Function at 0x41afc0
Capabilities:
Get common file path
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x82c
mov eax, dword [0x70e00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x104
xorps xmm0, xmm0
mov byte [ebp - 0x24], 0
lea eax, [ebp - 0x140]
movq qword [ebp - 0x13], xmm0
push 0
push eax
movups xmmword [ebp - 0x34], xmm0
mov dword [ebp - 0xb], 0
movups xmmword [ebp - 0x23], xmm0
mov word [ebp - 7], 0
mov byte [ebp - 5], 0
call fcn.005f46f0
add esp, 0xc
lea eax, [ebp - 0x340]
push 0x200
push 0
push eax
call fcn.005f46f0
add esp, 0xc
mov dword [ebp - 0x618], 0xe
lea eax, [ebp - 0x410]
mov dword [ebp - 0x410], 0x94
push eax
call dword [sym.imp.KERNEL32.DLL_GetVersionExA]
test eax, eax
je 0x41b311
push 0x104
lea eax, [ebp - 0x140]
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryA]
test eax, eax
jne 0x41b07c
mov eax, 0x16
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004aa758
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x140]
push 0x6e9fec
push eax
call fcn.005faab0
mov byte [eax], 0
lea eax, [ebp - 0x140]
push eax
lea eax, [ebp - 0x34]
push str.._s
push eax
call fcn.00417690
mov ebx, dword [sym.imp.KERNEL32.DLL_CreateFileA]
lea eax, [ebp - 0x34]
add esp, 0x14
push 0
push 0x80
push 3
push 0
push 3
push 0xc0000000
push eax
call ebx
mov esi, eax
cmp esi, 0xffffffff
je 0x41b311
mov edi, dword [sym.imp.KERNEL32.DLL_DeviceIoControl]
lea eax, [ebp - 0x61c]
push 0
push eax
push 0x18
lea eax, [ebp - 0x378]
push eax
push 0
push 0
push 0x70000
push esi
call edi
test eax, eax
je 0x41b30a
cmp dword [ebp - 0x364], 0x200
jne 0x41b30a
push 0
lea eax, [ebp - 0x61c]
push eax
push 0x20
lea eax, [ebp - 0x360]
push eax
push 0
push 0
push 0x560000
push esi
call edi
test eax, eax
je 0x41b30a
cmp dword [ebp - 0x360], 0
je 0x41b30a
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push dword [ebp - 0x358]
lea eax, [ebp - 0x24]
push 0x6e9ff8
push eax
call fcn.00417690
add esp, 0xc
lea eax, [ebp - 0x24]
push 0
push 0x80
push 3
push 0
push 3
push 0xc0000000
push eax
call ebx
mov ebx, eax
cmp ebx, 0xffffffff
je 0x41b311
mov esi, dword [sym.imp.KERNEL32.DLL_SetFilePointer]
push 0
push 0
push 0
push ebx
call esi
mov edi, dword [sym.imp.KERNEL32.DLL_ReadFile]
lea eax, [ebp - 0x614]
push 0
push eax
push 0x200
lea eax, [ebp - 0x610]
push eax
push ebx
call edi
test eax, eax
je 0x41b2ec
cmp dword [ebp - 0x614], 0x200
jne 0x41b2ec
mov eax, 0xaa55
cmp word [ebp - 0x412], ax
jne 0x41b2ec
xor eax, eax
lea ecx, [ebp - 0x452]
cmp byte [ecx], 0x80
je 0x41b1f3
inc eax
add ecx, 0x10
cmp eax, 4
jl 0x41b1e0
jmp 0x41b2c4
shl eax, 4
lea ecx, [ebp - 0x44a]
add eax, ecx
mov dword [ebp - 0x620], eax
push 0
push 0
mov eax, dword [eax]
shl eax, 9
push eax
push ebx
call esi
push 0
lea eax, [ebp - 0x614]
push eax
push 0x200
lea eax, [ebp - 0x340]
push eax
push ebx
call edi
test eax, eax
je 0x41b2ec
cmp dword [ebp - 0x614], 0x200
jne 0x41b2ec
mov eax, 0xaa55
lea esi, [ebp - 0x340]
lea edi, [ebp - 0x823]
mov ecx, 0x80
rep movsd dword es:[edi], dword [esi]
cmp word [ebp - 0x142], ax
jne 0x41b2ec
push 4
lea eax, [ebp - 0x820]
push str.NTFS
push eax
call fcn.00619ed0
add esp, 0xc
neg eax
sbb al, al
and byte [ebp - 0x828], al
lea eax, [ebp - 0x820]
push 5
push str.FAT32
push eax
call fcn.00619ed0
movzx ecx, byte [ebp - 0x828]
add esp, 0xc
test eax, eax
mov edx, 1
mov eax, dword [ebp - 0x620]
cmove ecx, edx
mov byte [ebp - 0x828], cl
mov eax, dword [eax]
shl eax, 9
mov dword [ebp - 0x827], eax
mov edx, dword [ebp - 0x358]
lea eax, [ebp - 0x828]
push eax
lea eax, [ebp - 0x610]
mov ecx, ebx
push eax
call fcn.0041a690
add esp, 8
mov dword [ebp - 0x618], 0
push ebx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, dword [ebp - 0x618]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004aa758
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, 0xe
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004aa758
mov esp, ebp
pop ebp
ret