Function at 0x49d980
Capabilities:
Get common file path

Disassembly:
sub esp, 0x190
mov dword [esp], ecx
push ebx
lea eax, [esp + 8]
push esi
push edi
mov esi, edx
push ebp
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
jne 0x49d9b1
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x190
ret
push 0x104
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc_1]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock_1]
mov edi, eax
test edi, edi
jne 0x49d9d8
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x190
ret
mov eax, dword [esp + 0x10]
push 0
push eax
call dword [sym.imp.KERNEL32.dll__lopen]
mov ebx, eax
lea eax, [esp + 0x14]
push eax
mov ebp, dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
lea eax, [esp + 0x18]
push 0x1a3
push 0x4a12f8
push eax
call ebp
lea ecx, [esp + 0x14]
push 0
push ecx
call dword [sym.imp.KERNEL32.dll__lcreat]
cmp eax, 0xffffffff
mov ebp, eax
jne 0x49da45
push edi
mov ebp, dword [sym.imp.KERNEL32.dll_GlobalHandle_1]
call ebp
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock_1]
push edi
call ebp
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree_1]
push ebx
call dword [sym.imp.KERNEL32.dll__lclose]
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x190
ret
lea eax, [esi - 0x104]
test eax, eax
jle 0x49da79
push 0x104
sub esi, 0x104
push edi
push ebx
call dword [sym.imp.KERNEL32.dll__lread]
push 0x104
push edi
push ebp
call dword [sym.imp.KERNEL32.dll__lwrite]
lea eax, [esi - 0x104]
test eax, eax
jg 0x49da4f
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll__lread]
push esi
push edi
push ebp
call dword [sym.imp.KERNEL32.dll__lwrite]
push ebx
call dword [sym.imp.KERNEL32.dll__lclose]
push ebp
call dword [sym.imp.KERNEL32.dll__lclose]
lea eax, [esp + 0x118]
push 0x200
mov ecx, dword [esp + 0x14]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_OpenFile]
lea ecx, [esp + 0x14]
push 0
push ecx
call dword [sym.imp.KERNEL32.dll__lopen]
mov esi, eax
push 6
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll__lcreat]
cmp eax, 0xffffffff
mov ebx, eax
jne 0x49db02
push edi
mov ebp, dword [sym.imp.KERNEL32.dll_GlobalHandle_1]
call ebp
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock_1]
push edi
call ebp
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree_1]
push esi
call dword [sym.imp.KERNEL32.dll__lclose]
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x190
ret
push 0x104
push edi
push esi
call dword [sym.imp.KERNEL32.dll__lread]
cmp eax, 0x104
jne 0x49db37
push 0x104
push edi
push ebx
call dword [sym.imp.KERNEL32.dll__lwrite]
push 0x104
push edi
push esi
call dword [sym.imp.KERNEL32.dll__lread]
cmp eax, 0x104
je 0x49db16
push eax
push edi
push ebx
call dword [sym.imp.KERNEL32.dll__lwrite]
push edi
mov ebp, dword [sym.imp.KERNEL32.dll_GlobalHandle_1]
call ebp
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock_1]
push edi
call ebp
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree_1]
push ebx
call dword [sym.imp.KERNEL32.dll__lclose]
push esi
call dword [sym.imp.KERNEL32.dll__lclose]
lea eax, [esp + 0x118]
push 0x200
lea ecx, [esp + 0x18]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_OpenFile]
mov eax, 1
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x190
ret