Function at 0x4cde19
Capabilities:
Get common file path

Disassembly:
mov eax, 0x7260db
call fcn.006db31c
sub esp, 0x230
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
mov dword [ebp - 0x18], edi
xor ecx, ecx
push 7
pop edx
mov dword [edi], vtable.ProxyRecoveryHandler.0
mov dword [edi + 8], ebx
mov dword [edi + 0x18], ebx
mov dword [edi + 0x1c], edx
mov word [edi + 8], cx
mov dword [edi + 0x20], ebx
mov dword [ebp - 4], ebx
mov dword [edi + 0x30], ebx
mov dword [edi + 0x34], edx
mov word [edi + 0x20], cx
mov dword [edi + 0x38], ebx
mov byte [edi + 0x3c], bl
mov dword [edi + 0x40], ebx
mov dword [edi + 0x50], ebx
mov dword [edi + 0x54], edx
mov word [edi + 0x40], cx
mov dword [edi + 0x58], ebx
mov dword [edi + 0x68], ebx
mov dword [edi + 0x6c], edx
mov word [edi + 0x58], cx
mov dword [edi + 0x70], ebx
mov dword [edi + 0x80], ebx
mov dword [edi + 0x84], edx
mov word [edi + 0x70], cx
lea eax, [edi + 0x88]
mov dword [eax], ebx
mov dword [eax + 0x10], ebx
mov dword [eax + 0x14], edx
mov word [eax], cx
mov dword [edi + 0xa0], 0x6ddd00
mov dword [edi + 0xa4], 0x5460
mov dword [edi + 0xa8], 0x93a80
mov dword [edi + 0xac], 0x3a980
mov dword [edi + 0xb0], 0x927c0
mov dword [edi + 0xb4], ebx
mov dword [edi + 0xb8], ebx
mov dword [edi + 0xbc], ebx
mov dword [edi + 0xc0], ebx
mov dword [edi + 0xc4], ebx
xor eax, eax
mov dword [edi + 0xc8], ebx
mov dword [edi + 0xcc], ebx
lea ebx, [edi + 0xd0]
mov dword [ebx], ecx
mov dword [ebx + 0x10], ecx
mov dword [ebx + 0x14], edx
mov word [ebx], ax
mov dword [edi + 0xe8], ecx
mov dword [edi + 0xec], ecx
mov al, byte [0x7ed364]
mov byte [ebp - 4], dl
test al, al
je 0x4cdf5b
cmp dword [0x7e0fc8], 8
lea ecx, [ebp - 0xd]
mov edi, 0x7e0fb4
cmovae edi, dword [0x7e0fb4]
call fcn.004d1215
mov esi, eax
mov ecx, esi
call fcn.004cc004
push edi
push esi
call fcn.004cbae5
mov al, byte [0x7ed364]
mov edi, dword [ebp - 0x18]
pop ecx
pop ecx
cmp dword [0x7e0fdc], 0
jne 0x4cdf89
test al, al
je 0x4ce2fc
lea ecx, [ebp - 0xd]
call fcn.004d0e5f
mov esi, eax
mov ecx, esi
call fcn.004d5fc8
push esi
call fcn.004cbae5
pop ecx
jmp 0x4ce2fc
test al, al
je 0x4cdff3
cmp dword [0x7e0fe0], 8
lea ecx, [ebp - 0xd]
mov edi, 0x7e0fcc
cmovae edi, dword [0x7e0fcc]
call fcn.004d1f62
mov esi, eax
mov ecx, esi
call fcn.004cc050
push edi
push esi
call fcn.004cbae5
cmp byte [0x7ed364], 0
pop ecx
pop ecx
je 0x4cdff0
cmp dword [0x7e0fb0], 8
lea ecx, [ebp - 0xd]
mov edi, 0x7e0f9c
cmovae edi, dword [0x7e0f9c]
call fcn.004d1bce
mov esi, eax
mov ecx, esi
call fcn.00451924
push edi
push esi
call fcn.004cbae5
pop ecx
pop ecx
mov edi, dword [ebp - 0x18]
push 0x7e0fb4
lea eax, [ebp - 0x34]
mov ecx, edi
push eax
call fcn.004d4989
lea esi, [edi + 8]
push eax
mov ecx, esi
call fcn.004b6786
lea ecx, [ebp - 0x34]
call fcn.004b6a96
cmp dword [edi + 0x18], 0
jne 0x4ce03f
cmp byte [0x7ed364], 0
je 0x4ce2fc
lea ecx, [ebp - 0xd]
call fcn.004d141f
mov esi, eax
mov ecx, esi
call fcn.004ba755
jmp 0x4cdf7d
cmp byte [0x7ed364], 0
je 0x4ce075
cmp dword [esi + 0x14], 8
mov dword [ebp - 0x1c], esi
jb 0x4ce056
mov eax, dword [esi]
mov dword [ebp - 0x1c], eax
lea ecx, [ebp - 0xd]
call fcn.004d1508
mov esi, eax
mov ecx, esi
call fcn.004cdb03
push dword [ebp - 0x1c]
push esi
call fcn.004cbae5
pop ecx
pop ecx
lea esi, [edi + 8]
push esi
lea eax, [ebp - 0x34]
push 0x72dab8
push eax
call fcn.004bdb48
add esp, 0xc
lea ecx, [edi + 0x20]
push eax
call fcn.004b6786
lea ecx, [ebp - 0x34]
call fcn.004b6a96
push str.snt.dat
lea eax, [ebp - 0x34]
push 0x7e0f9c
push eax
call fcn.004bdad8
add esp, 0xc
lea esi, [edi + 0x40]
mov ecx, esi
push eax
call fcn.004b6786
lea ecx, [ebp - 0x34]
call fcn.004b6a96
push str..bac
lea eax, [ebp - 0x34]
push esi
push eax
call fcn.004bdad8
add esp, 0xc
lea ecx, [edi + 0x58]
push eax
call fcn.004b6786
lea ecx, [ebp - 0x34]
call fcn.004b6a96
push str.RData.reg
mov esi, 0x7e0f9c
lea eax, [ebp - 0x34]
push esi
push eax
call fcn.004bdad8
add esp, 0xc
lea ecx, [edi + 0x70]
push eax
call fcn.004b6786
lea ecx, [ebp - 0x34]
call fcn.004b6a96
push str.tms.bin
lea eax, [ebp - 0x34]
push esi
push eax
call fcn.004bdad8
add esp, 0xc
lea ecx, [edi + 0x88]
push eax
call fcn.004b6786
lea ecx, [ebp - 0x34]
call fcn.004b6a96
push 0x208
xor esi, esi
lea eax, [ebp - 0x23c]
push esi
push eax
call fcn.006dca70
add esp, 0xc
lea eax, [ebp - 0x23c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x4ce181
cmp byte [0x7ed364], al
je 0x4ce2fc
lea ecx, [ebp - 0xd]
call fcn.004d1a4b
mov esi, eax
mov ecx, esi
call fcn.004ba5b3
jmp 0x4cdf7d
lea eax, [ebp - 0x23c]
mov ecx, ebx
push eax
call fcn.004b6b96
push esi
push 0x72dac4
mov ecx, ebx
call fcn.004d6051
cmp eax, 0xffffffff
je 0x4ce1fd
cmp dword [ebx + 0x14], 8
mov eax, ebx
jb 0x4ce1ab
mov eax, dword [ebx]
push 0x104
lea ecx, [ebp - 0x23c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
test eax, eax
je 0x4ce22a
lea eax, [ebp - 0x23c]
mov ecx, ebx
push eax
call fcn.004b6b96
cmp byte [0x7ed364], 0
je 0x4ce1fd
cmp dword [ebx + 0x14], 8
jb 0x4ce1e1
mov ebx, dword [ebx]
lea ecx, [ebp - 0xd]
call fcn.004d0f32
mov esi, eax
mov ecx, esi
call fcn.004cc0e8
push ebx
push esi
call fcn.004cbae5
pop ecx
pop ecx
xor esi, esi
mov ecx, edi
call fcn.004d4a2c
test al, al
jne 0x4ce25d
cmp byte [0x7ed364], al
je 0x4ce2fc
lea ecx, [ebp - 0xd]
call fcn.004d1163
mov esi, eax
mov ecx, esi
call fcn.004d5fa2
jmp 0x4cdf7d
cmp byte [0x7ed364], 0
je 0x4ce2fc
cmp dword [ebx + 0x14], 8
jb 0x4ce23f
mov ebx, dword [ebx]
lea ecx, [ebp - 0xd]
call fcn.004d025d
mov esi, eax
mov ecx, esi
call fcn.004ba697
push ebx
push esi
call fcn.004cbae5
pop ecx
jmp 0x4cdf83
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], esi
push eax
push esi
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CreateWellKnownSid]
push 1
call esi
cmp dword [ebp - 0x14], 0
jne 0x4ce299
cmp byte [0x7ed364], 0
je 0x4ce2fc
lea ecx, [ebp - 0xd]
call fcn.004d237f
mov esi, eax
mov ecx, esi
call fcn.004ba625
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
jmp 0x4ce251
push 0x7af994
push dword [ebp - 0x14]
call fcn.006db311
mov dword [edi + 0xec], eax
pop ecx
pop ecx
test eax, eax
jne 0x4ce2d0
cmp byte [0x7ed364], al
je 0x4ce2fc
lea ecx, [ebp - 0xd]
call fcn.004d2851
mov esi, eax
mov ecx, esi
call fcn.004ba709
jmp 0x4cdf7d
lea ecx, [ebp - 0x14]
push ecx
push eax
push 0
push 1
call esi
test eax, eax
jne 0x4ce2f1
cmp byte [0x7ed364], al
je 0x4ce2fc
lea ecx, [ebp - 0xd]
call fcn.004d2d3b
jmp 0x4ce287
mov ecx, edi
call fcn.004d4cd0
mov byte [edi + 0x3c], 1
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret