Function at 0x409fc0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc74
mov eax, dword [0x550070]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov eax, dword [0x55aa68]
mov dword [ebp - 0xc08], eax
push 0x7fc
push 0
lea ecx, [ebp - 0xc04]
push ecx
call fcn.004d43c0
add esp, 0xc
mov dword [ebp - 0xc3c], 0
mov edx, dword [ebp + 8]
mov dword [ebp - 0xc18], edx
mov eax, dword [ebp - 0xc18]
add eax, 2
mov dword [ebp - 0xc54], eax
mov ecx, dword [ebp - 0xc18]
mov dx, word [ecx]
mov word [ebp - 0xc2e], dx
add dword [ebp - 0xc18], 2
cmp word [ebp - 0xc2e], 0
jne 0x40a018
mov eax, dword [ebp - 0xc18]
sub eax, dword [ebp - 0xc54]
sar eax, 1
mov dword [ebp - 0xc58], eax
mov ecx, dword [ebp - 0xc58]
mov dword [ebp - 0xc44], ecx
mov edx, dword [ebp - 0xc44]
mov dword [ebp - 0xc10], edx
mov eax, 2
imul ecx, eax, 0
mov edx, dword [ebp + 8]
movzx eax, word [edx + ecx]
cmp eax, 0x5c
je 0x40a08a
mov ecx, dword [ebp - 0xc44]
mov dword [ebp - 0xc10], ecx
jmp 0x40a2d3
push 0xc
push str.SystemRoot_
mov edx, dword [ebp + 8]
push edx
call fcn.004de740
add esp, 0xc
test eax, eax
jne 0x40a135
push 0x400
lea eax, [ebp - 0xc08]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
jne 0x40a0c5
mov eax, 0xfffffff2
jmp 0x40a4a6
lea ecx, [ebp - 0xc08]
mov dword [ebp - 0xc1c], ecx
mov edx, dword [ebp - 0xc1c]
add edx, 2
mov dword [ebp - 0xc5c], edx
mov eax, dword [ebp - 0xc1c]
mov cx, word [eax]
mov word [ebp - 0xc30], cx
add dword [ebp - 0xc1c], 2
cmp word [ebp - 0xc30], 0
jne 0x40a0e0
mov edx, dword [ebp - 0xc1c]
sub edx, dword [ebp - 0xc5c]
sar edx, 1
mov dword [ebp - 0xc60], edx
mov eax, dword [ebp - 0xc60]
mov dword [ebp - 0xc3c], eax
mov ecx, dword [ebp - 0xc10]
sub ecx, 0xb
mov dword [ebp - 0xc10], ecx
jmp 0x40a2d3
push 4
push 0x550c2c
mov edx, dword [ebp + 8]
push edx
call fcn.004de740
add esp, 0xc
test eax, eax
jne 0x40a160
mov eax, dword [ebp - 0xc10]
sub eax, 4
mov dword [ebp - 0xc10], eax
jmp 0x40a2d3
mov dword [ebp - 0xc48], 0
push 0x400
lea ecx, [ebp - 0xc08]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov dword [ebp - 0xc0c], eax
cmp dword [ebp - 0xc0c], 0
jne 0x40a190
jmp 0x40a2b1
mov edx, dword [ebp - 0xc0c]
movzx eax, word [ebp + edx*2 - 0xc0a]
cmp eax, 0x5c
jne 0x40a1b2
mov ecx, dword [ebp - 0xc0c]
sub ecx, 1
mov dword [ebp - 0xc0c], ecx
cmp dword [ebp - 0xc0c], 3
jb 0x40a225
mov edx, dword [ebp + 8]
mov dword [ebp - 0xc20], edx
mov eax, dword [ebp - 0xc20]
add eax, 2
mov dword [ebp - 0xc64], eax
mov ecx, dword [ebp - 0xc20]
mov dx, word [ecx]
mov word [ebp - 0xc32], dx
add dword [ebp - 0xc20], 2
cmp word [ebp - 0xc32], 0
jne 0x40a1d3
mov eax, dword [ebp - 0xc20]
sub eax, dword [ebp - 0xc64]
sar eax, 1
mov dword [ebp - 0xc68], eax
mov ecx, dword [ebp - 0xc68]
add ecx, 2
cmp dword [ebp - 0xc0c], ecx
ja 0x40a225
cmp dword [ebp - 0xc0c], 0x400
jb 0x40a22a
jmp 0x40a2b1
mov edx, dword [ebp - 0xc0c]
sub edx, 2
push edx
mov eax, 2
shl eax, 1
lea ecx, [ebp + eax - 0xc08]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.004de740
add esp, 0xc
test eax, eax
je 0x40a255
jmp 0x40a2b1
mov eax, dword [ebp - 0xc0c]
mov ecx, dword [ebp + 8]
movzx edx, word [ecx + eax*2 - 4]
cmp edx, 0x5c
je 0x40a27c
mov eax, dword [ebp - 0xc0c]
mov ecx, dword [ebp + 8]
movzx edx, word [ecx + eax*2 - 4]
test edx, edx
je 0x40a27c
jmp 0x40a2b1
mov eax, dword [ebp - 0xc0c]
mov dword [ebp - 0xc3c], eax
mov ecx, dword [ebp - 0xc0c]
sub ecx, 2
mov edx, dword [ebp - 0xc10]
sub edx, ecx
mov dword [ebp - 0xc10], edx
mov dword [ebp - 0xc48], 1
xor eax, eax
jne 0x40a16a
cmp dword [ebp - 0xc48], 0
jne 0x40a2d3
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00409a20
add esp, 0xc
jmp 0x40a4a6
mov ecx, dword [ebp - 0xc3c]
add ecx, dword [ebp - 0xc10]
cmp dword [ebp + 0x10], ecx
jge 0x40a2ee
mov eax, 0xffffffe4
jmp 0x40a4a6
lea edx, [ebp - 0xc08]
mov dword [ebp - 0xc40], edx
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc28], eax
mov ecx, dword [ebp - 0xc28]
mov dword [ebp - 0xc74], ecx
mov edx, dword [ebp - 0xc40]
mov ax, word [edx]
mov word [ebp - 0xc12], ax
mov ecx, dword [ebp - 0xc28]
mov dx, word [ebp - 0xc12]
mov word [ecx], dx
mov eax, dword [ebp - 0xc40]
add eax, 2
mov dword [ebp - 0xc40], eax
mov ecx, dword [ebp - 0xc28]
add ecx, 2
mov dword [ebp - 0xc28], ecx
cmp word [ebp - 0xc12], 0
jne 0x40a30f
mov edx, dword [ebp - 0xc44]
sub edx, dword [ebp - 0xc10]
mov eax, dword [ebp + 8]
lea ecx, [eax + edx*2]
mov dword [ebp - 0xc24], ecx
mov edx, dword [ebp - 0xc24]
mov dword [ebp - 0xc4c], edx
mov eax, dword [ebp - 0xc24]
mov cx, word [eax]
mov word [ebp - 0xc34], cx
add dword [ebp - 0xc24], 2
cmp word [ebp - 0xc34], 0
jne 0x40a37b
mov edx, dword [ebp - 0xc24]
sub edx, dword [ebp - 0xc4c]
mov eax, dword [ebp - 0xc4c]
mov dword [ebp - 0xc6c], eax
mov dword [ebp - 0xc70], edx
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffffe
mov dword [ebp - 0xc2c], ecx
mov edx, dword [ebp - 0xc2c]
mov ax, word [edx + 2]
mov word [ebp - 0xc36], ax
add dword [ebp - 0xc2c], 2
cmp word [ebp - 0xc36], 0
jne 0x40a3c6
mov edi, dword [ebp - 0xc2c]
mov esi, dword [ebp - 0xc6c]
mov edx, dword [ebp - 0xc70]
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 0x7e
mov eax, dword [ebp + 0xc]
push eax
call fcn.004d3d8e
add esp, 8
test eax, eax
je 0x40a4a4
xor ecx, ecx
mov word [ebp - 0x408], cx
push 0x400
push 0
lea edx, [ebp - 0x406]
push edx
call fcn.004d43c0
add esp, 0xc
push 0x200
lea eax, [ebp - 0x408]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
test eax, eax
je 0x40a4a4
mov edx, dword [ebp + 0x10]
sub edx, 1
cmp edx, 0x200
jle 0x40a471
mov dword [ebp - 0xc50], 0x200
jmp 0x40a47d
mov eax, dword [ebp + 0x10]
sub eax, 1
mov dword [ebp - 0xc50], eax
mov ecx, dword [ebp - 0xc50]
push ecx
lea edx, [ebp - 0x408]
push edx
mov eax, dword [ebp + 0xc]
push eax
call fcn.004dc6cf
add esp, 0xc
xor ecx, ecx
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
mov word [eax + edx*2 - 2], cx
xor eax, eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004d181f
mov esp, ebp
pop ebp
ret