Function at 0x409a1f
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x424
push ebx
push esi
push edi
lea eax, [ebp - 0x424]
xor esi, esi
push 0x208
push eax
mov dword [ebp - 4], esi
mov dword [ebp - 0x10], 0xc
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
cmp dword [ebp + 0xc], esi
mov edi, dword [ebp + 8]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyA]
jne 0x409ad3
lea eax, [ebp - 0x21c]
push esi
push eax
push esi
push esi
push edi
call fcn.00412fa0
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
add esp, 0x14
lea eax, [ebp - 0x424]
push eax
push edi
call ebx
push edi
call fcn.0040a097
pop ecx
lea eax, [ebp - 0x21c]
push eax
push edi
call esi
push dword [ebp - 4]
lea eax, [ebp - 0x1c]
push 0x41caa4
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x1c]
push eax
push edi
call esi
push str..MIF
push edi
call esi
push edi
call fcn.00406412
test eax, eax
pop ecx
je 0x409ad1
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x3e7
jle 0x409a76
jmp 0x409d0a
xor esi, esi
push esi
push 0x80000080
lea eax, [ebp - 0x10]
push 2
push eax
push esi
push 0x40000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x409d0a
push dword [ebp + 0x14]
lea eax, [ebp - 0x11c]
push eax
call ebx
cmp byte [ebp - 0x11c], 0
lea eax, [ebp - 0x11c]
je 0x409b2d
mov cl, byte [eax]
cmp cl, 0xa
je 0x409b1e
cmp cl, 0xd
jne 0x409b21
mov byte [eax], 0x20
push eax
call dword [sym.imp.USER32.dll_CharNextA]
cmp byte [eax], 0
jne 0x409b12
push str.Start_Component_r_n
push esi
call fcn.00409ff2
pop ecx
test eax, eax
pop ecx
je 0x409d03
push str._tName___Workstation__r_n
push esi
call fcn.00409ff2
pop ecx
test eax, eax
pop ecx
je 0x409d03
push str._tStart_Group_r_n
push esi
call fcn.00409ff2
pop ecx
test eax, eax
pop ecx
je 0x409d03
push str._t_tName___InstallStatus__r_n
push esi
call fcn.00409ff2
pop ecx
test eax, eax
pop ecx
je 0x409d03
push str._t_tID__1_r_n
push esi
call fcn.00409ff2
pop ecx
test eax, eax
pop ecx
je 0x409d03
push str._t_tClass___MICROSOFTJOBSTATUS1.0__r_n
push esi
call fcn.00409ff2
pop ecx
test eax, eax
pop ecx
je 0x409d03
push str._t_tStart_Attribute_r_n
push esi
call fcn.00409ff2
pop ecx
test eax, eax
pop ecx
je 0x409d03
push str._t_t_tName___Status__r_n
push esi
call fcn.00409ff2
pop ecx
test eax, eax
pop ecx
je 0x409d03
push str._t_t_tID__1_r_n
push esi
call fcn.00409ff2
pop ecx
test eax, eax
pop ecx
je 0x409d03
push str._t_t_tType__String_16__r_n
push esi
call fcn.00409ff2
pop ecx
test eax, eax
pop ecx
je 0x409d03
mov ebx, str._t_t_tValue_
push ebx
push esi
call fcn.00409ff2
pop ecx
test eax, eax
pop ecx
je 0x409d03
cmp dword [ebp + 0x10], 0
mov eax, str._SUCCESS__r_n
jne 0x409c25
mov eax, str._FAILED__r_n
push eax
push esi
call fcn.00409ff2
pop ecx
test eax, eax
pop ecx
je 0x409d03
mov edi, str._t_tEnd_Attribute_r_n
push edi
push esi
call fcn.00409ff2
pop ecx
test eax, eax
pop ecx
je 0x409d03
push str._t_tStart_Attribute_r_n
push esi
call fcn.00409ff2
pop ecx
test eax, eax
pop ecx
je 0x409d03
push str._t_t_tName___Description__r_n
push esi
call fcn.00409ff2
pop ecx
test eax, eax
pop ecx
je 0x409d03
push str._t_t_tID__2_r_n
push esi
call fcn.00409ff2
pop ecx
test eax, eax
pop ecx
je 0x409d03
push str._t_t_tType__String_256__r_n
push esi
call fcn.00409ff2
pop ecx
test eax, eax
pop ecx
je 0x409d03
push ebx
push esi
call fcn.00409ff2
pop ecx
test eax, eax
pop ecx
je 0x409d03
lea eax, [ebp - 0x11c]
push eax
push esi
call fcn.00409ff2
pop ecx
test eax, eax
pop ecx
je 0x409d03
push 0x41c070
push esi
call fcn.00409ff2
pop ecx
test eax, eax
pop ecx
je 0x409d03
push edi
push esi
call fcn.00409ff2
pop ecx
test eax, eax
pop ecx
je 0x409d03
push str._tEnd_Group_r_n
push esi
call fcn.00409ff2
pop ecx
test eax, eax
pop ecx
je 0x409d03
push str.End_Component_r_n
push esi
call fcn.00409ff2
pop ecx
test eax, eax
pop ecx
je 0x409d03
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x409d0a
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
leave
ret