Function at 0x40b8cd
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe78
mov eax, dword [0x451220]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor edi, edi
mov esi, 0x804
push esi
lea eax, [ebp - 0xe78]
push edi
push eax
mov dword [ebp - 0x624], 1
mov dword [ebp - 0x628], edi
mov dword [ebp - 0x638], edi
call fcn.00429ac0
add esp, 0xc
cmp dword [ebx + 4], 2
mov dword [ebp - 0xe78], esi
jne 0x40b929
call fcn.0040be92
test eax, eax
je 0x40bd1b
push edi
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [ebx + 0xc], eax
cmp eax, edi
je 0x40bd20
xor eax, eax
push 0x206
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push edi
push eax
call fcn.00429ac0
add esp, 0xc
mov esi, 0x104
push esi
lea eax, [ebp - 0x210]
push eax
push dword [0x455244]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push str...cloudsec3.dll
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea ecx, [ebp - 0x210]
call fcn.004114e9
cmp eax, edi
je 0x40ba12
push str.DSEngLib_Init
push eax
mov dword [ebp - 0x638], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, edi
je 0x40bd1b
lea ecx, [ebp - 0xe78]
push ecx
call eax
test eax, eax
je 0x40bd1b
mov eax, dword [ebp - 0xe3c]
mov dword [ebx + 0x14], eax
cmp eax, edi
je 0x40bd1b
push dword [ebx + 4]
mov dword [ebp - 0x650], 0x14
call fcn.00413ab4
mov eax, dword [ebx + 4]
pop ecx
cmp eax, 2
jne 0x40ba2c
mov dword [ebp - 0x64c], 3
mov dword [ebp - 0x648], 0x1f45
mov dword [ebp - 0x644], edi
mov dword [ebp - 0x640], edi
jmp 0x40bb79
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x210]
push eax
call fcn.00413ab4
pop ecx
pop ecx
jmp 0x40bd20
cmp eax, 1
jne 0x40bd1b
xor eax, eax
push 0x206
mov word [ebp - 0x620], ax
lea eax, [ebp - 0x61e]
push edi
push eax
call fcn.00429ac0
add esp, 0xc
push esi
lea eax, [ebp - 0x620]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x40bd20
mov eax, dword [0x453c6c]
mov ecx, 0x453c6c
call dword [eax + 0xc]
add eax, 0x10
lea esi, [ebp - 0x668]
mov dword [ebp - 0x62c], eax
call fcn.00404d28
mov eax, esi
push 0x2a
push eax
mov eax, dword [ebx]
call fcn.00407569
mov eax, dword [ebp - 0x658]
sub eax, dword [ebp - 0x65c]
pop ecx
sar eax, 2
pop ecx
cmp eax, edi
jne 0x40bad5
mov dword [ebp - 0x624], edi
call fcn.00404eaa
push dword [ebp - 0x668]
call fcn.0042751c
mov eax, dword [ebp - 0x62c]
pop ecx
add eax, 0xfffffff0
call fcn.00406e8b
jmp 0x40bd26
jbe 0x40bb14
lea esi, [ebp - 0x668]
call fcn.0040cc70
push dword [eax]
lea eax, [ebp - 0x620]
push eax
push str._s_s__2
lea ecx, [ebp - 0x62c]
call fcn.0040c0df
mov eax, dword [ebp - 0x658]
sub eax, dword [ebp - 0x65c]
add esp, 0xc
inc edi
sar eax, 2
cmp edi, eax
jb 0x40bad7
xor edi, edi
mov eax, dword [ebp - 0x62c]
mov dword [ebp - 0x64c], 4
mov dword [ebp - 0x648], 0x1f43
mov ecx, dword [eax - 0xc]
lea ecx, [ecx + ecx + 2]
push eax
mov dword [ebp - 0x644], ecx
call fcn.00429165
pop ecx
push eax
mov dword [ebp - 0x640], eax
call fcn.00413ab4
pop ecx
lea esi, [ebp - 0x668]
call fcn.00404eaa
push dword [ebp - 0x668]
call fcn.0042751c
mov eax, dword [ebp - 0x62c]
pop ecx
add eax, 0xfffffff0
call fcn.00406e8b
mov esi, 0x104
lea eax, [ebp - 0x650]
mov dword [ebp - 0x63c], eax
cmp dword [ebp - 0xe68], edi
je 0x40bd1b
lea eax, [ebp - 0x628]
push eax
call dword [ebp - 0xe68]
mov ecx, dword [ebp - 0x628]
cmp ecx, edi
jne 0x40bbb3
push eax
call fcn.00413ab4
jmp 0x40ba26
push 0x208
lea eax, [ebp - 0x418]
push edi
push eax
mov dword [ebx + 0x10], ecx
mov dword [ebp - 0x670], 8
call fcn.00429ac0
add esp, 0xc
push esi
lea eax, [ebp - 0x418]
push eax
push dword [0x455244]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push str...csp.dat
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x418]
mov dword [ebp - 0x66c], eax
cmp dword [ebp - 0xe64], edi
je 0x40bd1b
lea eax, [ebp - 0x670]
push eax
push dword [ebp - 0x628]
call dword [ebp - 0xe64]
test eax, eax
jne 0x40bd1b
mov eax, dword [ebp - 0xe54]
mov dword [ebp - 0x630], eax
cmp eax, edi
je 0x40bd1b
push str.360safe
push str.360.product
push dword [ebp - 0x628]
call eax
push str.newspy_killer
push str.360.combo
push dword [ebp - 0x628]
call dword [ebp - 0x630]
cmp dword [ebx + 4], 2
jne 0x40bcbd
mov eax, dword [0x453c6c]
mov ecx, 0x453c6c
call dword [eax + 0xc]
push dword [ebx + 8]
add eax, 0x10
mov dword [ebp - 0x62c], eax
lea eax, [ebp - 0x62c]
push 0x448550
push eax
call fcn.0040678c
mov esi, dword [ebp - 0x62c]
add esp, 0xc
push esi
push str.ps.scansoftid
push dword [ebp - 0x628]
call dword [ebp - 0x630]
lea eax, [esi - 0x10]
call fcn.00406e8b
cmp dword [ebp - 0xe58], edi
je 0x40bd1b
push ebx
push 0x40be77
push dword [ebp - 0x628]
call dword [ebp - 0xe58]
call fcn.00413ab4
cmp dword [ebp - 0xe4c], edi
je 0x40bd20
push 1
lea eax, [ebp - 0x63c]
push eax
push dword [ebp - 0x628]
call dword [ebp - 0xe4c]
call fcn.00413ab4
push 0xffffffffffffffff
push dword [ebx + 0xc]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call fcn.00413ab4
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x40bd26
call fcn.00413ab4
mov dword [ebp - 0x624], edi
cmp dword [ebp - 0xe5c], edi
je 0x40bd48
cmp dword [ebp - 0x628], edi
je 0x40bd48
push dword [ebp - 0x628]
call dword [ebp - 0xe5c]
mov dword [ebp - 0x628], edi
cmp dword [ebp - 0x638], edi
je 0x40bd5c
push dword [ebp - 0x638]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x624]
pop edi
xor ecx, ebp
pop esi
call fcn.00427527
leave
ret