Function at 0x4b6860
Capabilities:
Get common file path

Disassembly:
sub esp, 0x110
mov eax, dword [0x54d154]
xor eax, esp
mov dword [esp + 0x10c], eax
mov ecx, 0x104
mov eax, esi
jmp 0x4b6880
cmp byte [eax], 0
je 0x4b688f
add eax, 1
sub ecx, 1
jne 0x4b6880
jmp 0x4b68ae
test ecx, ecx
je 0x4b68ae
mov eax, 0x104
sub eax, ecx
mov ecx, 0x104
sub ecx, eax
lea edx, [esi + eax]
mov eax, 0x52905c
call fcn.00410160
push str._NT_SYMBOL_PATH
lea eax, [esp + 8]
push eax
lea ecx, [esp + 8]
push ecx
call fcn.004e5b5f
add esp, 0xc
test eax, eax
je 0x4b6931
mov ecx, 0x104
mov eax, esi
cmp byte [eax], 0
je 0x4b68df
add eax, 1
sub ecx, 1
jne 0x4b68d0
jmp 0x4b68fe
test ecx, ecx
je 0x4b68fe
mov eax, 0x104
sub eax, ecx
mov ecx, 0x104
sub ecx, eax
lea edx, [esi + eax]
mov eax, 0x529070
call fcn.00410160
mov ecx, 0x104
mov eax, esi
cmp byte [eax], 0
je 0x4b6914
add eax, 1
sub ecx, 1
jne 0x4b6905
jmp 0x4b6931
test ecx, ecx
je 0x4b6931
mov eax, 0x104
sub eax, ecx
mov ecx, 0x104
sub ecx, eax
lea edx, [esi + eax]
mov eax, dword [esp]
call fcn.00410160
push str._NT_ALT_SYMBOL_PATH
lea edx, [esp + 8]
push edx
lea eax, [esp + 8]
push eax
call fcn.004e5b5f
add esp, 0xc
test eax, eax
je 0x4b69b4
mov ecx, 0x104
mov eax, esi
cmp byte [eax], 0
je 0x4b6962
add eax, 1
sub ecx, 1
jne 0x4b6953
jmp 0x4b6981
test ecx, ecx
je 0x4b6981
mov eax, 0x104
sub eax, ecx
mov ecx, 0x104
sub ecx, eax
lea edx, [eax + esi]
mov eax, 0x529070
call fcn.00410160
mov ecx, 0x104
mov eax, esi
cmp byte [eax], 0
je 0x4b6997
add eax, 1
sub ecx, 1
jne 0x4b6988
jmp 0x4b69b4
test ecx, ecx
je 0x4b69b4
mov eax, 0x104
sub eax, ecx
mov ecx, 0x104
sub ecx, eax
lea edx, [eax + esi]
mov eax, dword [esp]
call fcn.00410160
push str.SYSTEMROOT
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 8]
push edx
call fcn.004e5b5f
add esp, 0xc
test eax, eax
je 0x4b6af8
mov ecx, 0x104
mov eax, esi
lea ebx, [ebx]
cmp byte [eax], 0
je 0x4b69ef
add eax, 1
sub ecx, 1
jne 0x4b69e0
jmp 0x4b6a0e
test ecx, ecx
je 0x4b6a0e
mov eax, 0x104
sub eax, ecx
mov ecx, 0x104
sub ecx, eax
lea edx, [eax + esi]
mov eax, 0x529070
call fcn.00410160
mov ecx, 0x104
mov eax, esi
cmp byte [eax], 0
je 0x4b6a24
add eax, 1
sub ecx, 1
jne 0x4b6a15
jmp 0x4b6a41
test ecx, ecx
je 0x4b6a41
mov eax, 0x104
sub eax, ecx
mov ecx, 0x104
sub ecx, eax
lea edx, [eax + esi]
mov eax, dword [esp]
call fcn.00410160
mov ecx, 0x104
mov eax, esi
cmp byte [eax], 0
je 0x4b6a57
add eax, 1
sub ecx, 1
jne 0x4b6a48
jmp 0x4b6a76
test ecx, ecx
je 0x4b6a76
mov eax, 0x104
sub eax, ecx
mov ecx, 0x104
sub ecx, eax
lea edx, [eax + esi]
mov eax, 0x529070
call fcn.00410160
mov ecx, 0x104
mov eax, esi
lea ecx, [ecx]
cmp byte [eax], 0
je 0x4b6a8f
add eax, 1
sub ecx, 1
jne 0x4b6a80
jmp 0x4b6aac
test ecx, ecx
je 0x4b6aac
mov eax, 0x104
sub eax, ecx
mov ecx, 0x104
sub ecx, eax
lea edx, [eax + esi]
mov eax, dword [esp]
call fcn.00410160
mov ecx, 0x104
mov eax, esi
cmp byte [eax], 0
je 0x4b6ad5
add eax, 1
sub ecx, 1
jne 0x4b6ab3
mov ecx, dword [esp + 0x10c]
xor ecx, esp
call fcn.004e3834
add esp, 0x110
ret
test ecx, ecx
je 0x4b6c35
mov eax, 0x104
sub eax, ecx
mov ecx, 0x104
sub ecx, eax
lea edx, [eax + esi]
mov eax, str.System32
jmp 0x4b6c30
push 0x103
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x4b6c35
mov ecx, 0x104
mov eax, esi
cmp byte [eax], 0
je 0x4b6b26
add eax, 1
sub ecx, 1
jne 0x4b6b17
jmp 0x4b6b45
test ecx, ecx
je 0x4b6b45
mov eax, 0x104
sub eax, ecx
mov ecx, 0x104
sub ecx, eax
lea edx, [eax + esi]
mov eax, 0x529070
call fcn.00410160
mov ecx, 0x104
mov eax, esi
lea esp, [esp]
cmp byte [eax], 0
je 0x4b6b5f
add eax, 1
sub ecx, 1
jne 0x4b6b50
jmp 0x4b6b7d
test ecx, ecx
je 0x4b6b7d
mov eax, 0x104
sub eax, ecx
mov ecx, 0x104
sub ecx, eax
lea edx, [eax + esi]
lea eax, [esp + 8]
call fcn.00410160
mov ecx, 0x104
mov eax, esi
cmp byte [eax], 0
je 0x4b6b93
add eax, 1
sub ecx, 1
jne 0x4b6b84
jmp 0x4b6bb2
test ecx, ecx
je 0x4b6bb2
mov eax, 0x104
sub eax, ecx
mov ecx, 0x104
sub ecx, eax
lea edx, [eax + esi]
mov eax, 0x529070
call fcn.00410160
mov ecx, 0x104
mov eax, esi
lea esp, [esp]
cmp byte [eax], 0
je 0x4b6bcf
add eax, 1
sub ecx, 1
jne 0x4b6bc0
jmp 0x4b6bed
test ecx, ecx
je 0x4b6bed
mov eax, 0x104
sub eax, ecx
mov ecx, 0x104
sub ecx, eax
lea edx, [eax + esi]
lea eax, [esp + 8]
call fcn.00410160
mov ecx, 0x104
mov eax, esi
cmp byte [eax], 0
je 0x4b6c16
add eax, 1
sub ecx, 1
jne 0x4b6bf4
mov ecx, dword [esp + 0x10c]
xor ecx, esp
call fcn.004e3834
add esp, 0x110
ret
test ecx, ecx
je 0x4b6c35
mov eax, 0x104
sub eax, ecx
mov ecx, 0x104
sub ecx, eax
lea edx, [eax + esi]
mov eax, str.System
call fcn.00410160
mov ecx, dword [esp + 0x10c]
xor ecx, esp
call fcn.004e3834
add esp, 0x110
ret