Function at 0x5319c0
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0xd08]
sub esp, 0xd08
push 0xfffffffffffffffe
push 0x673dc8
push 0x5dfbd0
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x6aae14]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp + 0xd04], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov edi, dword [ebp + 0xd10]
mov esi, dword [ebp + 0xd14]
mov dword [ebp - 0x2c], esi
xor ebx, ebx
mov byte [ebp + 0x800], bl
push 0x3ff
push ebx
lea eax, [ebp + 0x801]
push eax
call fcn.005dfd60
add esp, 0xc
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
call fcn.004d9710
mov dword [ebp - 0x24], eax
cmp eax, ebx
je 0x531a9d
push 0x400
lea ecx, [ebp + 0x800]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea edx, [ebp + 0x800]
push edx
call fcn.004e24e0
add esp, 4
lea eax, [ebp + 0x800]
dec eax
lea ecx, [ecx]
mov cl, byte [eax + 1]
inc eax
cmp cl, bl
jne 0x531a70
mov ecx, dword [str.rundll32.exe]
mov dword [eax], ecx
mov edx, dword [0x62ea04]
mov dword [eax + 4], edx
mov ecx, dword [0x62ea08]
mov dword [eax + 8], ecx
mov dl, byte [0x62ea0c]
mov byte [eax + 0xc], dl
jmp 0x531acb
mov eax, dword [str.rundll32.exe]
mov dword [ebp + 0x800], eax
mov ecx, dword [0x62ea04]
mov dword [ebp + 0x804], ecx
mov edx, dword [0x62ea08]
mov dword [ebp + 0x808], edx
mov al, byte [0x62ea0c]
mov byte [ebp + 0x80c], al
cmp edi, ebx
je 0x531bfa
cmp byte [edi], bl
je 0x531bfa
push edi
call fcn.004ec4c0
add esp, 4
test eax, eax
jne 0x531b04
cmp esi, ebx
je 0x531c17
push edi
push str._s_file_not_present
push esi
call fcn.005dfb23
add esp, 0xc
jmp 0x531c17
push str.mwfsmfltr
call fcn.005110b0
test eax, eax
jne 0x531bec
or esi, 0xffffffff
mov dword [ebp - 0x20], esi
push ebx
call fcn.0051aa10
push edi
lea ecx, [ebp + 0x800]
push ecx
push str._s_setupapi.dll_InstallHinfSection_DefaultInstall_128__s
lea edx, [ebp]
push edx
call fcn.005dfb23
add esp, 0x10
cmp dword [ebp - 0x24], ebx
je 0x531b50
lea eax, [ebp - 0x1c]
push eax
call fcn.004f77e0
add esp, 4
mov edi, eax
jmp 0x531b53
mov edi, dword [ebp - 0x28]
push ebx
call fcn.00503120
test eax, eax
je 0x531b98
call fcn.004d9b00
test eax, eax
jne 0x531b98
mov byte [ebp + 0xc00], bl
push 0x103
push ebx
lea ecx, [ebp + 0xc01]
push ecx
call fcn.005dfd60
add esp, 0xc
push 1
lea edx, [ebp + 0xc00]
push edx
lea eax, [ebp]
push eax
call fcn.00510c10
mov esi, eax
mov dword [ebp - 0x20], esi
cmp esi, ebx
je 0x531bb0
push ebx
push ebx
push ebx
push 0xffffffffffffffff
push ebx
push 1
lea ecx, [ebp]
push ecx
call fcn.00506de0
add esp, 0x1c
cmp edi, ebx
je 0x531bc0
mov edx, dword [ebp - 0x1c]
push edx
call fcn.004f7860
add esp, 4
push 1
call fcn.0051aa10
push str.mwfsmfltr
call fcn.005110b0
test eax, eax
jne 0x531bec
mov eax, dword [ebp - 0x2c]
cmp eax, ebx
je 0x531c17
push str.Failed_to_install_mwfsmfltr
push eax
call fcn.005dfb23
add esp, 8
jmp 0x531c17
mov dword [ebp - 4], 0xfffffffe
mov eax, 1
jmp 0x531c20
cmp esi, ebx
je 0x531c17
push str.Invalid_parameter
push esi
call fcn.005dfb23
add esp, 8
jmp 0x531c17
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0xd04]
xor ecx, ebp
call fcn.005dfbbe
add ebp, 0xd08
mov esp, ebp
pop ebp
ret 8