Function at 0x4078ca
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x4b38
call fcn.00412df0
push esi
push edi
xor esi, esi
push 0x208
lea eax, [esp + 0x28e]
push esi
push eax
mov word [esp + 0x132c], si
mov word [esp + 0x294], si
call sub.msvcrt.dll_memset
add esp, 0xc
push 0x104
lea eax, [esp + 0x28c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push str.Prefetch
call sub.msvcrt.dll_wcslen
mov edi, eax
pop ecx
lea eax, [esp + 0x288]
push eax
call sub.msvcrt.dll_wcslen
lea eax, [edi + eax + 1]
cmp eax, 0x104
pop ecx
jae 0x40795a
lea eax, [esp + 0x288]
push str.Prefetch
push eax
lea eax, [esp + 0x1328]
call fcn.00404f85
pop ecx
pop ecx
jmp 0x407962
mov word [esp + 0x1320], si
lea eax, [esp + 0x1320]
push eax
push ebx
call fcn.0040e419
lea edi, [ebx + 8]
push edi
call fcn.0040dba5
push edi
call fcn.0040d923
lea edi, [ebx + 0xc]
call fcn.0040ee40
push esi
lea edi, [ebx + 0x10]
push edi
call fcn.004064df
push 1
push edi
call fcn.004064df
lea eax, [ebx + 0x270]
push eax
call fcn.0040f759
cmp dword [ebx + 0x5914], esi
je 0x4079e3
push str.Archive_System_.evtx
push str.System
push 1
push ebx
call fcn.0040766a
push str.Archive_Application_.evtx
push str.Application
push 2
push ebx
call fcn.0040766a
push str.Archive_Security_.evtx
push str.Security
push 3
push ebx
call fcn.0040766a
push 0x208
lea eax, [esp + 0x49e]
push esi
push eax
mov word [esp + 0x4a4], si
call sub.msvcrt.dll_memset
lea eax, [esp + 0x4a4]
add esp, 0xc
push eax
call fcn.00404508
cmp word [esp + 0x49c], si
pop ecx
je 0x407d18
or dword [esp + 0x1530], 0xffffffff
lea eax, [esp + 0x498]
push eax
push str..dmp
lea eax, [esp + 0x1538]
mov word [esp + 0x153c], si
mov word [esp + 0x1c9c], si
mov word [esp + 0x1a14], si
call fcn.00405fcf
lea eax, [esp + 0x1530]
call fcn.0040602c
test eax, eax
je 0x407d0c
jmp 0x407a6e
xor esi, esi
lea eax, [esp + 0x6a8]
call fcn.00403a8e
lea eax, [esp + 0x1a0c]
push eax
lea eax, [esp + 0x6ac]
push eax
call fcn.00403cbe
test eax, eax
je 0x407ce0
lea eax, [esp + 0x1f20]
call fcn.004073f9
mov eax, dword [esp + 0x17c0]
mov dword [esp + 0x4b38], eax
mov eax, dword [esp + 0x17c4]
mov dword [esp + 0x4b3c], eax
lea eax, [esp + 0x1a0c]
push eax
mov eax, 0x104
lea edi, [esp + 0x1f28]
mov dword [esp + 0x1f24], 0xc
call fcn.00404c75
pop ecx
push 0x7e
pop edi
push edi
lea eax, [esp + 0x20e]
push esi
push eax
mov word [esp + 0x214], si
call sub.msvcrt.dll_memset
add esp, 0xc
push edi
lea eax, [esp + 0x10e]
push esi
push eax
mov word [esp + 0x114], si
call sub.msvcrt.dll_memset
add esp, 0xc
push edi
lea eax, [esp + 0xe]
push esi
push eax
mov word [esp + 0x14], si
call sub.msvcrt.dll_memset
add esp, 0xc
push edi
lea eax, [esp + 0x18e]
push esi
push eax
mov word [esp + 0x194], si
call sub.msvcrt.dll_memset
add esp, 0xc
push edi
lea eax, [esp + 0x8e]
push esi
push eax
mov word [esp + 0x94], si
call sub.msvcrt.dll_memset
add esp, 0xc
push dword [esp + 0x6ac]
mov edi, str.0x_8.8x
push dword [esp + 0x6ac]
mov esi, 0x3ff
push edi
lea eax, [esp + 0x214]
push esi
push eax
call sub.msvcrt.dll__snwprintf
add esp, 0x14
cmp dword [esp + 0x7dc], 2
lea eax, [esp + 0x108]
jne 0x407bb4
push eax
push dword [esp + 0x6b8]
push dword [esp + 0x6b8]
call fcn.00407645
jmp 0x407bcd
push dword [esp + 0x6b4]
push dword [esp + 0x6b4]
push edi
push esi
push eax
call sub.msvcrt.dll__snwprintf
add esp, 0x14
cmp dword [esp + 0x7dc], 2
lea eax, [esp + 8]
jne 0x407bf1
push eax
push dword [esp + 0x6c0]
push dword [esp + 0x6c0]
call fcn.00407645
jmp 0x407c0a
push dword [esp + 0x6bc]
push dword [esp + 0x6bc]
push edi
push esi
push eax
call sub.msvcrt.dll__snwprintf
add esp, 0x14
cmp dword [esp + 0x7dc], 2
lea eax, [esp + 0x188]
jne 0x407c31
push eax
push dword [esp + 0x6c8]
push dword [esp + 0x6c8]
call fcn.00407645
jmp 0x407c4a
push dword [esp + 0x6c4]
push dword [esp + 0x6c4]
push edi
push esi
push eax
call sub.msvcrt.dll__snwprintf
add esp, 0x14
cmp dword [esp + 0x7dc], 2
lea eax, [esp + 0x88]
jne 0x407c71
push eax
push dword [esp + 0x6d0]
push dword [esp + 0x6d0]
call fcn.00407645
jmp 0x407c8a
push dword [esp + 0x6cc]
push dword [esp + 0x6cc]
push edi
push esi
push eax
call sub.msvcrt.dll__snwprintf
add esp, 0x14
lea eax, [esp + 0x88]
push eax
lea eax, [esp + 0x18c]
push eax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x114]
push eax
lea eax, [esp + 0x218]
push eax
lea eax, [esp + 0x6f0]
push eax
push str._s____s___s__s__s__s_
lea eax, [esp + 0x214a]
push 0xfff
push eax
call sub.msvcrt.dll__snwprintf
mov eax, dword [ebx]
add esp, 0x24
lea ecx, [esp + 0x1f20]
push ecx
mov ecx, ebx
call dword [eax + 4]
lea esi, [esp + 0x1308]
call fcn.00405d84
lea esi, [esp + 0x12f8]
call fcn.004045c6
lea eax, [esp + 0x1530]
call fcn.0040602c
test eax, eax
jne 0x407a6c
lea esi, [esp + 0x1530]
call fcn.004060c5
lea eax, [ebx + 0x274]
push eax
call fcn.00412717
lea eax, [ebx + 0x56e0]
call fcn.004119da
pop edi
pop esi
mov esp, ebp
pop ebp
ret