Function at 0x404aa0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4836e0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 0x10], esp
xor ebx, ebx
push str.begin...CRegWatch___n
mov dword [ebp - 0x18], esi
mov dword [esi], 0x485354
mov dword [ebp - 4], ebx
call fcn.0047a8c7
add esp, 4
call fcn.0046d830
push 0x57ce84
push 0x4a4dac
push 0x52f524
call fcn.0045e440
add esp, 0xc
push 0x57ce88
push 0x4f2818
call fcn.0045e910
add esp, 8
push 0x57ce8c
push 0x551360
push 0x4b552c
call fcn.0045edd0
add esp, 0xc
push 0x57ce90
push 0x513218
call fcn.004600c0
add esp, 8
push 0x57ce98
push 0x52d520
call fcn.00478270
add esp, 8
xor edx, edx
mov dword [ebp - 0x14], edx
cmp edx, dword [0x57ce98]
jge 0x404b81
shl edx, 6
or ecx, 0xffffffff
xor eax, eax
lea edi, [edx + 0x52d520]
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 4
jle 0x404b76
mov byte [edx + ecx + 0x52d51c], bl
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
mov edx, eax
jmp 0x404b4f
push 0x50ef30
mov byte [0x51b3d8], bl
mov byte [0x54bdd8], bl
mov byte [0x54fd54], bl
mov byte [0x540f68], bl
mov byte [0x4dec8c], bl
mov byte [0x4a2e60], bl
mov byte [0x50eeb0], bl
mov byte [0x4a4b6c], bl
mov byte [0x50bf20], bl
mov byte [0x52d35c], bl
mov byte [0x54f90c], bl
mov byte [0x54ed0c], bl
mov byte [0x4a4bec], bl
mov byte [0x5649a8], bl
mov byte [0x549134], bl
mov byte [0x511a50], bl
mov byte [0x519524], bl
mov byte [0x54c124], bl
mov byte [0x54d930], bl
mov byte [0x561460], bl
mov dword [0x57ce80], ebx
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea eax, [esi + 4]
push 0x4914d0
push eax
mov byte [esi + 0x84], bl
mov byte [eax], bl
call fcn.0047a8f8
mov eax, 1
push 0x54a104
mov byte [esi + 0x104], al
mov byte [esi + 0x105], al
mov byte [esi + 0x106], al
mov byte [esi + 0x107], al
mov dword [esi + 0x10c], eax
call fcn.004038a0
add esp, 0xc
push 0x54bf64
call fcn.00403c60
mov edi, 0x54bf64
or ecx, 0xffffffff
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov byte [0x50d7a8], bl
mov eax, ecx
mov esi, edi
mov edi, 0x50d7a8
mov byte [0x4f1934], bl
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
push 0x80
rep movsb byte es:[edi], byte [esi]
mov edi, 0x54a104
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea eax, [ebp - 0x98]
mov edx, ecx
mov esi, edi
mov edi, 0x4f1934
push eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea edi, [ebp - 0x98]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, 0x519320
lea eax, [ebp - 0x118]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.00403990
mov ecx, dword [0x57ce8c]
mov edx, dword [0x57ce88]
mov eax, dword [0x57ce84]
add esp, 4
push ecx
push edx
lea ecx, [ebp - 0x118]
push eax
push ecx
call fcn.00483565
add esp, 4
push eax
push 0x54a104
call fcn.00483565
add esp, 4
push eax
push 0x54bf64
call fcn.00483565
add esp, 4
lea edx, [ebp - 0x218]
push eax
push str.__s::_s_
push edx
call fcn.0047a8f8
push 0x57ce80
push 0x4e1934
call fcn.004353e0
add esp, 0x28
mov ecx, 0x65cd80
push str.get_service_info....
call fcn.00479641
mov ecx, dword [0x57ce80]
push ecx
mov ecx, eax
call fcn.00479a12
push 0xa
mov ecx, eax
call fcn.00479456
push 0x401430
mov ecx, eax
call fcn.00401410
push str.end...CRegWatch___n
call fcn.0047a8c7
add esp, 4
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x18]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret