Function at 0x4149b9
Capabilities:
Get common file path

Disassembly:
push 0x7c
mov eax, 0x46b9c4
call fcn.00444285
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x71]
mov dword [ebp - 0x88], ebx
lea ecx, [ebp - 0x40]
and dword [ebp - 0x78], 0
push 0
push eax
mov dword [ebp - 0x40], 0x481c40
mov dword [ebp - 0x18], 0x481c48
call fcn.00406120
mov dword [ebp - 4], 3
cmp dword [ebp + 0xc], 1
jne 0x414a9b
mov byte [ebp - 4], 4
lea eax, [ebp - 0x40]
mov dword [ebp - 0x84], eax
mov esi, 0x104
xor eax, eax
mov byte [ebp - 0x80], al
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x2c], esi
jae 0x414a28
push eax
push esi
lea ecx, [ebp - 0x3c]
call fcn.0041482d
push 2
pop edi
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x78], edi
mov byte [ebp - 0x80], 1
call fcn.00413f7e
push esi
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov dword [ebp - 0x78], edi
mov esi, eax
and edi, 0xfffffffd
mov dword [ebp - 0x78], edi
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x84]
call fcn.004111ed
test esi, esi
je 0x414bdd
push 0
lea eax, [ebp - 0x71]
mov dword [ebp - 0x70], 0x48e948
push eax
push str.sysnative
lea ecx, [ebp - 0x70]
mov dword [ebp - 0x48], 0x48e950
call fcn.004105ca
mov byte [ebp - 4], 6
lea eax, [ebp - 0x70]
push eax
lea ecx, [ebp - 0x40]
call fcn.00414de9
jmp 0x414b3c
cmp dword [ebp + 0xc], 2
jne 0x414b4a
mov byte [ebp - 4], 8
lea eax, [ebp - 0x40]
mov dword [ebp - 0x84], eax
mov esi, 0x104
xor eax, eax
mov byte [ebp - 0x80], al
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x2c], esi
jae 0x414ace
push eax
push esi
lea ecx, [ebp - 0x3c]
call fcn.0041482d
push 4
pop edi
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x78], edi
mov byte [ebp - 0x80], 1
call fcn.00413f7e
push esi
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov dword [ebp - 0x78], edi
mov esi, eax
and edi, 0xfffffffb
mov dword [ebp - 0x78], edi
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x84]
call fcn.004111ed
test esi, esi
je 0x414bdd
push 0
lea eax, [ebp - 0x71]
mov dword [ebp - 0x70], 0x48e948
push eax
push str.syswow64
lea ecx, [ebp - 0x70]
mov dword [ebp - 0x48], 0x48e950
call fcn.004105ca
mov byte [ebp - 4], 0xa
lea eax, [ebp - 0x70]
push eax
lea ecx, [ebp - 0x40]
call fcn.00414de9
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x70]
call fcn.00404d40
jmp 0x414bac
mov byte [ebp - 4], 0xc
lea eax, [ebp - 0x40]
mov dword [ebp - 0x84], eax
mov esi, 0x104
xor eax, eax
mov byte [ebp - 0x80], al
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x2c], esi
jae 0x414b73
push eax
push esi
lea ecx, [ebp - 0x3c]
call fcn.0041482d
push 8
pop edi
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x78], edi
mov byte [ebp - 0x80], 1
call fcn.00413f7e
push esi
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov dword [ebp - 0x78], edi
mov esi, eax
and edi, 0xfffffff7
mov dword [ebp - 0x78], edi
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x84]
call fcn.004111ed
test esi, esi
je 0x414bdd
push 1
push 0x481c30
lea ecx, [ebp - 0x40]
call fcn.00414d8a
push eax
mov ecx, ebx
call fcn.00414bf4
or edi, 1
mov dword [ebp - 0x78], edi
and dword [ebp - 4], 0
lea ecx, [ebp - 0x40]
call fcn.00404d40
mov eax, ebx
call fcn.00444234
ret
lea ecx, [ebp - 0x5c]
call fcn.00414c84
push 0x496aac
lea eax, [ebp - 0x5c]
push eax
call fcn.00452f38
int3