Function at 0x100520b0
Capabilities:
Get common file path
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x100caa55
push eax
mov dword fs:[0], esp
sub esp, 0x1c
cmp dword [0x101075cc], 0
jne 0x1005267e
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov bl, byte [ebp + 8]
mov dword [0x101075cc], eax
test bl, bl
je 0x100520fe
push dword [ebp + 0xc]
call fcn.100565e0
add esp, 4
test al, al
je 0x1005267d
push esi
push edi
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
push 0
push 0
mov dword [0x10107568], eax
mov byte [0x101075c9], bl
call fcn.10052000
add esp, 8
inc eax
mov esi, 0x104
cmp eax, esi
push 0
push 0
cmova esi, eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
add eax, 8
cmp esi, eax
push 0
push 0
cmovb esi, eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
inc eax
mov edx, 2
cmp esi, eax
cmovb esi, eax
xor ecx, ecx
mov eax, esi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.100a1d2b
mov ebx, eax
push esi
push ebx
mov dword [ebp - 0x10], ebx
lea edi, [ebx + 4]
call fcn.10052000
add esp, 0xc
cmp eax, esi
jae 0x10052214
mov ecx, edi
mov dword [ebp - 0x28], 0
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100521a2
sub ecx, edx
sar ecx, 1
push ecx
push edi
lea ecx, [ebp - 0x28]
call fcn.100530f0
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0
push eax
push 0x10102550
call fcn.10057740
mov edx, dword [ebp - 0x14]
add esp, 8
mov dword [ebp - 4], 0xffffffff
cmp edx, 8
jb 0x10052214
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x1005220a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1005268c
push edx
push ecx
call fcn.100a1a2e
add esp, 8
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
jae 0x100522b6
mov ecx, edi
mov dword [ebp - 0x28], 0
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10052244
sub ecx, edx
sar ecx, 1
push ecx
push edi
lea ecx, [ebp - 0x28]
call fcn.100530f0
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 1
push eax
push 0x10102598
call fcn.10057740
mov edx, dword [ebp - 0x14]
add esp, 8
mov dword [ebp - 4], 0xffffffff
cmp edx, 8
jb 0x100522b6
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x100522ac
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1005268c
push edx
push ecx
call fcn.100a1a2e
add esp, 8
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea ecx, [esi + 8]
cmp eax, ecx
jae 0x10052367
push str.winsxs
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
mov ecx, edi
mov dword [ebp - 0x28], 0
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100522f5
sub ecx, edx
sar ecx, 1
push ecx
push edi
lea ecx, [ebp - 0x28]
call fcn.100530f0
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 2
push eax
push 0x10102580
call fcn.10057740
mov edx, dword [ebp - 0x14]
add esp, 8
mov dword [ebp - 4], 0xffffffff
cmp edx, 8
jb 0x10052367
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x1005235d
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1005268c
push edx
push ecx
call fcn.100a1a2e
add esp, 8
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
cmp eax, esi
jae 0x10052409
mov ecx, edi
mov dword [ebp - 0x28], 0
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10052397
sub ecx, edx
sar ecx, 1
push ecx
push edi
lea ecx, [ebp - 0x28]
call fcn.100530f0
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 3
push eax
push 0x10102568
call fcn.10057740
mov edx, dword [ebp - 0x14]
add esp, 8
mov dword [ebp - 4], 0xffffffff
cmp edx, 8
jb 0x10052409
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x100523ff
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1005268c
push edx
push ecx
call fcn.100a1a2e
add esp, 8
mov esi, dword [ebp + 0xc]
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10052411
sub ecx, edx
push ecx
push esi
mov ecx, 0x10102520
call fcn.10036320
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push str.kernelbase.dll
mov byte [0x101075c8], 1
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10052477
push 0
push 0x10107570
push 0x10055180
push 0x100cfdd4
push eax
call esi
push eax
call fcn.1006eaf0
add esp, 0x10
cmp dword [0x10107570], 0
jne 0x10052477
push str.Failed_hooking_kernelbase_free_library_calls_n
call fcn.10081660
add esp, 4
push 0x100cfe10
call ebx
push 0
push 0x1010756c
push 0x100543b0
mov edi, eax
push 0x100cfdd4
push edi
call esi
push eax
call fcn.1006eaf0
add esp, 0x10
cmp dword [0x1010756c], 0
jne 0x100524bc
cmp dword [0x10107570], 0
jne 0x100524bc
push str.Failed_hooking_free_library_calls_n
call fcn.10081660
add esp, 4
push 0
push 0x10107574
push 0x100537b0
push 0x100cfe44
push edi
call esi
push eax
call fcn.1006eaf0
add esp, 0x10
push 0
push 0x10107578
push 0x10053830
push 0x100cfe50
push edi
call esi
push eax
call fcn.1006eaf0
add esp, 0x10
push 0
push 0x101075a0
push 0x100546d0
push str.GetFinalPathNameByHandleW
push edi
call esi
push eax
call fcn.1006eaf0
add esp, 0x10
push 0
push 0x1010757c
push 0x10054cf0
push str.GetVolumeInformationByHandleW
push edi
call esi
push eax
call fcn.1006eaf0
add esp, 0x10
push 0
push 0x1010759c
push fcn.100543d0
push str.GetFileInformationByHandle
push edi
call esi
push eax
call fcn.1006eaf0
add esp, 0x10
push 0
push 0x101075a8
push 0x100540c0
push str.EnumSystemFirmwareTables
push edi
call esi
push eax
call fcn.1006eaf0
add esp, 0x10
push 0
push 0x101075ac
push 0x100549f0
push str.GetSystemFirmwareTable
push edi
call esi
push eax
call fcn.1006eaf0
add esp, 0x10
push str.advapi32.dll
call ebx
mov edi, eax
test edi, edi
je 0x100525eb
push 0
push 0x10107580
push 0x10056010
push str.RegCreateKeyExW
push edi
call esi
push eax
call fcn.1006eaf0
add esp, 0x10
push 0
push 0x10107584
push 0x10056200
push 0x100cff08
push edi
call esi
push eax
call fcn.1006eaf0
add esp, 0x10
push 0
push 0x10107588
push 0x10055ff0
push 0x100cff18
push edi
call esi
push eax
call fcn.1006eaf0
add esp, 0x10
push str.ntdll.dll
call ebx
mov edi, eax
test edi, edi
je 0x10052670
push 0
push 0x10107590
push fcn.10055840
push str.NtQueryInformationFile
push edi
call esi
push eax
call fcn.1006eaf0
add esp, 0x10
push 0
push 0x10107594
push 0x10055520
push str.NtQueryDirectoryFile
push edi
call esi
push eax
call fcn.1006eaf0
add esp, 0x10
push 0
push 0x10107598
push 0x10055cc0
push str.NtQueryVolumeInformationFile
push edi
call esi
push eax
call fcn.1006eaf0
add esp, 0x10
push 0
push 0x1010758c
push 0x100551a0
push str.NtCreateFile
push edi
call esi
push eax
call fcn.1006eaf0
add esp, 0x10
push dword [ebp - 0x10]
call fcn.100a1d34
add esp, 4
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
call fcn.100b0a3d
int3