Function at 0x5340f0
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x1c04]
mov eax, 0x1c04
call fcn.005e00d0
push 0xfffffffffffffffe
push 0x674168
push 0x5dfbd0
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x6aae14]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp + 0x1c00], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov ebx, dword [ebp + 0x1c0c]
mov dword [ebp - 0x30], ebx
mov esi, dword [ebp + 0x1c10]
mov dword [ebp - 4], 0
mov byte [ebp + 0x1400], 0
push 0x3ff
xor edi, edi
push edi
lea eax, [ebp + 0x1401]
push eax
call fcn.005dfd60
mov byte [ebp + 0x400], 0
push 0x3ff
push edi
lea ecx, [ebp + 0x401]
push ecx
call fcn.005dfd60
mov byte [ebp + 0x1000], 0
push 0x3ff
push edi
lea edx, [ebp + 0x1001]
push edx
call fcn.005dfd60
mov byte [ebp + 0xc00], 0
push 0x3ff
push edi
lea eax, [ebp + 0xc01]
push eax
call fcn.005dfd60
mov byte [ebp + 0x800], 0
push 0x3ff
push edi
lea ecx, [ebp + 0x801]
push ecx
call fcn.005dfd60
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x2c], edi
push 0x5c
push ebx
call fcn.005e0a00
add esp, 0x44
mov edi, eax
test edi, edi
jne 0x5341eb
mov edi, ebx
mov dword [ebp - 0x24], ebx
jmp 0x5341ef
inc edi
mov dword [ebp - 0x24], edi
push 0x2e
push edi
call fcn.005e3012
add esp, 8
mov dword [ebp - 0x1c], eax
test esi, esi
je 0x53430f
cmp byte [esi], 0
je 0x53430f
push 0x2e
push esi
call fcn.005e3012
add esp, 8
test eax, eax
je 0x53430f
push 0x6283e8
push eax
call fcn.005f095a
add esp, 8
test eax, eax
jne 0x534253
push 5
push str.unins
push esi
call fcn.005f0a9e
add esp, 0xc
test eax, eax
jne 0x534253
mov dword [ebp - 0x2c], 1
jmp 0x53430f
push 8
push str.trayicoc
push esi
call fcn.005f0a9e
add esp, 0xc
test eax, eax
je 0x5342f7
push 8
push str.trayicos
push esi
call fcn.005f0a9e
add esp, 0xc
test eax, eax
je 0x5342f7
push 8
push str.download
push esi
call fcn.005f0a9e
add esp, 0xc
test eax, eax
je 0x5342f7
push 8
push str.debuginf
push esi
call fcn.005f0a9e
add esp, 0xc
test eax, eax
je 0x5342f7
push 8
push str.mwavscan
push esi
call fcn.005f0a9e
add esp, 0xc
test eax, eax
je 0x5342f7
push 8
push 0x64eee8
push esi
call fcn.005f0a9e
add esp, 0xc
test eax, eax
je 0x5342f7
push 5
push str.eserv
push esi
call fcn.005f0a9e
add esp, 0xc
test eax, eax
je 0x5342f7
push 6
push str.launch
push esi
call fcn.005f0a9e
add esp, 0xc
test eax, eax
jne 0x53430f
push 7
push str.regedit
push edi
call fcn.005f0a9e
add esp, 0xc
test eax, eax
je 0x53456d
cmp dword [0x75abec], 0
jne 0x534427
call fcn.004d9b00
mov dword [0x75abe8], eax
mov dword [0x75abec], 1
push 0x626c74
lea edx, [ebp]
push edx
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
call edi
push 1
lea eax, [ebp]
push eax
call fcn.00515650
mov bl, al
push 0x626c60
lea ecx, [ebp + 0x1800]
push ecx
call edi
push 1
lea edx, [ebp + 0x1800]
push edx
call fcn.00515650
cmp bl, 1
jne 0x53439e
cmp al, bl
jne 0x53439e
lea eax, [ebp + 0x1800]
push eax
lea ecx, [ebp]
push ecx
call fcn.005f095a
add esp, 8
test eax, eax
je 0x53439e
push str._MailScanDirectory__
push 0x755be8
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
call esi
jmp 0x5343a4
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x626c34
push 0x755be8
call esi
push str._ProgramFiles_eScan_Web_Safe_
push 0x755be8
call esi
push str._CommonAppData_MicroWorldeScanBD_
push 0x755be8
call esi
push str._CommonProgramFiles_MicroWorldAgent_
push 0x755be8
call esi
push str._CommonProgramFiles_MicroWorldwgwin_
push 0x755be8
call esi
push str._CommonProgramFiles_MicroWorldeScanRAD_
push 0x755be8
call esi
push str._CommonProgramFiles_MicroWorldWebServer_
push 0x755be8
call esi
push str._CommonProgramFiles_MicroWorldApache2_bin_
push 0x755be8
call esi
push str._ESCANDRIVE_pub_
push 0x755be8
call esi
push 0x755be0
push 0x755be8
call fcn.00516130
add esp, 8
mov ebx, dword [ebp - 0x30]
jmp 0x534433
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
cmp byte [0x7557e0], 0
jne 0x534520
push 0x400
push 0x7557e0
call fcn.00534010
add esp, 8
cmp byte [0x7557e0], 0
je 0x534468
push 0x7557e0
call fcn.004e24e0
add esp, 4
push 0x7557e0
push 0x7553e0
call edi
push 0x7553e0
call fcn.004e24e0
add esp, 4
push str.servicingTrustedInstaller.exe
push 0x7553e0
call esi
push 0x7557e0
push 0x754fe0
call edi
push str.WinSxS
push 0x754fe0
call esi
push 0x754fe0
call fcn.004e24e0
add esp, 4
push 0x400
push 0x754be0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x754be0
call fcn.004e24e0
add esp, 4
push 0x754be0
push 0x7547e0
call edi
push str.svchost.exe
push 0x7547e0
call esi
push 0x754be0
push 0x7543e0
call edi
push str.VSSVC.exe
push 0x7543e0
call esi
push 0x754be0
push 0x753fe0
call edi
push str.poqexec.exe
push 0x753fe0
call esi
cmp byte [0x7557e0], 0
je 0x53456d
cmp dword [ebp - 0x2c], 1
jne 0x53457e
cmp dword [ebp - 0x1c], 0
je 0x53457e
push str..TMP
mov edx, dword [ebp - 0x1c]
push edx
call fcn.005f095a
add esp, 8
mov esi, dword [ebp - 0x24]
test eax, eax
jne 0x534581
movsx eax, byte [esi + 1]
push eax
call fcn.005e3ae6
add esp, 4
cmp eax, 0x49
jne 0x534581
movsx ecx, byte [esi + 2]
push ecx
call fcn.005e3ae6
add esp, 4
cmp eax, 0x55
jne 0x534581
cmp byte [esi], 0x5f
jne 0x534581
mov dword [ebp - 4], 0xfffffffe
mov eax, 1
jmp 0x534904
mov esi, dword [ebp - 0x24]
push 0
push 0
push 0
push 0
push 0
lea edx, [ebp + 0x800]
push edx
lea eax, [ebp + 0x1400]
push eax
lea ecx, [ebp + 0xc00]
push ecx
push 0
push 0
push 0
lea edx, [ebp + 0x1000]
push edx
push 0
push 0
push ebx
call fcn.005052b0
push str.Windows_Command_Processor
lea eax, [ebp + 0x1000]
push eax
call fcn.005f095a
add esp, 8
test eax, eax
je 0x534647
push str.Windows_TaskManager
lea ecx, [ebp + 0x1000]
push ecx
call fcn.005f095a
add esp, 8
test eax, eax
je 0x534647
push 0x62eef0
lea edx, [ebp + 0xc00]
push edx
call fcn.005f095a
add esp, 8
test eax, eax
je 0x534647
push str.taskmgr
lea eax, [ebp + 0xc00]
push eax
call fcn.005f095a
add esp, 8
test eax, eax
je 0x534647
push str.cmd.exe
lea ecx, [ebp + 0x800]
push ecx
call fcn.005f095a
add esp, 8
test eax, eax
je 0x534647
push str.taskmgr.exe
lea edx, [ebp + 0x800]
push edx
call fcn.005f095a
add esp, 8
test eax, eax
jne 0x53464e
mov dword [ebp - 0x20], 1
mov eax, 0x7557e0
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x534656
sub eax, edx
push eax
push 0x7557e0
push ebx
call fcn.005f0a9e
add esp, 0xc
test eax, eax
jne 0x5346e2
cmp dword [ebp - 0x20], eax
jne 0x5346e2
push eax
push str.eScan_setup.exe
push ebx
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
jne 0x53456d
push ebx
call fcn.0052c300
add esp, 4
test eax, eax
je 0x5346e2
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x5346e2
push str..TMP
push eax
call fcn.005f095a
add esp, 8
test eax, eax
jne 0x5346e2
movsx eax, byte [esi]
push eax
call fcn.005e3ae6
add esp, 4
cmp eax, 0x49
jne 0x5346e2
movsx ecx, byte [esi + 1]
push ecx
call fcn.005e3ae6
add esp, 4
cmp eax, 0x53
jne 0x5346e2
cmp byte [esi + 2], 0x2d
je 0x53456d
lea edx, [ebp + 0x400]
push edx
push 0
push ebx
call fcn.00506880
add esp, 0xc
mov edi, eax
xor esi, esi
mov dword [ebp - 0x28], esi
test edi, edi
jne 0x53477e
cmp dword [0x75abe8], esi
je 0x53474f
push ebx
push 0x7547e0
call fcn.005f095a
add esp, 8
test eax, eax
je 0x534776
push ebx
push 0x7553e0
call fcn.005f095a
add esp, 8
test eax, eax
je 0x534776
push ebx
push 0x7543e0
call fcn.005f095a
add esp, 8
test eax, eax
je 0x534776
push ebx
push 0x753fe0
call fcn.005f095a
add esp, 8
test eax, eax
je 0x534776
push str.tiworker.exe
mov eax, dword [ebp - 0x24]
push eax
call fcn.005f095a
add esp, 8
test eax, eax
jne 0x53477e
push 0x754fe0
push ebx
call fcn.004dd6e0
add esp, 8
test eax, eax
jne 0x53477e
mov esi, 1
mov dword [ebp - 0x28], esi
cmp dword [ebp - 0x20], 0
jne 0x5348fb
cmp edi, 1
je 0x534796
cmp esi, 1
jne 0x53484e
push 0
push 0x60cf40
lea ecx, [ebp + 0x1400]
push ecx
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
jne 0x53456d
push 0
push str.Microsoft_Corp
lea edx, [ebp + 0x1400]
push edx
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
jne 0x53456d
push 0
push str.Thinprint
lea eax, [ebp + 0x1400]
push eax
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
jne 0x53456d
push ebx
call fcn.004e8b10
add esp, 4
cmp eax, 0x1c00000
jbe 0x53484e
push 0
push str.espatch
push ebx
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
jne 0x53456d
push 0
push str.mwav
push ebx
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
jne 0x53456d
push 0
push str.esupd
push ebx
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
jne 0x53456d
cmp dword [ebp - 0x20], 0
jne 0x5348fb
mov eax, dword [0x755be0]
test eax, eax
je 0x5348fb
cmp byte [eax], 0
je 0x5348fb
mov dword [ebp - 0x1c], 0
push 1
push 0
push 0x2c
lea ecx, [ebp - 0x1c]
push ecx
lea edx, [ebp + 0x1800]
push edx
push eax
call fcn.004e1380
add esp, 0x18
or esi, 0xffffffff
cmp dword [ebp - 0x1c], esi
je 0x5348fb
lea eax, [ebp + 0x1800]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x5348a0
sub eax, edx
push eax
lea eax, [ebp + 0x1800]
push eax
push ebx
call fcn.005f0a9e
add esp, 0xc
test eax, eax
je 0x53456d
push 1
push 0
push 0x2c
lea ecx, [ebp - 0x1c]
push ecx
lea edx, [ebp + 0x1800]
push edx
mov eax, dword [0x755be0]
push eax
call fcn.004e1380
add esp, 0x18
jmp 0x534892
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x1c00]
xor ecx, ebp
call fcn.005dfbbe
add ebp, 0x1c04
mov esp, ebp
pop ebp
ret