Function at 0x414af9
Capabilities:
Get common file path

Disassembly:
push 0x7c
mov eax, 0x48aca4
call fcn.00459b85
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x71]
mov dword [ebp - 0x88], ebx
lea ecx, [ebp - 0x40]
and dword [ebp - 0x78], 0
push 0
push eax
mov dword [ebp - 0x40], 0x4a6f40
mov dword [ebp - 0x18], 0x4a6f48
call fcn.004060a0
mov dword [ebp - 4], 3
cmp dword [ebp + 0xc], 1
jne 0x414bdb
mov byte [ebp - 4], 4
lea eax, [ebp - 0x40]
mov dword [ebp - 0x84], eax
mov esi, 0x104
xor eax, eax
mov byte [ebp - 0x80], al
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x2c], esi
jae 0x414b68
push eax
push esi
lea ecx, [ebp - 0x3c]
call fcn.0041496d
push 2
pop edi
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x78], edi
mov byte [ebp - 0x80], 1
call fcn.004140be
push esi
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov dword [ebp - 0x78], edi
mov esi, eax
and edi, 0xfffffffd
mov dword [ebp - 0x78], edi
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x84]
call fcn.0041132b
test esi, esi
je 0x414d1d
push 0
lea eax, [ebp - 0x71]
mov dword [ebp - 0x70], 0x4b6748
push eax
push str.sysnative
lea ecx, [ebp - 0x70]
mov dword [ebp - 0x48], 0x4b6750
call fcn.0041070a
mov byte [ebp - 4], 6
lea eax, [ebp - 0x70]
push eax
lea ecx, [ebp - 0x40]
call fcn.00414f29
jmp 0x414c7c
cmp dword [ebp + 0xc], 2
jne 0x414c8a
mov byte [ebp - 4], 8
lea eax, [ebp - 0x40]
mov dword [ebp - 0x84], eax
mov esi, 0x104
xor eax, eax
mov byte [ebp - 0x80], al
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x2c], esi
jae 0x414c0e
push eax
push esi
lea ecx, [ebp - 0x3c]
call fcn.0041496d
push 4
pop edi
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x78], edi
mov byte [ebp - 0x80], 1
call fcn.004140be
push esi
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov dword [ebp - 0x78], edi
mov esi, eax
and edi, 0xfffffffb
mov dword [ebp - 0x78], edi
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x84]
call fcn.0041132b
test esi, esi
je 0x414d1d
push 0
lea eax, [ebp - 0x71]
mov dword [ebp - 0x70], 0x4b6748
push eax
push str.syswow64
lea ecx, [ebp - 0x70]
mov dword [ebp - 0x48], 0x4b6750
call fcn.0041070a
mov byte [ebp - 4], 0xa
lea eax, [ebp - 0x70]
push eax
lea ecx, [ebp - 0x40]
call fcn.00414f29
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x70]
call fcn.00404cc0
jmp 0x414cec
mov byte [ebp - 4], 0xc
lea eax, [ebp - 0x40]
mov dword [ebp - 0x84], eax
mov esi, 0x104
xor eax, eax
mov byte [ebp - 0x80], al
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x2c], esi
jae 0x414cb3
push eax
push esi
lea ecx, [ebp - 0x3c]
call fcn.0041496d
push 8
pop edi
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x78], edi
mov byte [ebp - 0x80], 1
call fcn.004140be
push esi
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov dword [ebp - 0x78], edi
mov esi, eax
and edi, 0xfffffff7
mov dword [ebp - 0x78], edi
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x84]
call fcn.0041132b
test esi, esi
je 0x414d1d
push 1
push 0x4a6f30
lea ecx, [ebp - 0x40]
call fcn.00414eca
push eax
mov ecx, ebx
call fcn.00414d34
or edi, 1
mov dword [ebp - 0x78], edi
and dword [ebp - 4], 0
lea ecx, [ebp - 0x40]
call fcn.00404cc0
mov eax, ebx
call fcn.00459b34
ret
lea ecx, [ebp - 0x5c]
call fcn.00414dc4
push 0x4bef3c
lea eax, [ebp - 0x5c]
push eax
call fcn.00471ff8
int3