Function at 0x44ddd0
Capabilities:
Get common file path
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x555f68
mov eax, dword fs:[0]
push eax
sub esp, 0x44
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5b3890]
xor eax, esp
push eax
lea eax, [esp + 0x58]
mov dword fs:[0], eax
mov esi, ecx
mov ebp, dword [esp + 0x68]
push 0x104
mov ecx, ebp
call fcn.0049f100
cmp esi, 0x7c1e
jne 0x44de2f
mov edi, ebp
call fcn.0044c9a0
mov eax, dword [ebp + 4]
mov ecx, dword [esp + 0x58]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x50
ret
cmp esi, 0x7c01
jne 0x44de63
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 4]
mov edx, dword [esp + 0x6c]
push eax
push ecx
push edx
call fcn.0040da20
mov eax, dword [ebp + 4]
add esp, 0xc
mov ecx, dword [esp + 0x58]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x50
ret
push 0
push esi
call fcn.00408870
add esp, 8
test al, al
je 0x44dec6
mov edi, dword [esp + 0x6c]
push 0
push edi
call fcn.0040a450
add esp, 8
cmp eax, 0xffffffff
je 0x44de9f
lea ecx, [esp + 0x17]
push ecx
push ebp
push esi
push eax
push edi
call fcn.0040b5b0
add esp, 0x14
test al, al
jne 0x44de18
mov edx, dword [0x5b117c]
push 0xffffffffffffffff
push edx
mov ecx, ebp
call fcn.00406a80
mov eax, dword [ebp + 4]
mov ecx, dword [esp + 0x58]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x50
ret
xor eax, eax
mov ecx, esi
call fcn.0044b040
test al, al
je 0x44df16
mov edi, dword [ebp + 4]
mov eax, dword [esp + 0x6c]
push esi
mov esi, dword [ebp + 0xc]
or ebx, 0xffffffff
call fcn.0044b060
add esp, 4
test al, al
jne 0x44de18
mov eax, dword [0x5b117c]
push ebx
push eax
mov ecx, ebp
call fcn.00406a80
mov eax, dword [ebp + 4]
mov ecx, dword [esp + 0x58]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x50
ret
push 0x104
lea ecx, [esp + 0x1c]
call fcn.0049f020
mov dword [esp + 0x18], vtable.cWCStr.0
push 0
mov ecx, ebp
mov dword [esp + 0x64], 0
call fcn.0049f100
cmp esi, 0x7c14
jg 0x44e0b3
je 0x44e05a
cmp esi, 0xa
je 0x44df99
cmp esi, 0x7c12
jne 0x44e0bf
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 4]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov ecx, dword [ebp + 4]
mov edx, str.hiberfil.sys
add ecx, 6
lea esp, [esp]
movzx eax, word [edx]
mov word [ecx], ax
add edx, 2
add ecx, 2
test ax, ax
jne 0x44df80
mov ebp, dword [ebp + 4]
jmp 0x44e30f
push 0
push 0
push 0
push 0
push 0
lea ecx, [esp + 0x4c]
call fcn.00405970
mov eax, dword [esp + 0x6c]
push 0
push 0
push eax
lea ecx, [esp + 0x44]
mov ebx, 1
push ecx
mov byte [esp + 0x70], bl
call fcn.00457f30
xor esi, esi
add esp, 0x10
cmp dword [esp + 0x40], esi
mov edi, vtable.cWCS.0
jle 0x44e040
push 0xffffffffffffffff
push 0
lea ecx, [esp + 0x30]
call fcn.0049eff0
mov dword [esp + 0x28], vtable.cWCStr.0
mov edx, dword [esp + 0x3c]
mov eax, dword [edx + esi*4]
push 0
push 0xffffffffffffffff
push 0
push eax
lea ecx, [esp + 0x38]
push ecx
mov byte [esp + 0x74], 2
call fcn.00455cf0
lea edx, [esp + 0x3c]
push 0
push edx
call fcn.00431550
mov eax, dword [esp + 0x48]
add esp, 0x1c
push 0xffffffffffffffff
push eax
mov ecx, ebp
call fcn.0049eeb0
lea ecx, [esp + 0x28]
mov byte [esp + 0x60], bl
mov dword [esp + 0x28], edi
call fcn.0049ee80
add esi, ebx
cmp esi, dword [esp + 0x40]
jl 0x44dfd8
mov ebp, dword [ebp + 4]
lea ecx, [esp + 0x38]
mov byte [esp + 0x60], 0
call fcn.00405a00
mov dword [esp + 0x18], edi
jmp 0x44e317
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x24]
push 0
push ecx
push edx
call fcn.004a41c0
mov eax, dword [esp + 0x28]
push 1
push 0
push 0x56d7b8
push eax
push ebp
call fcn.00431c60
add esp, 0x20
lea ecx, [esp + 0x18]
mov esi, eax
mov dword [esp + 0x60], 0xffffffff
mov dword [esp + 0x18], vtable.cWCS.0
call fcn.0049ee80
mov eax, esi
mov ecx, dword [esp + 0x58]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x50
ret
cmp esi, 0x7c15
je 0x44e28b
cmp esi, 0x3d
ja 0x44e0ed
movzx ecx, byte [0x5b76f8]
mov edx, dword [ebp + 4]
mov eax, dword [0x5b9f2c]
push ecx
push esi
push edx
push eax
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x44e273
mov ebp, dword [ebp + 4]
jmp 0x44e30f
cmp esi, 0x7c16
jne 0x44e13c
movzx ecx, byte [0x5b76f8]
mov edx, dword [esp + 0x1c]
mov eax, dword [0x5b9f2c]
push ecx
push 0x28
push edx
push eax
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x44e273
mov ecx, dword [esp + 0x1c]
push 0xffffffffffffffff
push ecx
mov ecx, ebp
call fcn.00406a80
push 0xffffffffffffffff
push str.Application_Data
mov ecx, ebp
call fcn.0049eeb0
mov ebp, dword [ebp + 4]
jmp 0x44e30f
cmp esi, 0x7c1c
jne 0x44e1e8
movzx edx, byte [0x5b76f8]
mov eax, dword [esp + 0x1c]
mov ecx, dword [0x5b9f2c]
push edx
push 0x1a
push eax
push ecx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x44e273
push 0xffffffffffffffff
push 0
lea ecx, [esp + 0x30]
call fcn.00401040
mov edx, dword [esp + 0x1c]
push 1
push 0
push 0x56d7b8
push edx
push str._sMicrosoftCredentials
push eax
mov byte [esp + 0x78], 4
call fcn.00403e80
add esp, 0xc
push eax
push ebp
call fcn.00431c60
mov edi, vtable.cWCS.0
add esp, 0x14
lea ecx, [esp + 0x28]
mov esi, eax
mov byte [esp + 0x60], 0
mov dword [esp + 0x28], edi
call fcn.0049ee80
lea ecx, [esp + 0x18]
mov dword [esp + 0x60], 0xffffffff
mov dword [esp + 0x18], edi
call fcn.0049ee80
mov eax, esi
mov ecx, dword [esp + 0x58]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x50
ret
cmp esi, 0x7c1d
jne 0x44e258
movzx eax, byte [0x5b76f8]
mov ecx, dword [esp + 0x1c]
mov edx, dword [0x5b9f2c]
push eax
push 8
push ecx
push edx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x44e273
mov eax, dword [esp + 0x1c]
push 1
push 0
push str.AutomaticDestinations_nCustomDestinations
push eax
push ebp
call fcn.00431c60
add esp, 0x14
lea ecx, [esp + 0x18]
mov esi, eax
mov dword [esp + 0x60], 0xffffffff
mov dword [esp + 0x18], vtable.cWCS.0
call fcn.0049ee80
mov eax, esi
mov ecx, dword [esp + 0x58]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x50
ret
cmp esi, 0x7c1b
jne 0x44e273
push 0
push ebp
call fcn.004b7180
add esp, 8
test eax, eax
jne 0x44df91
mov ecx, dword [0x5b117c]
push 0xffffffffffffffff
push ecx
mov ecx, ebp
call fcn.00406a80
mov ebp, dword [ebp + 4]
jmp 0x44e30f
push 0
push 0
push 0
push 0
push 0
lea ecx, [esp + 0x4c]
call fcn.00405970
mov edx, dword [esp + 0x6c]
push 0
push 0
push edx
lea eax, [esp + 0x44]
push eax
mov byte [esp + 0x70], 3
call fcn.00457ec0
xor esi, esi
add esp, 0x10
cmp dword [esp + 0x40], esi
jle 0x44e2fe
lea ebx, [esi + 1]
mov ecx, dword [esp + 0x3c]
mov edx, dword [ecx + esi*4]
push 0
push 0xffffffffffffffff
push 0
push edx
lea eax, [esp + 0x28]
push eax
call fcn.00455cf0
lea ecx, [esp + 0x2c]
push 0
push ecx
call fcn.00431550
mov edx, dword [esp + 0x38]
push edx
push ebp
call fcn.00408140
add esi, ebx
add esp, 0x24
cmp esi, dword [esp + 0x40]
jl 0x44e2c4
mov ebp, dword [ebp + 4]
lea ecx, [esp + 0x38]
mov byte [esp + 0x60], 0
call fcn.00405a00
mov dword [esp + 0x18], vtable.cWCS.0
lea ecx, [esp + 0x18]
mov dword [esp + 0x60], 0xffffffff
call fcn.0049ee80
mov eax, ebp
mov ecx, dword [esp + 0x58]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x50
ret