_Sound_Recorder_SNDVOL32.EXE_Sound_Volume_SOL.EXE_Solitaire_SPIDER.EXE_Spider_Solitaire_SYNCAPP.EXE_Create_A_Briefcase_SYSEDIT.EXE_System_Configuration_Editor_SYSKEY.EXE_SAM_Lock_Tool_TELNET.EXE_MS_Telnet_Client_TSSHUTDN.EXE_System_Shutdown_TOURSTART.EXE_Windows_Tour_Launcher_UTILMAN.EXE_System_Utility_Manager_VERIFIER.EXE_Driver_Verifier_Manager_WIAACMGR.EXE_Scanner_and_Camera_Wizard_WINCHAT.EXE_Windows_for_Workgroups_Chat_WINHELP.EXE_Windows_Help_Engine_WINHLP32.EXE_Help_WINMINE.EXE_Minesweeper_WINVER.EXE_Windows_Version_Information_WMPLAYER.EXE_Windows_Media_Player_WORDPAD.EXE_WordPad_MFC_Application_WRITE.EXE_WordPad_WSCRIPT.EXE_Windows_Script_Host_Settings_WUPDMGR.EXE_Windows_Update_
call fcn.10045850
add esp, 0xc
lea ecx, [esp + 0x428]
push ecx
lea edx, [esp + 0x11c]
push edx
lea eax, [esp + 0xd58]
push 0x1013fbf8
push eax
call fcn.1010d6a8
lea ecx, [esp + 0x438]
push ecx
lea edx, [esp + 0x24]
push edx
lea eax, [esp + 0x648]
push 0x1013fbf8
push eax
call fcn.1010d6a8
push 1
push ebx
xor edx, edx
lea ecx, [esp + 0xd78]
mov byte [esp + 0x760], bl
mov byte [esp + 0xb70], bl
call fcn.10044660
add esp, 0x28
test eax, eax
jne 0x1000293e
push 0x207
lea ecx, [esp + 0x225]
push ebx
push ecx
mov byte [esp + 0x22c], bl
call fcn.10116880
add esp, 0xc
push ebx
push ebx
push ebx
push ebx
push ebx
lea edx, [esp + 0x74c]
push edx
push ebx
lea eax, [esp + 0xb64]
push eax
push ebx
push ebx
push ebx
lea ecx, [esp + 0x24c]
push ecx
push ebx
push ebx
lea edx, [esp + 0xd88]
push edx
call sym.EncDec.dll_GetVersionInformation
cmp eax, 1
jne 0x100029c3
cmp byte [esp + 0x220], bl
je 0x100029c3
lea eax, [esp + 0x220]
push eax
lea ecx, [esp + 0x944]
push ecx
jmp 0x100029c1
push 1
push ebx
xor edx, edx
lea ecx, [esp + 0x638]
call fcn.10044660
add esp, 8
test eax, eax
jne 0x100029c3
push 0x207
lea edx, [esp + 0x225]
push ebx
push edx
mov byte [esp + 0x22c], bl
call fcn.10116880
add esp, 0xc
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [esp + 0x74c]
push eax
push ebx
lea ecx, [esp + 0xb64]
push ecx
push ebx
push ebx
push ebx
lea edx, [esp + 0x24c]
push edx
push ebx
push ebx
lea eax, [esp + 0x668]
push eax
call sym.EncDec.dll_GetVersionInformation
cmp eax, 1
jne 0x100029c3
cmp byte [esp + 0x220], bl
je 0x100029c3
lea ecx, [esp + 0x220]
push ecx
lea edx, [esp + 0x944]
push edx
call edi
lea eax, [esp + 0xb48]
push eax
lea ecx, [esp + 0x73c]
push ecx
push 1
push str.AllowList
lea edx, [esp + 0x950]
lea ecx, [esp + 0x438]
call fcn.10001950
push 1
lea edx, [esp + 0x20]
push 0x2c
push edx
lea edx, [esp + 0x444]
mov ecx, str.ACCWIZ.EXE_Accessibility_Wizard_CALC.EXE_Calculator_CHARMAP.EXE_Character_Map_CLEANMGR.EXE_Disk_Space_Cleanup_Manager_CLICONFG.EXE_SQL_Client_Configuration_Utlity_CLIPBRD.EXE_Clipbook_Viewer_CLSPACK.EXE_Class_Package_Export_Tool_CMSTP.EXE_Connection_Manager_Profile_Installer_CONTROL.EXE_Control_Panel_DCOMCNFG.EXE_Component_Services_DDESHARE.EXE_DDE_Share_DVDPLAY.EXE_DVD_Player_DXDIAG.EXE_DirectX_Diagnostics_EUDCEDIT.EXE_Private_Character_Editor_EVENTVWR.EXE_Event_Viewer_FREECELL.EXE_Free_Cell_FXSCLNT.EXE_Fax_Console_FXSCOVER.EXE_Fax_Cover_Page_Editor_FXSEND.EXE_MS_Fax_Send_Note_Utility_IEXPRESS.EXE_IExpress_2.0_LOGOFF.EXE_System_Logoff_MAGNIFY.EXE_Microsoft_Magnifier_MMC.EXE_Microsoft_Management_Console_MOBSYNC.EXE_Microsoft_Synchronization_Manager_MPLAY32.EXE_Windows_Media_Player_version_5.1_MSHEARTS.EXE_Hearts_MSPAINT.EXE_Paint_MSTSC.EXE_Remote_Desktop_Connection_NARRATOR.EXE_Microsoft_Narrator_NETSETUP.EXE_Network_Setup_Wizard_NOTEPAD.EXE_Notepad_NSLOOKUP.EXE_NSLookup_Application_NTSD.EXE_Symbolic_Debugger_for_Windows_2000_ODBCAD32.EXE_ODBC_Data_Source_Administrator_OSK.EXE_On_Screen_Keyboard_OSUNINST.EXE_Windows_Uninstall_Utility_PACKAGER.EXE_Object_Packager_PERFMON.EXE_Performance_Monitor_PROGMAN.EXE_Program_Manager_RASPHONE.EXE_Remote_Access_Phonebook_REGEDIT.EXE_Registry_Editor_REGEDT32.EXE_Registry_Editor_RESET.EXE_Resets_Session_RSTRUI.EXE_System_Restore_RTCSHARE.EXE_RTC_Application_Sharing_SHRPUBW.EXE_Create_Shared_Folder_SHUTDOWN.EXE_System_Shutdown_SIGVERIF.EXE_File_Signature_Verification_SNDREC32.EXE_Sound_Recorder_SNDVOL32.EXE_Sound_Volume_SOL.EXE_Solitaire_SPIDER.EXE_Spider_Solitaire_SYNCAPP.EXE_Create_A_Briefcase_SYSEDIT.EXE_System_Configuration_Editor_SYSKEY.EXE_SAM_Lock_Tool_TELNET.EXE_MS_Telnet_Client_TSSHUTDN.EXE_System_Shutdown_TOURSTART.EXE_Windows_Tour_Launcher_UTILMAN.EXE_System_Utility_Manager_VERIFIER.EXE_Driver_Verifier_Manager_WIAACMGR.EXE_Scanner_and_Camera_Wizard_WINCHAT.EXE_Windows_for_Workgroups_Chat_WINHELP.EXE_Windows_Help_Engine_WINHLP32.EXE_Help_WINMINE.EXE_Minesweeper_WINVER.EXE_Windows_Version_Information_WMPLAYER.EXE_Windows_Media_Player_WORDPAD.EXE_WordPad_MFC_Application_WRITE.EXE_WordPad_WSCRIPT.EXE_Windows_Script_Host_Settings_WUPDMGR.EXE_Windows_Update_
call fcn.10045850
add esp, 0x1c
cmp dword [esp + 0xc], esi
jne 0x10002842
push str.CLI_SAPI
push str.php.exe
push 1
push str.AllowList
mov edx, 0x1013ff88
mov ecx, str.php.exe
call fcn.10001950
mov ecx, dword [esp + 0xe6c]
add esp, 0x10
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1010d699
mov esp, ebp
pop ebp
ret