Function at 0x43d440
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x61c]
sub esp, 0x61c
push 0xffffffffffffffff
push 0x4752c0
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x48a2c4]
xor eax, ebp
mov dword [ebp + 0x618], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x206
mov dword [ebp - 0x18], ecx
xor esi, esi
lea ecx, [ebp + 2]
xor eax, eax
push esi
push ecx
mov word [ebp], ax
call fcn.004471a0
add esp, 0xc
push 0x104
lea edx, [ebp]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push str.Protectionlist.dat
lea ecx, [ebp]
push ecx
mov edx, ecx
push edx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea ecx, [ebp - 0x34]
call fcn.004378e0
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp]
push ecx
mov dword [ebp - 4], esi
call fcn.00443020
add esp, 8
test eax, eax
jne 0x43d50d
mov eax, dword [ebp - 0x28]
cmp eax, esi
je 0x43d4f1
push eax
call fcn.0044714c
add esp, 4
mov edx, dword [ebp - 0x34]
push edx
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], esi
call fcn.0044714c
add esp, 4
xor eax, eax
jmp 0x43d8a7
push 0x206
lea ecx, [ebp + 0x20a]
xor eax, eax
push esi
push ecx
mov word [ebp + 0x208], ax
call fcn.004471a0
add esp, 0xc
push 0x104
lea edx, [ebp + 0x208]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test byte [ebp - 0x38], 1
je 0x43d6ec
mov ecx, dword [ebp - 0x24]
sub ecx, dword [ebp - 0x28]
mov eax, 0x3e0f83e1
imul ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
xor edi, edi
add eax, edx
je 0x43d6ec
mov dword [ebp - 0x1c], esi
cmp edi, eax
jb 0x43d572
call fcn.00448cbe
mov eax, dword [ebp - 0x28]
test byte [esi + eax], 2
je 0x43d6c3
lea ecx, [ebp + 0x208]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x43d6c3
mov edx, dword [0x488014]
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], 1
xor eax, eax
push 0x206
push eax
lea ecx, [ebp + 0x412]
push ecx
mov byte [ebp - 4], 1
mov word [ebp + 0x410], ax
call fcn.004471a0
lea edx, [ebp + 0x208]
push edx
push 0x478d48
lea eax, [ebp + 0x410]
push 0x104
push eax
call fcn.0040c600
mov ecx, dword [ebp - 0x24]
sub ecx, dword [ebp - 0x28]
mov eax, 0x3e0f83e1
imul ecx
sar edx, 6
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
add esp, 0x1c
cmp edi, ecx
jb 0x43d603
call fcn.00448cbe
mov edx, dword [ebp - 0x28]
lea ebx, [esi + edx + 4]
test ebx, ebx
jne 0x43d612
xor eax, eax
jmp 0x43d63f
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
inc esi
cmp esi, 0x3fffffff
jle 0x43d628
xor eax, eax
jmp 0x43d63c
lea eax, [esi + esi]
call fcn.00449e30
mov eax, esp
push 3
push esi
push ebx
push eax
call fcn.0042e110
mov esi, dword [ebp - 0x1c]
push eax
lea eax, [ebp + 0x410]
push eax
mov ecx, eax
push ecx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea edx, [ebp + 0x410]
push edx
lea ecx, [ebp - 0x14]
call fcn.00414ae0
mov ecx, dword [ebp - 0x24]
sub ecx, dword [ebp - 0x28]
mov eax, 0x3e0f83e1
imul ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp edi, eax
jb 0x43d67f
call fcn.00448cbe
mov ecx, dword [ebp - 0x28]
mov edx, dword [esi + ecx]
mov ecx, dword [ebp - 0x18]
lea eax, [ebp - 0x14]
push eax
add ecx, 0x434
mov dword [ebp - 0x10], edx
call fcn.0043d050
mov eax, dword [ebp - 0x14]
lea ecx, [eax - 0xc]
mov byte [ebp - 4], 0
cmp ecx, dword [0x488010]
je 0x43d6c3
lea ebx, [eax - 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x43d6c3
push ebx
call fcn.00448106
add esp, 4
mov ecx, dword [ebp - 0x24]
sub ecx, dword [ebp - 0x28]
mov eax, 0x3e0f83e1
imul ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
inc edi
add esi, 0x108
add eax, edx
mov dword [ebp - 0x1c], esi
cmp edi, eax
jb 0x43d572
test byte [ebp - 0x38], 2
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpynW]
mov esi, 8
je 0x43d7bb
lea edx, [ebp + 0x208]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x43d7bb
mov eax, dword [0x488014]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 1
xor ecx, ecx
push 0x206
push ecx
lea edx, [ebp + 0x412]
push edx
mov byte [ebp - 4], 2
mov word [ebp + 0x410], cx
call fcn.004471a0
add esp, 0xc
push 3
lea eax, [ebp + 0x208]
push eax
lea ecx, [ebp + 0x410]
push ecx
call edi
push str.hiberfil.sys
lea edx, [ebp + 0x410]
push edx
mov eax, edx
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea ecx, [ebp + 0x410]
push ecx
lea ecx, [ebp - 0x14]
call fcn.00414ae0
mov ecx, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
push edx
add ecx, 0x434
mov dword [ebp - 0x10], esi
call fcn.0043d050
mov eax, dword [ebp - 0x14]
lea ecx, [eax - 0xc]
mov byte [ebp - 4], 0
cmp ecx, dword [0x488010]
je 0x43d7bb
lea ebx, [eax - 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x43d7bb
push ebx
call fcn.00448106
add esp, 4
test byte [ebp - 0x38], 4
je 0x43d87b
lea edx, [ebp + 0x208]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x43d87b
mov eax, dword [0x488014]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 1
xor ecx, ecx
push 0x206
push ecx
lea edx, [ebp + 0x412]
push edx
mov byte [ebp - 4], 3
mov word [ebp + 0x410], cx
call fcn.004471a0
add esp, 0xc
push 3
lea eax, [ebp + 0x208]
push eax
lea ecx, [ebp + 0x410]
push ecx
call edi
push str.pagefile.sys
lea edx, [ebp + 0x410]
push edx
mov eax, edx
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea ecx, [ebp + 0x410]
push ecx
lea ecx, [ebp - 0x14]
call fcn.00414ae0
mov ecx, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
push edx
add ecx, 0x434
mov dword [ebp - 0x10], esi
call fcn.0043d050
mov eax, dword [ebp - 0x14]
lea ecx, [eax - 0xc]
cmp ecx, dword [0x488010]
je 0x43d87b
lea edi, [eax - 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x43d87b
push edi
call fcn.00448106
add esp, 4
mov eax, dword [ebp - 0x28]
xor esi, esi
cmp eax, esi
je 0x43d88d
push eax
call fcn.0044714c
add esp, 4
mov edx, dword [ebp - 0x34]
push edx
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], esi
call fcn.0044714c
add esp, 4
mov eax, 1
lea esp, [ebp - 0x48]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x618]
xor ecx, ebp
call fcn.00447157
add ebp, 0x61c
mov esp, ebp
pop ebp
ret 4