Function at 0x41faf0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x600b4f
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x69ee98]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], 1
call fcn.00485933
mov edi, eax
test edi, edi
je 0x42001a
mov eax, dword [edi]
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x613aec]
mov ecx, edi
call esi
mov ebx, dword [ebp + 8]
add eax, 0x10
mov dword [ebx], eax
mov dword [ebp - 4], 0
mov ecx, 1
mov eax, dword [0x6c7804]
mov esi, ecx
mov dword [ebp - 0x14], ecx
mov edx, esi
mov ecx, dword [eax - 8]
sub edx, dword [eax - 4]
sub ecx, 0x104
or ecx, edx
jge 0x41fb83
push 0x104
mov ecx, 0x6c7804
call fcn.00403840
mov eax, dword [0x6c7804]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov eax, dword [0x6c7804]
test eax, eax
jne 0x41fb9e
xor ecx, ecx
jmp 0x41fbb9
push dword [eax - 8]
push eax
call fcn.005dafda
mov ecx, eax
add esp, 8
test ecx, ecx
js 0x420010
mov eax, dword [0x6c7804]
cmp ecx, dword [eax - 8]
jg 0x420010
mov dword [eax - 0xc], ecx
mov eax, dword [0x6c7804]
mov byte [eax + ecx], 0
mov ecx, esi
mov eax, dword [ebx]
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
sub eax, 0x104
or eax, ecx
jge 0x41fbed
push 0x104
mov ecx, ebx
call fcn.00403840
push 0x104
push dword [ebx]
push dword [0x6c7804]
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
mov eax, dword [ebx]
test eax, eax
jne 0x41fc0a
xor ecx, ecx
jmp 0x41fc20
push dword [eax - 8]
push eax
call fcn.005dafda
mov ecx, eax
add esp, 8
test ecx, ecx
js 0x420010
mov eax, dword [ebx]
cmp ecx, dword [eax - 8]
jg 0x420010
mov dword [eax - 0xc], ecx
mov eax, dword [ebx]
mov byte [ecx + eax], 0
call fcn.00485933
mov edi, eax
test edi, edi
je 0x420024
mov eax, dword [edi]
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x613aec]
mov ecx, edi
call esi
lea edi, [eax + 0x10]
mov dword [ebp - 0x24], edi
mov dword [ebp - 4], 1
mov ecx, 1
mov eax, dword [edi - 8]
sub ecx, dword [edi - 4]
sub eax, 0x104
or eax, ecx
jge 0x41fc85
push 0x104
lea ecx, [ebp - 0x24]
call fcn.00403840
mov edi, dword [ebp - 0x24]
push 0x104
push edi
call dword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryA]
test eax, eax
jne 0x41fca1
push 0x104
push edi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push dword [edi - 8]
push edi
call fcn.005dafda
add esp, 8
test eax, eax
js 0x420010
cmp eax, dword [edi - 8]
jg 0x420010
mov dword [edi - 0xc], eax
mov byte [eax + edi], 0
call fcn.00485933
mov ebx, eax
test ebx, ebx
je 0x42002e
mov eax, dword [ebx]
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x613aec]
mov ecx, ebx
call esi
lea esi, [eax + 0x10]
mov dword [ebp - 0x20], esi
mov byte [ebp - 4], 2
mov ecx, 1
mov eax, dword [esi - 8]
sub ecx, dword [esi - 4]
sub eax, 0x104
or eax, ecx
jge 0x41fd13
push 0x104
lea ecx, [ebp - 0x20]
call fcn.00403840
mov esi, dword [ebp - 0x20]
push 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push dword [esi - 8]
push esi
call fcn.005dafda
add esp, 8
test eax, eax
js 0x420010
cmp eax, dword [esi - 8]
jg 0x420010
push edi
mov dword [esi - 0xc], eax
push esi
mov byte [eax + esi], 0
call fcn.005e0a45
add esp, 8
or ebx, 0xffffffff
test eax, eax
je 0x41ffc4
mov eax, dword [ebp + 8]
mov eax, dword [eax]
cmp dword [eax - 0xc], 0
je 0x41fdb3
push 0x5c
push eax
call fcn.005daaeb
mov ecx, eax
add esp, 8
mov eax, dword [ebp + 8]
test ecx, ecx
jne 0x41fd7b
or ecx, ebx
jmp 0x41fd7d
sub ecx, dword [eax]
push ecx
push 0
lea ecx, [ebp - 0x28]
push ecx
mov ecx, eax
call fcn.004031e0
mov byte [ebp - 4], 3
mov ecx, 3
mov eax, dword [eax]
mov dword [ebp - 0x14], ecx
test eax, eax
je 0x420038
push eax
push esi
call fcn.005e343b
add esp, 8
mov byte [ebp - 0xd], 0
test eax, eax
jne 0x41fdb7
mov byte [ebp - 0xd], 1
mov dword [ebp - 4], 2
mov eax, dword [ebp - 0x14]
test al, 2
je 0x41fdf8
mov ecx, dword [ebp - 0x28]
and eax, 0xfffffffd
mov dword [ebp - 0x14], eax
add ecx, 0xfffffff0
mov eax, ebx
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x41fdf8
mov eax, dword [ecx]
mov dword [ebp - 0x1c], eax
push ecx
mov eax, dword [eax]
mov ebx, dword [eax + 4]
mov ecx, ebx
call dword [0x613aec]
mov ecx, dword [ebp - 0x1c]
call ebx
or ebx, 0xffffffff
cmp byte [ebp - 0xd], 0
je 0x41ffc4
call fcn.00485933
mov dword [ebp - 0x28], eax
test eax, eax
je 0x420042
mov eax, dword [eax]
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x613aec]
mov ecx, dword [ebp - 0x28]
call esi
add eax, 0x10
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 4
call fcn.00485933
mov dword [ebp - 0x28], eax
test eax, eax
je 0x42004c
mov eax, dword [eax]
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x613aec]
mov ecx, dword [ebp - 0x28]
call esi
add eax, 0x10
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 5
call fcn.00485933
mov dword [ebp - 0x28], eax
test eax, eax
je 0x420056
mov eax, dword [eax]
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x613aec]
mov ecx, dword [ebp - 0x28]
call esi
add eax, 0x10
mov dword [ebp - 0x28], eax
push 0x271a
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 6
call fcn.004030c0
push 0xe72b
lea ecx, [ebp - 0x18]
call fcn.004030c0
push edi
push dword [ebp - 0x18]
lea eax, [ebp - 0x1c]
push eax
call fcn.00407050
mov esi, dword [ebp - 0x28]
add esp, 0xc
push 0x30
push esi
push dword [ebp - 0x1c]
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [ebp + 8]
push 0
push 0x674642
call fcn.004038a0
mov dword [ebp - 0x14], 0
add esi, 0xfffffff0
mov byte [ebp - 4], 5
mov eax, ebx
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x41ff01
mov ebx, dword [esi]
push esi
mov eax, dword [ebx]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x613aec]
mov ecx, ebx
call esi
or ebx, 0xffffffff
mov byte [ebp - 4], 4
mov eax, ebx
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x41ff2e
mov ebx, dword [ecx]
push ecx
mov eax, dword [ebx]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x613aec]
mov ecx, ebx
call esi
or ebx, 0xffffffff
mov byte [ebp - 4], 2
mov eax, ebx
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x41ff5b
mov ebx, dword [ecx]
push ecx
mov eax, dword [ebx]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x613aec]
mov ecx, ebx
call esi
or ebx, 0xffffffff
mov byte [ebp - 4], 1
mov eax, ebx
mov ecx, dword [ebp - 0x20]
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x41ff88
mov ebx, dword [ecx]
push ecx
mov eax, dword [ebx]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x613aec]
mov ecx, ebx
call esi
or ebx, 0xffffffff
mov byte [ebp - 4], 0
lea eax, [edi - 0x10]
lock xadd dword [eax + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x41ffad
mov edi, dword [eax]
push eax
mov edx, dword [edi]
mov esi, dword [edx + 4]
mov ecx, esi
call dword [0x613aec]
mov ecx, edi
call esi
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov dword [ebp - 0x14], 0
add esi, 0xfffffff0
mov byte [ebp - 4], 1
mov eax, ebx
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x41fff5
mov ebx, dword [esi]
push esi
mov eax, dword [ebx]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x613aec]
mov ecx, ebx
call esi
or ebx, 0xffffffff
mov byte [ebp - 4], 0
lea ecx, [edi - 0x10]
lock xadd dword [ecx + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x41ffad
mov edi, dword [ecx]
push ecx
mov eax, dword [edi]
mov esi, dword [eax + 4]
jmp 0x41ffa1
push 0x80070057
call fcn.00402cb0
push 0x80004005
call fcn.00402cb0
push 0x80004005
call fcn.00402cb0
push 0x80004005
call fcn.00402cb0
push 0x80004005
call fcn.00402cb0
push 0x80004005
call fcn.00402cb0
push 0x80004005
call fcn.00402cb0
push 0x80004005
call fcn.00402cb0
int3