Function at 0x401715
Capabilities:
Get common file path

Disassembly:
push ebp
mov edx, 0x97
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x40171b
call fcn.0041cbe0
mov edx, dword [esp + 0x264]
lea ecx, [esp]
call fcn.00411060
push edx
call fcn.0041cb30
pop edx
push eax
push edx
call fcn.0041cb30
pop edx
push eax
push 0x104
call fcn.00411dd0
lea eax, [esp + 8]
push eax
call fcn.0041cca0
push edx
call fcn.0041cb30
pop edx
push eax
push edx
call fcn.0041cb30
pop edx
push eax
push 0x104
call fcn.00411dd0
lea eax, [esp + 0xc]
push eax
call fcn.0041cca0
push 0x104
push dword [esp + 8]
call sub.KERNEL32.dll_GetSystemDirectoryW
mov eax, str.winlogon.exe
push eax
push dword [esp + 8]
call sub.KERNEL32.dll_lstrcatW
push edx
call fcn.0041cb30
pop edx
push eax
push edx
call fcn.0041cb30
pop edx
push eax
push dword [esp + 0xc]
call fcn.00411ec0
lea eax, [esp + 8]
push eax
call fcn.0041cca0
push edx
call fcn.0041cb30
pop edx
push eax
push edx
call fcn.0041cb30
pop edx
push eax
push dword [esp + 8]
call fcn.00411ec0
lea eax, [esp + 4]
push eax
call fcn.0041cca0
mov dword [esp + 0xc], 0
mov eax, str.Kernel32.dll
push eax
push 0
call fcn.00414c67
and eax, eax
je 0x401a3d
mov eax, str.CreateToolhelp32Snapshot
push eax
push 0
call fcn.00414cc1
mov dword [esp + 0x10], eax
mov eax, str.Process32First
push eax
push 0
call fcn.00414cc1
mov dword [esp + 0x14], eax
mov eax, str.Process32Next
push eax
push 0
call fcn.00414cc1
mov dword [esp + 0x18], eax
cmp dword [esp + 0x10], 0
je 0x401858
cmp dword [esp + 0x14], 0
je 0x401858
mov eax, 1
jmp 0x40185a
xor eax, eax
and eax, eax
je 0x40186c
cmp dword [esp + 0x18], 0
je 0x40186c
mov eax, 1
jmp 0x40186e
xor eax, eax
and eax, eax
je 0x401a33
lea ebp, [esp + 0x1c]
mov dword [ebp], 0x22c
push 0
push 2
push dword [esp + 0x18]
call fcn.00414e1d
mov dword [esp + 0x248], eax
cmp dword [esp + 0x248], 0
je 0x401a27
lea eax, [esp + 0x1c]
push eax
push dword [esp + 0x24c]
push dword [esp + 0x1c]
call fcn.00414e1d
mov dword [esp + 0x24c], eax
cmp dword [esp + 0x24c], 0
je 0x401a27
push edx
call fcn.0041cb30
pop edx
push eax
push edx
call fcn.0041cb30
pop edx
push eax
push edx
call fcn.0041cb30
pop edx
push eax
push edx
call fcn.0041cb30
pop edx
push eax
push 0x18
push 0xffffffff
lea ebp, [esp + 0x34]
lea eax, [ebp + 0x24]
push eax
call fcn.0041c630
call fcn.004111a2
add dword [esp], edx
call fcn.00411ec0
lea eax, [esp + 0x254]
push eax
call fcn.0041cca0
push edx
call fcn.0041cb30
pop edx
push eax
push edx
call fcn.0041cb30
pop edx
push eax
push dword [esp + 0x258]
call fcn.00415057
lea eax, [esp + 0x254]
push eax
call fcn.0041cca0
push dword [esp + 0x250]
mov edx, dword [esp + 4]
pop ecx
call fcn.004111d0
je 0x401a06
lea ebp, [esp + 0x1c]
push dword [ebp + 8]
push 0
push 0x400
call sub.KERNEL32.dll_OpenProcess
mov dword [esp + 0x254], eax
push 0x104
push dword [esp + 0xc]
push 0
push dword [esp + 0x260]
call fcn.004021e8
push edx
call fcn.0041cb30
pop edx
push eax
push edx
call fcn.0041cb30
pop edx
push eax
push dword [esp + 8]
call fcn.00411ec0
call fcn.0041cb70
push edx
call fcn.0041cb30
pop edx
push eax
push edx
call fcn.0041cb30
pop edx
push eax
push dword [esp + 0x14]
call fcn.00411ec0
call fcn.00411210
mov edx, eax
call fcn.00411210
mov ecx, eax
call fcn.004111d0
je 0x4019f0
lea ebp, [esp + 0x1c]
mov eax, dword [ebp + 8]
jmp 0x401a48
mov dword [esp + 0xc], 1
lea ebp, [esp + 0x1c]
mov eax, dword [ebp + 8]
mov dword [esp + 0x258], eax
lea eax, [esp + 0x1c]
push eax
push dword [esp + 0x24c]
push dword [esp + 0x20]
call fcn.00414e1d
mov dword [esp + 0x24c], eax
jmp 0x4018c5
push dword [esp + 0x248]
call sub.KERNEL32.dll_CloseHandle
push 0
call fcn.00414ba7
mov eax, dword [esp + 0x258]
jmp 0x401a48
push dword [esp + 0x250]
call fcn.0041cd30
push dword [esp]
call fcn.0041cd30
push dword [esp + 8]
call fcn.0041cd30
push dword [esp + 4]
call fcn.0041cd30
add esp, 0x25c
pop ebp
ret 4