Function at 0x4e4500
Capabilities:
Get common file path
Manipulate boot configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd80
xor eax, eax
push ebx
push esi
push edi
mov dword [ebp - 8], eax
mov edx, dword [ebp + 8]
lea eax, [ebp - 0x21c]
lea edi, [ebp - 0x10]
mov esi, dword [edx + 0x110]
push 0x104
push eax
and esi, 0xff000000
call sub.KERNEL32.DLL_GetWindowsDirectoryA
test esi, esi
je 0x4e4788
test esi, 0x8000000
je 0x4e457e
and esi, 0xf7ffffff
push esi
push edi
mov esi, str.C:BOOT.INI
lea edi, [ebp - 0x118]
mov eax, edi
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
push esi
push edi
mov esi, str._n_n__BOOT.INI___n_n
lea edi, [ebp - 0x280]
mov eax, edi
mov ecx, 0x12
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
pop edi
pop esi
jmp 0x4e469a
test esi, 0x10000000
je 0x4e45c6
and esi, 0xefffffff
push esi
push edi
mov esi, str.C:CONFIG.SYS
lea edi, [ebp - 0x118]
mov eax, edi
mov ecx, 3
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
pop edi
pop esi
push esi
push edi
mov esi, str._n_n__CONFIG.SYS___n_n
lea edi, [ebp - 0x280]
mov eax, edi
mov ecx, 0x12
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
pop edi
pop esi
jmp 0x4e469a
test esi, 0x20000000
je 0x4e460c
and esi, 0xdfffffff
push esi
push edi
mov esi, str.C:AUTOEXEC.BAT
lea edi, [ebp - 0x118]
mov eax, edi
mov ecx, 4
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push esi
push edi
mov esi, str._n_n__AUTOEXEC.BAT___n_n
lea edi, [ebp - 0x280]
mov eax, edi
mov ecx, 0x12
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
pop edi
pop esi
jmp 0x4e469a
test esi, 0x40000000
je 0x4e4652
and esi, 0xbfffffff
lea edx, [ebp - 0x21c]
push edx
push str._sWIN.INI
lea ecx, [ebp - 0x118]
push ecx
call fcn.00618418
add esp, 0xc
push esi
push edi
mov esi, str._n_n__WIN.INI___n_n
lea edi, [ebp - 0x280]
mov eax, edi
mov ecx, 0x12
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
pop edi
pop esi
jmp 0x4e469a
test esi, 0x80000000
je 0x4e4788
and esi, 0x7fffffff
lea edx, [ebp - 0x21c]
push edx
push str._sSYSTEM.INI
lea ecx, [ebp - 0x118]
push ecx
call fcn.00618418
add esp, 0xc
push esi
push edi
mov esi, str._n_n__SYSTEM.INI___n_n
lea edi, [ebp - 0x280]
mov eax, edi
mov ecx, 0x12
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
pop edi
pop esi
push 0
push 0
push 0
push 0x1002
lea edx, [ebp - 0x118]
push edx
lea ecx, [ebp - 4]
push ecx
call fcn.00526588
add esp, 0x18
test eax, eax
jne 0x4e4780
push edi
mov eax, dword [ebp - 4]
push eax
call fcn.005268d0
add esp, 8
test eax, eax
jne 0x4e4770
mov eax, dword [edi]
inc eax
push eax
call fcn.00613cd0
pop ecx
mov ebx, eax
test ebx, ebx
je 0x4e4770
lea eax, [ebp - 0x14]
push eax
mov eax, dword [edi]
push eax
push ebx
mov edx, dword [ebp - 4]
push edx
call fcn.00526828
add esp, 0x10
test eax, eax
jne 0x4e4769
jmp 0x4e472b
mov eax, dword [edi]
movsx ecx, byte [ebx + eax - 1]
cmp ecx, 0x20
je 0x4e4724
mov eax, dword [edi]
cmp ecx, 9
je 0x4e4724
mov eax, dword [edi]
cmp ecx, 0xa
je 0x4e4724
mov eax, dword [edi]
cmp ecx, 0xd
jne 0x4e4731
sub dword [edi], 1
sbb dword [edi + 4], 0
mov eax, dword [edi]
test eax, eax
jne 0x4e4703
cmp dword [edi + 4], 0
jne 0x4e473a
cmp dword [edi], 0
je 0x4e4769
lea edx, [ebp - 0x280]
push edx
mov ecx, dword [ebp + 8]
push ecx
call fcn.004e47a8
add esp, 8
mov eax, dword [edi]
mov byte [ebx + eax], 0
push ebx
mov edx, dword [ebp + 8]
push edx
call fcn.004e47e4
mov dword [ebp - 8], 1
add esp, 8
push ebx
call fcn.00613cc0
pop ecx
push 0
push 0
mov ecx, dword [ebp - 4]
push ecx
call fcn.0052673c
add esp, 0xc
test esi, esi
jne 0x4e453c
cmp dword [ebp - 8], 0
je 0x4e479f
push str._n_n__END_PREPEND___n_n
mov eax, dword [ebp + 8]
push eax
call fcn.004e47a8
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret