Function at 0x49e6dc
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde8
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x218], eax
mov dword [ebp - 0x214], eax
mov dword [ebp - 0x20c], eax
mov dword [ebp - 0x210], eax
mov dword [ebp - 0x208], eax
mov dword [ebp - 0x204], eax
xor eax, eax
push ebp
push 0x49e9b1
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, 0xff
lea eax, [ebp - 0xff]
lea edx, [ebp - 0x1fe]
mov byte [eax], 0
mov byte [edx], 0
inc edx
inc eax
dec ecx
jne 0x49e72d
xor eax, eax
push ebp
push 0x49e7b4
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xfa
lea eax, [ebp - 0xff]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
push 0xfa
lea eax, [ebp - 0x1fe]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
lea edx, [ebp - 0x204]
lea eax, [ebp - 0xff]
call fcn.0040dbf4
mov edx, dword [ebp - 0x204]
mov eax, 0x549464
call fcn.004050b0
lea edx, [ebp - 0x208]
lea eax, [ebp - 0x1fe]
call fcn.0040dbf4
mov edx, dword [ebp - 0x208]
mov eax, 0x549468
call fcn.004050b0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49e7be
lea edx, [ebp - 0x210]
mov eax, dword [0x5453ac]
mov eax, dword [eax]
call fcn.0046d69c
mov eax, dword [ebp - 0x210]
lea edx, [ebp - 0x20c]
call fcn.0040d860
mov edx, dword [ebp - 0x20c]
mov eax, 0x54939c
call fcn.004050b0
xor eax, eax
push ebp
push 0x49e864
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x472da8]
call fcn.00472ea8
mov ebx, eax
mov edx, 0x80000001
mov eax, ebx
call fcn.00472f48
mov edx, 0x49e9c8
mov eax, ebx
call fcn.004731b0
lea ecx, [ebp - 0x214]
mov edx, 0x49ea14
mov eax, ebx
call fcn.0047360c
mov edx, dword [ebp - 0x214]
mov eax, 0x5493a4
mov ecx, 0x49ea24
call fcn.00405368
mov eax, ebx
call fcn.00472f18
mov eax, ebx
call fcn.004041d0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49e86e
xor eax, eax
push ebp
push 0x49e8e1
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x472da8]
call fcn.00472ea8
mov ebx, eax
mov edx, 0x80000002
mov eax, ebx
call fcn.00472f48
mov edx, 0x49e9c8
mov eax, ebx
call fcn.004731b0
lea ecx, [ebp - 0x218]
mov edx, 0x49ea30
mov eax, ebx
call fcn.0047360c
mov edx, dword [ebp - 0x218]
mov eax, 0x5493a0
mov ecx, 0x49ea24
call fcn.00405368
mov eax, ebx
call fcn.00472f18
mov eax, ebx
call fcn.004041d0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49e8eb
mov eax, dword [0x5493a0]
mov edx, 0x49ea24
call fcn.00405468
jne 0x49e919
mov eax, 0x49ea48
call fcn.0040d6a0
test al, al
je 0x49e919
mov eax, 0x5493a0
mov edx, 0x49ea60
call fcn.004050b0
mov eax, dword [0x5493a0]
mov edx, 0x49ea24
call fcn.00405468
jne 0x49e947
mov eax, 0x49ea78
call fcn.0040d6a0
test al, al
je 0x49e947
mov eax, 0x5493a0
mov edx, 0x49ea90
call fcn.004050b0
mov eax, dword [0x5493a0]
mov edx, 0x49ea24
call fcn.00405468
jne 0x49e968
mov eax, 0x5493a0
mov edx, dword [0x5493a4]
call fcn.004050b0
cmp dword [0x5493b0], 6
jb 0x49e983
mov eax, 0x5493a8
mov edx, dword [0x5493a0]
call fcn.004050b0
jmp 0x49e993
mov eax, 0x5493a8
mov edx, dword [0x54939c]
call fcn.004050b0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49e9b8
lea eax, [ebp - 0x218]
mov edx, 6
call fcn.00405080
ret