Function at 0x45c170
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x538a60]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push esi
push eax
push edx
call fcn.00479020
add esp, 8
mov dword [0x53eba0], eax
test eax, eax
jne 0x45c1ab
mov al, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004bae74
mov esp, ebp
pop ebp
ret
mov eax, dword [0x53eba0]
test byte [eax + 0x68], 1
je 0x45c9bd
cmp byte [0x53eb98], 0
je 0x45c2e7
cmp byte [0x53eb79], 1
jne 0x45c1ee
mov ax, word [0x53eb3c]
test ax, ax
je 0x45c1ee
cwde
push eax
push 0x561208
push 0x561418
push str._S__s__d_MFT.z
jmp 0x45c205
movsx eax, byte [0x53eb3e]
push eax
push 0x561208
push 0x561418
push str._S__s__c_MFT.z
push 0x1000
push 0x547d60
call fcn.00471220
mov ecx, dword [0x53eba0]
add esp, 0x18
mov edx, str._MFT
call fcn.004588a0
cmp byte [0x53eb79], 1
jne 0x45c24e
mov ax, word [0x53eb3c]
test ax, ax
je 0x45c24e
cwde
push eax
push 0x561208
push 0x561418
push str._S__s__d_LogFile.z
jmp 0x45c265
movsx eax, byte [0x53eb3e]
push eax
push 0x561208
push 0x561418
push str._S__s__c_LogFile.z
push 0x1000
push 0x547d60
call fcn.00471220
mov ecx, dword [0x53eba0]
add esp, 0x18
mov edx, str._LogFile
call fcn.004588a0
cmp byte [0x53eb79], 1
jne 0x45c2ae
mov ax, word [0x53eb3c]
test ax, ax
je 0x45c2ae
cwde
push eax
push 0x561208
push 0x561418
push str._S__s__d_Secure.z
jmp 0x45c2c5
movsx eax, byte [0x53eb3e]
push eax
push 0x561208
push 0x561418
push str._S__s__c_Secure.z
push 0x1000
push 0x547d60
call fcn.00471220
mov ecx, dword [0x53eba0]
add esp, 0x18
mov edx, str._Secure
call fcn.004588a0
cmp byte [0x53eb97], 0
je 0x45c350
cmp byte [0x53eb79], 1
jne 0x45c317
mov ax, word [0x53eb3c]
test ax, ax
je 0x45c317
cwde
push eax
push 0x561208
push 0x561418
push str._S__s__d_USNJRNL.z
jmp 0x45c32e
movsx eax, byte [0x53eb3e]
push eax
push 0x561208
push 0x561418
push str._S__s__c_USNJRNL.z
push 0x1000
push 0x547d60
call fcn.00471220
mov ecx, dword [0x53eba0]
add esp, 0x18
mov edx, str._Extend__UsnJrnl
call fcn.004588a0
cmp byte [0x53eb7b], 0
je 0x45c36a
mov edx, dword [0x53eba0]
mov ecx, dword [0x53ec44]
call fcn.0045a430
mov al, byte [0x53eb3e]
cmp al, 0x63
je 0x45c380
cmp byte [0x53eb9e], 1
jne 0x45c782
cmp byte [0x53eb99], 0
je 0x45c3c3
movsx eax, al
push eax
push 0x561208
push 0x561418
push str._S__s__c_pagefile.sys.z
push 0x1000
push 0x547d60
call fcn.00471220
mov ecx, dword [0x53eba0]
add esp, 0x18
mov edx, str.pagefile.sys
call fcn.004588a0
mov al, byte [0x53eb3e]
cmp byte [0x53eb86], 0
je 0x45c406
movsx eax, al
push eax
push 0x561208
push 0x561418
push str._S__s__c_hiberfil.sys.z
push 0x1000
push 0x547d60
call fcn.00471220
mov ecx, dword [0x53eba0]
add esp, 0x18
mov edx, str.hyberfil.sys
call fcn.004588a0
mov al, byte [0x53eb3e]
cmp byte [0x53eb94], 0
je 0x45c47f
movsx eax, al
push eax
push 0x561208
push 0x561418
push str._S__s__c_SYSTEM.z
push 0x1000
push 0x547d60
call fcn.00471220
mov ecx, dword [0x53eba0]
mov edx, str.Windows_System32_config_SYSTEM
call fcn.004588a0
movsx eax, byte [0x53eb3e]
push eax
push 0x561208
push 0x561418
push str._S__s__c_amcache.hve.z
push 0x1000
push 0x547d60
call fcn.00471220
mov ecx, dword [0x53eba0]
add esp, 0x30
mov edx, str.Windows_AppCompat_Programs_Amcache.hve
call fcn.004588a0
mov al, byte [0x53eb3e]
cmp byte [0x53eb95], 0
je 0x45c4c2
movsx eax, al
push eax
push 0x561208
push 0x561418
push str._S__s__c_SOFTWARE.z
push 0x1000
push 0x547d60
call fcn.00471220
mov ecx, dword [0x53eba0]
add esp, 0x18
mov edx, str.Windows_System32_config_SOFTWARE
call fcn.004588a0
mov al, byte [0x53eb3e]
cmp byte [0x53eb93], 0
je 0x45c505
movsx eax, al
push eax
push 0x561208
push 0x561418
push str._S__s__c_SECURITY.z
push 0x1000
push 0x547d60
call fcn.00471220
mov ecx, dword [0x53eba0]
add esp, 0x18
mov edx, str.Windows_System32_config_SECURITY
call fcn.004588a0
mov al, byte [0x53eb3e]
cmp byte [0x53eb92], 0
je 0x45c548
movsx eax, al
push eax
push 0x561208
push 0x561418
push str._S__s__c_SAM.z
push 0x1000
push 0x547d60
call fcn.00471220
mov ecx, dword [0x53eba0]
add esp, 0x18
mov edx, str.Windows_System32_config_SAM
call fcn.004588a0
mov al, byte [0x53eb3e]
cmp byte [0x53eb91], 0
je 0x45c58b
movsx eax, al
push eax
push 0x561208
push 0x561418
push str._S__s__c_DEFAULT.z
push 0x1000
push 0x547d60
call fcn.00471220
mov ecx, dword [0x53eba0]
add esp, 0x18
mov edx, str.Windows_System32_config_DEFAULT
call fcn.004588a0
mov al, byte [0x53eb3e]
cmp byte [0x53eb90], 0
je 0x45c5de
movsx eax, al
push eax
push 0x561208
push 0x561418
push str._S__s__c_NTDS.dit.z
push 0x1000
push 0x547d60
call fcn.00471220
mov ecx, dword [0x53eba0]
add esp, 0x18
mov edx, str.Windows_NTDS_Ntds.dit
call fcn.004588a0
mov ecx, dword [0x53eba0]
mov edx, str.NTDS_Ntds.dit
call fcn.004588a0
mov al, byte [0x53eb3e]
cmp byte [0x53eb8f], 0
je 0x45c621
movsx eax, al
push eax
push 0x561208
push 0x561418
push str._S__s__c_Windows.edb.z
push 0x1000
push 0x547d60
call fcn.00471220
mov ecx, dword [0x53eba0]
add esp, 0x18
mov edx, str.ProgramData_Microsoft_Search_Data_Applications_Windows_Windows.edb
call fcn.004588a0
mov al, byte [0x53eb3e]
cmp byte [0x53eb78], 0
je 0x45c65f
movsx eax, al
push eax
push 0x561208
push 0x561418
push str._S__s__c_SRUDB.dat.z
push 0x1000
push 0x547d60
call fcn.00471220
mov ecx, dword [0x53eba0]
add esp, 0x18
mov edx, str.Windows_System32_sru_SRUDB.dat
call fcn.004588a0
cmp byte [0x53eb8b], 0
je 0x45c680
push dword [0x53eba0]
mov edx, 0x520e1c
mov ecx, str._Windows_Prefetch
call fcn.0045aa70
add esp, 4
cmp byte [0x53eb8a], 0
je 0x45c6b9
push dword [0x53eba0]
mov edx, str.EVTX
mov ecx, str._Windows_System32_winevt_logs
call fcn.0045aa70
add esp, 4
mov edx, 0x520e5c
mov ecx, str._Windows_System32_config
push dword [0x53eba0]
call fcn.0045aa70
add esp, 4
cmp byte [0x53eb89], 0
je 0x45c6e8
mov esi, 0x527c20
jmp 0x45c6d0
mov edx, dword [0x53eba0]
mov ecx, dword [esi]
call fcn.0045a430
add esi, 4
cmp esi, 0x527c90
jl 0x45c6d0
cmp byte [0x53eb87], 0
je 0x45c753
push dword [0x53eba0]
mov edx, 0x521320
mov ecx, str._Windows_Tasks
call fcn.0045aa70
add esp, 4
test eax, eax
je 0x45c717
mov ecx, str.failed_to_acquire__Windows_Tasks_.job_n
call fcn.00458190
mov edx, dword [0x53eba0]
mov ecx, str._Windows_System32_Tasks
call fcn.0045a430
test eax, eax
je 0x45c735
mov ecx, str.failed_to_recursively_acquire__Windows_System32_Tasks
call fcn.00458190
mov edx, dword [0x53eba0]
mov ecx, str._Windows_SysWOW64_Tasks
call fcn.0045a430
test eax, eax
je 0x45c753
mov ecx, str.failed_to_recursively_acquire__Windows_SysWOW64_Tasks
call fcn.00458190
cmp byte [0x53eb88], 0
je 0x45c782
push dword [0x53eba0]
mov edx, 0x521494
mov ecx, str._Windows_INF
call fcn.0045aa70
add esp, 4
test eax, eax
je 0x45c782
mov ecx, str.failed_to_acquire__Windows_INF_.log_n
call fcn.00458190
cmp byte [0x53eb8c], 0
jne 0x45c7b8
cmp byte [0x53eb7f], 0
jne 0x45c7b8
cmp byte [0x53eb6b], 0
jne 0x45c7b8
cmp byte [0x53eb6a], 0
jne 0x45c7b8
cmp byte [0x53eb8e], 0
jne 0x45c7b8
cmp byte [0x53eb8d], 0
je 0x45c820
lea eax, [ebp - 0x28]
mov dword [ebp - 0x28], 0x1000
push eax
push 0x552d60
call dword [sym.imp.USERENV.dll_GetProfilesDirectoryW]
cmp eax, 1
je 0x45c7df
mov ecx, str.GetProfilesDirectory___failed__this_will_impact_profile_acquisition_data_n
call fcn.00458190
jmp 0x45c820
push 0x6000
push 0x552d60
call fcn.004bbcd9
movzx ecx, word [0x552d60]
add esp, 8
movsx eax, byte [0x53eb3e]
cmp eax, ecx
je 0x45c80c
cmp byte [0x53eb9e], 1
jne 0x45c820
mov edx, str.Users
call fcn.0045ad50
mov edx, str.Documents_and_Settings
call fcn.0045ad50
cmp byte [0x53eb83], 0
je 0x45c87d
cmp dword [0x53eb4c], 0
jle 0x45c87d
mov ecx, dword [0x53eb38]
call fcn.00455630
mov ecx, dword [0x53eba0]
mov edx, 4
mov dword [0x53ec30], eax
lea eax, [ebp - 0x40]
push eax
push 0x45b650
push dword [ecx + 0x1c]
push dword [ecx + 0x18]
call fcn.00478620
mov eax, dword [0x53ec30]
add esp, 0x10
test eax, eax
je 0x45c87d
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp byte [0x53eb68], 0
je 0x45c9bd
push 0x10
call fcn.004bb090
add esp, 4
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
movzx ecx, word [esi + 0xc]
movzx eax, word [esi + 6]
push ecx
movzx ecx, word [esi + 0xa]
push ecx
movzx ecx, word [esi + 8]
push ecx
push eax
movzx eax, word [esi + 2]
push eax
movzx eax, word [esi]
push eax
push str._04d_02d_02d_02d_02d_02d
lea eax, [ebp - 0x14]
push 0x10
push eax
call fcn.004716e0
add esp, 0x24
lea eax, [ebp - 0x14]
push eax
push str.Started_FileHash_at_:__S_n
push 0xffffffffffffffff
push 0x800
push 0x545d60
call fcn.004bb4ef
add esp, 0x14
mov ecx, 0x545d60
call fcn.00458190
push 0x51b858
push 0x800
push 0x545d60
call fcn.00471700
add esp, 0xc
push esi
call fcn.004bae6f
mov ecx, dword [0x53eba0]
lea eax, [ebp - 0x34]
add esp, 4
mov edx, 4
push eax
push 0x45bb40
push dword [ecx + 0x1c]
push dword [ecx + 0x18]
call fcn.00478620
push 0x10
call fcn.004bb090
add esp, 0x14
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
movzx ecx, word [esi + 0xc]
movzx eax, word [esi + 2]
push ecx
movzx ecx, word [esi + 0xa]
push ecx
movzx ecx, word [esi + 8]
push ecx
movzx ecx, word [esi + 6]
push ecx
push eax
movzx eax, word [esi]
push eax
push str._04d_02d_02d_02d_02d_02d
lea eax, [ebp - 0x24]
push 0x10
push eax
call fcn.004716e0
add esp, 0x24
lea eax, [ebp - 0x24]
push eax
push str.Completed_FileHash_at_:__S_n
push 0xffffffffffffffff
push 0x800
push 0x545d60
call fcn.004bb4ef
add esp, 0x14
mov ecx, 0x545d60
call fcn.00458190
push 0x51b858
push 0x800
push 0x545d60
call fcn.00471700
add esp, 0xc
push esi
call fcn.004bae6f
add esp, 4
mov eax, dword [0x53eba0]
test eax, eax
je 0x45c9da
cmp dword [eax], 0x10101010
jne 0x45c9da
push eax
mov eax, dword [eax + 0x10c]
call eax
add esp, 4
mov ecx, dword [ebp - 4]
xor al, al
xor ecx, ebp
pop esi
call fcn.004bae74
mov esp, ebp
pop ebp
ret