Function at 0x4019c0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x804
mov eax, dword [0x4c9070]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x400
lea eax, [ebp - 0x404]
push 0
push eax
call fcn.0046ea70
mov eax, dword fs:[0x2c]
add esp, 0xc
mov ecx, dword [eax]
mov eax, dword [0x4d67a8]
cmp eax, dword [ecx + 4]
jle 0x401a26
push 0x4d67a8
call fcn.0046c1c1
add esp, 4
cmp dword [0x4d67a8], 0xffffffff
jne 0x401a26
call fcn.00408a00
push 0x4d67a8
call fcn.0046c182
add esp, 4
push 0x4d69b0
push 0x4a159c
lea eax, [ebp - 0x404]
push 0x200
push eax
call fcn.004042f0
add esp, 0x10
cmp word [ebp - 6], 0
je 0x401a5b
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046be2f
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x404]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x401a64
sub ecx, edx
sar ecx, 1
je 0x401a9d
cmp word [ebp + ecx*2 - 0x406], 0x5c
jne 0x401a9d
lea ecx, [ecx*2 - 2]
cmp ecx, 0x400
jae 0x401d1a
xor eax, eax
mov word [ebp + ecx - 0x404], ax
push 0x400
lea eax, [ebp - 0x804]
push 0
push eax
call fcn.0046ea70
lea eax, [ebp - 0x404]
push eax
push str.HRINSTDIR_s
lea eax, [ebp - 0x804]
push 0x200
push eax
call fcn.004042f0
add esp, 0x1c
cmp word [ebp - 0x406], 0
jne 0x401a4b
lea eax, [ebp - 0x804]
push eax
call fcn.00474dde
push 0x400
lea eax, [ebp - 0x404]
push 0
push eax
call fcn.0046ea70
call fcn.004088e0
add eax, 0x800
push eax
push 0x4a159c
lea eax, [ebp - 0x404]
push 0x200
push eax
call fcn.004042f0
add esp, 0x20
cmp word [ebp - 6], 0
jne 0x401a4b
lea ecx, [ebp - 0x404]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x401b35
sub ecx, edx
sar ecx, 1
je 0x401b6e
cmp word [ebp + ecx*2 - 0x406], 0x5c
jne 0x401b6e
lea ecx, [ecx*2 - 2]
cmp ecx, 0x400
jae 0x401d1a
xor eax, eax
mov word [ebp + ecx - 0x404], ax
push 0x400
lea eax, [ebp - 0x804]
push 0
push eax
call fcn.0046ea70
lea eax, [ebp - 0x404]
push eax
push str.HRDATADIR_s
lea eax, [ebp - 0x804]
push 0x200
push eax
call fcn.004042f0
add esp, 0x1c
cmp word [ebp - 0x406], 0
jne 0x401a4b
lea eax, [ebp - 0x804]
push eax
call fcn.00474dde
add esp, 4
lea eax, [ebp - 0x404]
push 0x200
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
cmp eax, 0x200
ja 0x401a4b
lea ecx, [ebp - 0x404]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x401be4
sub ecx, edx
sar ecx, 1
je 0x401c1d
cmp word [ebp + ecx*2 - 0x406], 0x5c
jne 0x401c1d
lea ecx, [ecx*2 - 2]
cmp ecx, 0x400
jae 0x401d1a
xor eax, eax
mov word [ebp + ecx - 0x404], ax
push 0x400
lea eax, [ebp - 0x804]
push 0
push eax
call fcn.0046ea70
lea eax, [ebp - 0x404]
push eax
push str.SYSTEMDIR_sSystem32
lea eax, [ebp - 0x804]
push 0x200
push eax
call fcn.004042f0
add esp, 0x1c
cmp word [ebp - 0x406], 0
jne 0x401a4b
lea eax, [ebp - 0x804]
push eax
call fcn.00474dde
push 0x400
lea eax, [ebp - 0x804]
push 0
push eax
call fcn.0046ea70
lea eax, [ebp - 0x404]
push eax
push str.DRIVERDIR_sSystem32drivers
lea eax, [ebp - 0x804]
push 0x200
push eax
call fcn.004042f0
add esp, 0x20
cmp word [ebp - 0x406], 0
jne 0x401a4b
lea eax, [ebp - 0x804]
push eax
call fcn.00474dde
push 0x400
lea eax, [ebp - 0x804]
push 0
push eax
call fcn.0046ea70
lea eax, [ebp - 0x404]
push eax
push str.SYSWOWDIR_sSysWOW64
lea eax, [ebp - 0x804]
push 0x200
push eax
call fcn.004042f0
add esp, 0x20
cmp word [ebp - 0x406], 0
jne 0x401a4b
lea eax, [ebp - 0x804]
push eax
call fcn.00474dde
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
mov eax, 1
call fcn.0046be2f
mov esp, ebp
pop ebp
ret
call fcn.0046bf94
int3