Function at 0x41c053
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x70]
sub esp, 0xd0
push ebx
xor ebx, ebx
cmp dword [0x4db1ec], ebx
push esi
push edi
jne 0x41c076
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
mov dword [0x4db1ec], eax
call fcn.0040fe01
call fcn.0049a2b5
call fcn.004142b8
mov esi, 0x4db0e0
push ebx
mov ecx, esi
call fcn.00410a9b
call fcn.00405fc7
mov edi, 0x4dbd30
push edi
call dword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
mov eax, dword [0x4dad38]
or eax, dword [0x4dad3c]
jne 0x41c0bb
push 0x4dad38
call dword [sym.imp.KERNEL32.DLL_QueryPerformanceFrequency]
push edi
call dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
push 0x4dad40
call dword [sym.imp.KERNEL32.DLL_QueryPerformanceCounter]
push 0x4db014
call dword [sym.imp.KERNEL32.DLL_GetSystemTimeAsFileTime]
push ebx
push 0x3911
call fcn.004133bd
push 0xd6fd2
push 0x311f1
lea eax, [ebp - 0x60]
push str._06lu_06lu
push eax
call dword [sym.imp.user32.dll_wsprintfW]
add esp, 0x18
lea eax, [ebp - 0x60]
push eax
push 0x4c37ee
mov ecx, esi
call fcn.0044414b
lea eax, [ebp - 0x60]
push eax
push str.PECMDVER
mov ecx, esi
call fcn.0044414b
push str.X86_U
lea ecx, [ebp + 0x68]
call fcn.0044df7a
push dword [0x4d90f0]
lea ecx, [ebp + 0x68]
call fcn.00444a7c
push dword [ebp + 0x68]
mov ecx, esi
push 0x4c37c4
call fcn.0044414b
push 0x4c37c0
push 0x4c37b0
mov ecx, esi
call fcn.0044419b
push ebx
push 0x391e
call fcn.004133bd
call fcn.0041321b
push ebx
push 0x3920
call fcn.004133bd
mov eax, dword [ebp + 0x78]
add esp, 0x10
cmp dword [0x4dac7c], ebx
mov dword [0x4daf98], eax
jne 0x41c18d
mov dword [0x4dac7c], eax
mov eax, dword [ebp + 0x7c]
mov dword [0x4d92ac], eax
call fcn.0043ee25
push str.WM_TaskbarRestart
push dword [0x4db244]
mov esi, 0x4db0e0
push esi
call fcn.00447086
mov edi, dword [sym.imp.KERNEL32.DLL_GetCurrentProcessId]
add esp, 0xc
push str.__PID
call edi
push eax
push esi
call fcn.00447086
add esp, 0xc
call edi
push eax
call fcn.00404e15
mov dword [esp], str.__PPID
push eax
push esi
call fcn.00447086
push str.__HINST
push dword [0x4daf98]
push esi
call fcn.00447086
add esp, 0x18
call dword [sym.imp.KERNEL32.DLL_GetCurrentThreadId]
push 0x4c3744
push eax
push esi
mov dword [0x4dae68], eax
call fcn.00447086
add esp, 0xc
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
add eax, 0x3929
push ebx
push eax
call fcn.004133bd
movzx eax, word [0x4de018]
push str.SYSCODEPAGE
push eax
push esi
call fcn.00447086
add esp, 0x14
push 0x20a
lea ecx, [ebp + 0x6c]
call fcn.00444a2e
push dword [ebp + 0x6c]
mov edi, 0x208
push edi
call dword [sym.imp.KERNEL32.DLL_GetCurrentDirectoryW]
push dword [ebp + 0x6c]
mov ecx, esi
push 0x4c33f4
call fcn.0044419b
push dword [ebp + 0x6c]
mov ecx, esi
push str._CD
call fcn.0044419b
mov eax, dword [ebp + 0x6c]
mov word [eax + 4], bx
push dword [ebp + 0x6c]
mov ecx, esi
push str.CurDrv
call fcn.0044419b
mov eax, dword [ebp + 0x6c]
push edi
push eax
push ebx
mov word [eax], bx
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
push dword [ebp + 0x6c]
mov ecx, esi
push str.CurFile
call fcn.0044419b
call fcn.004133cd
lea ecx, [ebp + 0x6c]
call fcn.0043e48d
lea ecx, [ebp + 0x68]
call fcn.0043e48d
pop edi
pop esi
pop ebx
add ebp, 0x70
leave
ret