Function at 0x43f780
Capabilities:
Get common file path
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1660
call fcn.004646d0
mov eax, dword [0x48602c]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x11
call fcn.0043c190
add esp, 4
push 0x12
call fcn.0043c190
add esp, 4
push 0x14
call fcn.0043c190
add esp, 4
mov dword [ebp - 0x1328], 0
mov dword [ebp - 0x153c], 0
mov byte [ebp - 0x1320], 0
push 0x103
push 0
lea eax, [ebp - 0x131f]
push eax
call sub.MSVCR80.dll_memset
add esp, 0xc
mov word [ebp - 0x1538], 0
push 0x206
push 0
lea ecx, [ebp - 0x1536]
push ecx
call sub.MSVCR80.dll_memset
add esp, 0xc
mov word [ebp - 0x210], 0
push 0x206
push 0
lea edx, [ebp - 0x20e]
push edx
call sub.MSVCR80.dll_memset
add esp, 0xc
mov byte [ebp - 0x1218], 0
push 0xfff
push 0
lea eax, [ebp - 0x1217]
push eax
call sub.MSVCR80.dll_memset
add esp, 0xc
mov dword [ebp - 0x132c], 0
mov dword [ebp - 0x1324], 0
push 0x104
lea ecx, [ebp - 0x1538]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov dx, word [ebp - 0x1538]
mov word [ebp - 0x210], dx
mov dword [ebp - 0x1330], 0xffffffff
cmp dword [ebp - 0x153c], 0
jne 0x43f9d0
push str.C:WindowsSystem32RecoveryReAgent.xml
push 0x104
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.MSVCR80.dll_wcscpy_s]
add esp, 0xc
mov cx, word [ebp - 0x1538]
mov word [ebp - 0x210], cx
push 0
push 0
push 3
push 0
push 3
push bind
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x1330], eax
cmp dword [ebp - 0x1330], 0xffffffff
je 0x43f9d0
push 0
lea eax, [ebp - 0x132c]
push eax
push 0x1000
lea ecx, [ebp - 0x1218]
push ecx
mov edx, dword [ebp - 0x1330]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push 0x4694c4
lea eax, [ebp - 0x1218]
push eax
call fcn.00407700
add esp, 8
mov dword [ebp - 0x164c], eax
cmp dword [ebp - 0x164c], 0
je 0x43f9c3
push 0x4694d4
call sub.MSVCR80.dll_strlen
add esp, 4
mov dword [ebp - 0x1650], eax
mov ecx, dword [ebp - 0x1650]
mov edx, dword [ebp - 0x1650]
sub edx, 1
mov dword [ebp - 0x1650], edx
test ecx, ecx
jle 0x43f969
mov eax, dword [ebp - 0x164c]
add eax, 1
mov dword [ebp - 0x164c], eax
jmp 0x43f93f
mov ecx, dword [ebp - 0x164c]
mov dword [ebp - 0x1324], ecx
mov edx, dword [ebp - 0x164c]
movsx eax, byte [edx]
cmp eax, 0x7d
je 0x43f9a2
mov ecx, dword [ebp - 0x164c]
movsx edx, byte [ecx]
cmp edx, 0x3e
je 0x43f9a2
mov eax, dword [ebp - 0x164c]
add eax, 1
mov dword [ebp - 0x164c], eax
jmp 0x43f975
mov ecx, dword [ebp - 0x164c]
movsx edx, byte [ecx]
cmp edx, 0x7d
jne 0x43f9c3
mov eax, dword [ebp - 0x164c]
mov byte [eax], 0
mov dword [ebp - 0x153c], 1
mov ecx, dword [ebp - 0x1330]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x153c], 0
jne 0x43fb26
call fcn.0043d2d0
push str.C:RecoveryLogsReload.xml
push 0x104
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.MSVCR80.dll_wcscpy_s]
add esp, 0xc
mov ax, word [ebp - 0x1538]
mov word [ebp - 0x210], ax
push 0
push 0
push 3
push 0
push 3
push bind
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x1330], eax
cmp dword [ebp - 0x1330], 0xffffffff
je 0x43fb26
push 0
lea edx, [ebp - 0x132c]
push edx
push 0x1000
lea eax, [ebp - 0x1218]
push eax
mov ecx, dword [ebp - 0x1330]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push 0x46951c
lea edx, [ebp - 0x1218]
push edx
call fcn.00407700
add esp, 8
mov dword [ebp - 0x1654], eax
cmp dword [ebp - 0x1654], 0
je 0x43fb19
push 0x46952c
call sub.MSVCR80.dll_strlen
add esp, 4
mov dword [ebp - 0x1658], eax
mov eax, dword [ebp - 0x1658]
mov ecx, dword [ebp - 0x1658]
sub ecx, 1
mov dword [ebp - 0x1658], ecx
test eax, eax
jle 0x43fabf
mov edx, dword [ebp - 0x1654]
add edx, 1
mov dword [ebp - 0x1654], edx
jmp 0x43fa95
mov eax, dword [ebp - 0x1654]
mov dword [ebp - 0x1324], eax
mov ecx, dword [ebp - 0x1654]
movsx edx, byte [ecx]
cmp edx, 0x7d
je 0x43faf8
mov eax, dword [ebp - 0x1654]
movsx ecx, byte [eax]
cmp ecx, 0x3e
je 0x43faf8
mov edx, dword [ebp - 0x1654]
add edx, 1
mov dword [ebp - 0x1654], edx
jmp 0x43facb
mov eax, dword [ebp - 0x1654]
movsx ecx, byte [eax]
cmp ecx, 0x7d
jne 0x43fb19
mov edx, dword [ebp - 0x1654]
mov byte [edx], 0
mov dword [ebp - 0x153c], 1
mov eax, dword [ebp - 0x1330]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 0x1648], 0
push 0x103
push 0
lea ecx, [ebp - 0x1647]
push ecx
call sub.MSVCR80.dll_memset
add esp, 0xc
cmp dword [ebp - 0x153c], 0
jne 0x43fc9a
push 0x104
lea edx, [ebp - 0x1648]
push edx
call fcn.0043e5c0
add esp, 8
push str.RecoveryLogsReload.xml
push 0x104
lea eax, [ebp - 0x1648]
push eax
call dword [sym.imp.MSVCR80.dll_strcat_s]
add esp, 0xc
push 0
push 0
push 3
push 0
push 3
push bind
lea ecx, [ebp - 0x1648]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x1330], eax
cmp dword [ebp - 0x1330], 0xffffffff
je 0x43fc9a
push 0
lea edx, [ebp - 0x132c]
push edx
push 0x1000
lea eax, [ebp - 0x1218]
push eax
mov ecx, dword [ebp - 0x1330]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push 0x469558
lea edx, [ebp - 0x1218]
push edx
call fcn.00407700
add esp, 8
mov dword [ebp - 0x165c], eax
cmp dword [ebp - 0x165c], 0
je 0x43fc8d
push str._WinreBCD_id_
call sub.MSVCR80.dll_strlen
add esp, 4
mov dword [ebp - 0x1660], eax
mov eax, dword [ebp - 0x1660]
mov ecx, dword [ebp - 0x1660]
sub ecx, 1
mov dword [ebp - 0x1660], ecx
test eax, eax
jle 0x43fc33
mov edx, dword [ebp - 0x165c]
add edx, 1
mov dword [ebp - 0x165c], edx
jmp 0x43fc09
mov eax, dword [ebp - 0x165c]
mov dword [ebp - 0x1324], eax
mov ecx, dword [ebp - 0x165c]
movsx edx, byte [ecx]
cmp edx, 0x7d
je 0x43fc6c
mov eax, dword [ebp - 0x165c]
movsx ecx, byte [eax]
cmp ecx, 0x3e
je 0x43fc6c
mov edx, dword [ebp - 0x165c]
add edx, 1
mov dword [ebp - 0x165c], edx
jmp 0x43fc3f
mov eax, dword [ebp - 0x165c]
movsx ecx, byte [eax]
cmp ecx, 0x7d
jne 0x43fc8d
mov edx, dword [ebp - 0x165c]
mov byte [edx], 0
mov dword [ebp - 0x153c], 1
mov eax, dword [ebp - 0x1330]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x153c], 0
jne 0x43fcaa
xor eax, eax
jmp 0x43fe18
push 0x104
lea ecx, [ebp - 0x1648]
push ecx
call fcn.0043e5c0
add esp, 8
push 0x469578
push 0x104
lea edx, [ebp - 0x1648]
push edx
call dword [sym.imp.MSVCR80.dll_strcat_s]
add esp, 0xc
mov eax, dword [ebp - 0x1324]
push eax
push 0x104
lea ecx, [ebp - 0x1648]
push ecx
call dword [sym.imp.MSVCR80.dll_strcat_s]
add esp, 0xc
push 0x469584
push 0x104
lea edx, [ebp - 0x1648]
push edx
call dword [sym.imp.MSVCR80.dll_strcat_s]
add esp, 0xc
push 0
push 0
push 3
push 0
push 3
push bind
lea eax, [ebp - 0x1648]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0xffffffff
jne 0x43fdc8
push 0x104
lea ecx, [ebp - 0x1648]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov byte [ebp - 0x1645], 0
push str.Recovery_
push 0x104
lea edx, [ebp - 0x1648]
push edx
call dword [sym.imp.MSVCR80.dll_strcat_s]
add esp, 0xc
mov eax, dword [ebp - 0x1324]
push eax
push 0x104
lea ecx, [ebp - 0x1648]
push ecx
call dword [sym.imp.MSVCR80.dll_strcat_s]
add esp, 0xc
push str.winre.wim
push 0x104
lea edx, [ebp - 0x1648]
push edx
call dword [sym.imp.MSVCR80.dll_strcat_s]
add esp, 0xc
push 0
push 0
push 3
push 0
push 3
push bind
lea eax, [ebp - 0x1648]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0xffffffff
je 0x43fe16
lea ecx, [ebp - 0x1648]
push ecx
call sub.MSVCR80.dll_strlen
add esp, 4
push eax
lea edx, [ebp - 0x1648]
push edx
push 0x104
push 0xc9b030
lea eax, [ebp - 0x1328]
push eax
call dword [sym.imp.MSVCR80.dll_mbstowcs_s]
add esp, 0x14
mov ecx, dword [ebp - 0x214]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x43fe18
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043ad38
mov esp, ebp
pop ebp
ret