Function at 0x1016c290
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x278
mov eax, dword [0x10250150]
xor eax, ebp
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x275]
call fcn.1013ac20
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.102134e7
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.10201330
add esp, 8
lea eax, [ebp - 0x20c]
lea ecx, [ebp - 0x23c]
push eax
call fcn.10006b40
push 1
push 0x10219e0c
lea ecx, [ebp - 0x23c]
call fcn.10007e60
push str.smss.exe
lea eax, [ebp - 0x23c]
push eax
lea eax, [ebp - 0x224]
push eax
call fcn.1002f240
add esp, 0xc
mov ecx, 0x10259a54
push eax
lea eax, [ebp - 0x274]
push eax
call fcn.10031ed0
mov edx, dword [ebp - 0x210]
cmp edx, 8
jb 0x1016c37b
mov ecx, dword [ebp - 0x224]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x1016c371
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1016ce7c
push edx
push ecx
call fcn.102134ff
add esp, 8
push str.csrss.exe
lea eax, [ebp - 0x23c]
push eax
lea eax, [ebp - 0x224]
push eax
call fcn.1002f240
add esp, 0xc
mov ecx, 0x10259a54
push eax
lea eax, [ebp - 0x274]
push eax
call fcn.10031ed0
mov edx, dword [ebp - 0x210]
cmp edx, 8
jb 0x1016c3e8
mov ecx, dword [ebp - 0x224]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x1016c3de
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1016ce81
push edx
push ecx
call fcn.102134ff
add esp, 8
push str.winlogon.exe
lea eax, [ebp - 0x23c]
push eax
lea eax, [ebp - 0x224]
push eax
call fcn.1002f240
add esp, 0xc
mov ecx, 0x10259a54
push eax
lea eax, [ebp - 0x274]
push eax
call fcn.10031ed0
mov edx, dword [ebp - 0x210]
cmp edx, 8
jb 0x1016c455
mov ecx, dword [ebp - 0x224]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x1016c44b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1016ce86
push edx
push ecx
call fcn.102134ff
add esp, 8
push str.services.exe
lea eax, [ebp - 0x23c]
push eax
lea eax, [ebp - 0x224]
push eax
call fcn.1002f240
add esp, 0xc
mov ecx, 0x10259a54
push eax
lea eax, [ebp - 0x274]
push eax
call fcn.10031ed0
mov edx, dword [ebp - 0x210]
cmp edx, 8
jb 0x1016c4c2
mov ecx, dword [ebp - 0x224]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x1016c4b8
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1016ce8b
push edx
push ecx
call fcn.102134ff
add esp, 8
push str.svchost.exe
lea eax, [ebp - 0x23c]
push eax
lea eax, [ebp - 0x224]
push eax
call fcn.1002f240
add esp, 0xc
mov ecx, 0x10259a54
push eax
lea eax, [ebp - 0x274]
push eax
call fcn.10031ed0
mov edx, dword [ebp - 0x210]
cmp edx, 8
jb 0x1016c52f
mov ecx, dword [ebp - 0x224]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x1016c525
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1016ce90
push edx
push ecx
call fcn.102134ff
add esp, 8
push str.spoolsv.exe
lea eax, [ebp - 0x23c]
push eax
lea eax, [ebp - 0x224]
push eax
call fcn.1002f240
add esp, 0xc
mov ecx, 0x10259a54
push eax
lea eax, [ebp - 0x274]
push eax
call fcn.10031ed0
mov edx, dword [ebp - 0x210]
cmp edx, 8
jb 0x1016c59c
mov ecx, dword [ebp - 0x224]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x1016c592
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1016ce95
push edx
push ecx
call fcn.102134ff
add esp, 8
push str.rundll32.exe
lea eax, [ebp - 0x23c]
push eax
lea eax, [ebp - 0x224]
push eax
call fcn.1002f240
add esp, 0xc
mov ecx, 0x10259a54
push eax
lea eax, [ebp - 0x274]
push eax
call fcn.10031ed0
mov edx, dword [ebp - 0x210]
cmp edx, 8
jb 0x1016c609
mov ecx, dword [ebp - 0x224]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x1016c5ff
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1016ce9a
push edx
push ecx
call fcn.102134ff
add esp, 8
push str.regsvr32.exe
lea eax, [ebp - 0x23c]
push eax
lea eax, [ebp - 0x224]
push eax
call fcn.1002f240
add esp, 0xc
mov ecx, 0x10259a54
push eax
lea eax, [ebp - 0x274]
push eax
call fcn.10031ed0
mov edx, dword [ebp - 0x210]
cmp edx, 8
jb 0x1016c676
mov ecx, dword [ebp - 0x224]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x1016c66c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1016ce9f
push edx
push ecx
call fcn.102134ff
add esp, 8
push str.shdocvw.dll
lea eax, [ebp - 0x23c]
push eax
lea eax, [ebp - 0x224]
push eax
call fcn.1002f240
add esp, 0xc
mov ecx, 0x10259a54
push eax
lea eax, [ebp - 0x274]
push eax
call fcn.10031ed0
mov edx, dword [ebp - 0x210]
cmp edx, 8
jb 0x1016c6e3
mov ecx, dword [ebp - 0x224]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x1016c6d9
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1016cea4
push edx
push ecx
call fcn.102134ff
add esp, 8
push str.shell32.dll
lea eax, [ebp - 0x23c]
push eax
lea eax, [ebp - 0x224]
push eax
call fcn.1002f240
add esp, 0xc
mov ecx, 0x10259a54
push eax
lea eax, [ebp - 0x274]
push eax
call fcn.10031ed0
mov edx, dword [ebp - 0x210]
cmp edx, 8
jb 0x1016c750
mov ecx, dword [ebp - 0x224]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x1016c746
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1016cea9
push edx
push ecx
call fcn.102134ff
add esp, 8
push str.oleaut32.dll
lea eax, [ebp - 0x23c]
push eax
lea eax, [ebp - 0x224]
push eax
call fcn.1002f240
add esp, 0xc
mov ecx, 0x10259a54
push eax
lea eax, [ebp - 0x274]
push eax
call fcn.10031ed0
mov edx, dword [ebp - 0x210]
cmp edx, 8
jb 0x1016c7bd
mov ecx, dword [ebp - 0x224]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x1016c7b3
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1016ceae
push edx
push ecx
call fcn.102134ff
add esp, 8
push str.actxprxy.dll
lea eax, [ebp - 0x23c]
push eax
lea eax, [ebp - 0x224]
push eax
call fcn.1002f240
add esp, 0xc
mov ecx, 0x10259a54
push eax
lea eax, [ebp - 0x274]
push eax
call fcn.10031ed0
mov edx, dword [ebp - 0x210]
cmp edx, 8
jb 0x1016c82a
mov ecx, dword [ebp - 0x224]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x1016c820
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1016ceb3
push edx
push ecx
call fcn.102134ff
add esp, 8
push str.mshtml.dll
lea eax, [ebp - 0x23c]
push eax
lea eax, [ebp - 0x224]
push eax
call fcn.1002f240
add esp, 0xc
mov ecx, 0x10259a54
push eax
lea eax, [ebp - 0x274]
push eax
call fcn.10031ed0
mov edx, dword [ebp - 0x210]
cmp edx, 8
jb 0x1016c897
mov ecx, dword [ebp - 0x224]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x1016c88d
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1016ceb8
push edx
push ecx
call fcn.102134ff
add esp, 8
push str.urlmon.dll
lea eax, [ebp - 0x23c]
push eax
lea eax, [ebp - 0x224]
push eax
call fcn.1002f240
add esp, 0xc
mov ecx, 0x10259a54
push eax
lea eax, [ebp - 0x274]
push eax
call fcn.10031ed0
mov edx, dword [ebp - 0x210]
cmp edx, 8
jb 0x1016c904
mov ecx, dword [ebp - 0x224]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x1016c8fa
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1016cebd
push edx
push ecx
call fcn.102134ff
add esp, 8
push str.msjava.dll
lea eax, [ebp - 0x23c]
push eax
lea eax, [ebp - 0x224]
push eax
call fcn.1002f240
add esp, 0xc
mov ecx, 0x10259a54
push eax
lea eax, [ebp - 0x274]
push eax
call fcn.10031ed0
mov edx, dword [ebp - 0x210]
cmp edx, 8
jb 0x1016c971
mov ecx, dword [ebp - 0x224]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x1016c967
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1016cec2
push edx
push ecx
call fcn.102134ff
add esp, 8
push str.browseui.dll
lea eax, [ebp - 0x23c]
push eax
lea eax, [ebp - 0x224]
push eax
call fcn.1002f240
add esp, 0xc
mov ecx, 0x10259a54
push eax
lea eax, [ebp - 0x274]
push eax
call fcn.10031ed0
mov edx, dword [ebp - 0x210]
cmp edx, 8
jb 0x1016c9de
mov ecx, dword [ebp - 0x224]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x1016c9d4
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1016cec7
push edx
push ecx
call fcn.102134ff
add esp, 8
push str.user32.dll
lea eax, [ebp - 0x23c]
push eax
lea eax, [ebp - 0x224]
push eax
call fcn.1002f240
add esp, 0xc
mov ecx, 0x10259a54
push eax
lea eax, [ebp - 0x274]
push eax
call fcn.10031ed0
mov edx, dword [ebp - 0x210]
cmp edx, 8
jb 0x1016ca4b
mov ecx, dword [ebp - 0x224]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x1016ca41
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1016cecc
push edx
push ecx
call fcn.102134ff
add esp, 8
push 0x104
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.10201330
add esp, 8
lea eax, [ebp - 0x20c]
lea ecx, [ebp - 0x224]
push eax
call fcn.10006b40
push 1
push 0x10219e0c
lea ecx, [ebp - 0x224]
call fcn.10007e60
push str.explorer.exe
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x26c]
push eax
call fcn.1002f240
add esp, 0xc
mov ecx, 0x10259a54
push eax
lea eax, [ebp - 0x274]
push eax
call fcn.10031ed0
mov edx, dword [ebp - 0x258]
cmp edx, 8
jb 0x1016cb02
mov ecx, dword [ebp - 0x26c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x1016caf8
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1016ced1
push edx
push ecx
call fcn.102134ff
add esp, 8
call fcn.1000ad40
test eax, eax
je 0x1016cde7
push 0x10220dc0
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1016cdaf
push 0x104
lea ecx, [ebp - 0x20c]
push ecx
call eax
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.10201330
add esp, 8
lea eax, [ebp - 0x20c]
lea ecx, [ebp - 0x26c]
push eax
call fcn.10006b40
push 1
push 0x10219e0c
lea ecx, [ebp - 0x26c]
call fcn.10007e60
push str.svchost.exe
lea eax, [ebp - 0x26c]
push eax
lea eax, [ebp - 0x254]
push eax
call fcn.1002f240
add esp, 0xc
mov ecx, 0x10259a54
push eax
lea eax, [ebp - 0x274]
push eax
call fcn.10031ed0
lea ecx, [ebp - 0x254]
call fcn.1001d6d0
push str.regsvr32.exe
lea eax, [ebp - 0x26c]
push eax
lea eax, [ebp - 0x254]
push eax
call fcn.1002f240
add esp, 0xc
mov ecx, 0x10259a54
push eax
lea eax, [ebp - 0x274]
push eax
call fcn.10031ed0
lea ecx, [ebp - 0x254]
call fcn.1001d6d0
push str.shdocvw.dll
lea eax, [ebp - 0x26c]
push eax
lea eax, [ebp - 0x254]
push eax
call fcn.1002f240
add esp, 0xc
mov ecx, 0x10259a54
push eax
lea eax, [ebp - 0x274]
push eax
call fcn.10031ed0
lea ecx, [ebp - 0x254]
call fcn.1001d6d0
push str.shell32.dll
lea eax, [ebp - 0x26c]
push eax
lea eax, [ebp - 0x254]
push eax
call fcn.1002f240
add esp, 0xc
mov ecx, 0x10259a54
push eax
lea eax, [ebp - 0x274]
push eax
call fcn.10031ed0
lea ecx, [ebp - 0x254]
call fcn.1001d6d0
push str.oleaut32.dll
lea eax, [ebp - 0x26c]
push eax
lea eax, [ebp - 0x254]
push eax
call fcn.1002f240
add esp, 0xc
push eax
lea eax, [ebp - 0x274]
mov ecx, 0x10259a54
push eax
call fcn.10031ed0
lea ecx, [ebp - 0x254]
call fcn.1001d6d0
push str.actxprxy.dll
lea eax, [ebp - 0x26c]
push eax
lea eax, [ebp - 0x254]
push eax
call fcn.1002f240
add esp, 0xc
mov ecx, 0x10259a54
push eax
lea eax, [ebp - 0x274]
push eax
call fcn.10031ed0
lea ecx, [ebp - 0x254]
call fcn.1001d6d0
push str.mshtml.dll
lea eax, [ebp - 0x26c]
push eax
lea eax, [ebp - 0x254]
push eax
call fcn.1002f240
add esp, 0xc
mov ecx, 0x10259a54
push eax
lea eax, [ebp - 0x274]
push eax
call fcn.10031ed0
lea ecx, [ebp - 0x254]
call fcn.1001d6d0
push str.urlmon.dll
lea eax, [ebp - 0x26c]
push eax
lea eax, [ebp - 0x254]
push eax
call fcn.1002f240
add esp, 0xc
mov ecx, 0x10259a54
push eax
lea eax, [ebp - 0x274]
push eax
call fcn.10031ed0
lea ecx, [ebp - 0x254]
call fcn.1001d6d0
push str.browseui.dll
lea eax, [ebp - 0x26c]
push eax
lea eax, [ebp - 0x254]
push eax
call fcn.1002f240
add esp, 0xc
mov ecx, 0x10259a54
push eax
lea eax, [ebp - 0x274]
push eax
call fcn.10031ed0
lea ecx, [ebp - 0x254]
call fcn.1001d6d0
push str.explorer.exe
lea eax, [ebp - 0x26c]
push eax
lea eax, [ebp - 0x254]
push eax
call fcn.1002f240
add esp, 0xc
mov ecx, 0x10259a54
push eax
lea eax, [ebp - 0x274]
push eax
call fcn.10031ed0
lea ecx, [ebp - 0x254]
call fcn.1001d6d0
lea ecx, [ebp - 0x26c]
call fcn.1001d6d0
push str.explorer.exe
lea eax, [ebp - 0x23c]
push eax
lea eax, [ebp - 0x254]
push eax
call fcn.1002f240
add esp, 0xc
mov ecx, 0x10259a54
push eax
lea eax, [ebp - 0x274]
push eax
call fcn.10031ed0
lea ecx, [ebp - 0x254]
call fcn.1001d6d0
mov edx, dword [ebp - 0x210]
cmp edx, 8
jb 0x1016ce27
mov ecx, dword [ebp - 0x224]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x1016ce1d
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1016ced6
push edx
push ecx
call fcn.102134ff
add esp, 8
mov edx, dword [ebp - 0x228]
cmp edx, 8
jb 0x1016ce63
mov ecx, dword [ebp - 0x23c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x1016ce59
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1016ced6
push edx
push ecx
call fcn.102134ff
add esp, 8
lea ecx, [ebp - 0x275]
call fcn.1013ac40
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10212f74
mov esp, ebp
pop ebp
ret
call fcn.10200ab0
call fcn.10200ab0
call fcn.10200ab0
call fcn.10200ab0
call fcn.10200ab0
call fcn.10200ab0
call fcn.10200ab0
call fcn.10200ab0
call fcn.10200ab0
call fcn.10200ab0
call fcn.10200ab0
call fcn.10200ab0
call fcn.10200ab0
call fcn.10200ab0
call fcn.10200ab0
call fcn.10200ab0
call fcn.10200ab0
call fcn.10200ab0
call fcn.10200ab0
int3