Function at 0x41c2b9
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x70]
sub esp, 0xd0
push ebx
xor ebx, ebx
cmp dword [0x4dd1fc], ebx
push esi
push edi
jne 0x41c2dc
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov dword [0x4dd1fc], eax
call fcn.0041000c
call fcn.00439364
call fcn.004144dd
mov esi, 0x4dd0f0
push ebx
mov ecx, esi
call fcn.00410ca6
call fcn.004061a3
mov edi, 0x4ddd50
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x4dcd48]
or eax, dword [0x4dcd4c]
jne 0x41c321
push 0x4dcd48
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0x4dcd50
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
push 0x4dd024
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
push ebx
push 0x393a
call fcn.004135e2
push 0xd6fd2
push 0x311f1
lea eax, [ebp - 0x60]
push str._06lu_06lu
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x18
lea eax, [ebp - 0x60]
push eax
push 0x4c5886
mov ecx, esi
call fcn.00444692
lea eax, [ebp - 0x60]
push eax
push str.PECMDVER
mov ecx, esi
call fcn.00444692
push str.X86_U
lea ecx, [ebp + 0x68]
call fcn.0044e827
push dword [0x4db0f0]
lea ecx, [ebp + 0x68]
call fcn.00444fd8
push dword [ebp + 0x68]
mov ecx, esi
push 0x4c585c
call fcn.00444692
push 0x4c5858
push 0x4c5848
mov ecx, esi
call fcn.004446e2
push ebx
push 0x3947
call fcn.004135e2
call fcn.00413440
push ebx
push 0x3949
call fcn.004135e2
mov eax, dword [ebp + 0x78]
add esp, 0x10
cmp dword [0x4dcc88], ebx
mov dword [0x4dcfa8], eax
jne 0x41c3f3
mov dword [0x4dcc88], eax
mov eax, dword [ebp + 0x7c]
mov dword [0x4db2ac], eax
call fcn.0043f1ba
push str.WM_TaskbarRestart
push dword [0x4dd254]
mov esi, 0x4dd0f0
push esi
call fcn.00447638
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
add esp, 0xc
push str.__PID
call edi
push eax
push esi
call fcn.00447638
add esp, 0xc
call edi
push eax
call fcn.00404e2b
mov dword [esp], str.__PPID
push eax
push esi
call fcn.00447638
push str.__HINST
push dword [0x4dcfa8]
push esi
call fcn.00447638
add esp, 0x18
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 0x4c57dc
push eax
push esi
mov dword [0x4dce78], eax
call fcn.00447638
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetTickCount]
add eax, 0x3952
push ebx
push eax
call fcn.004135e2
movzx eax, word [0x4e0018]
push str.SYSCODEPAGE
push eax
push esi
call fcn.00447638
add esp, 0x14
push 0x20a
lea ecx, [ebp + 0x6c]
call fcn.00444f8a
push dword [ebp + 0x6c]
mov edi, 0x208
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push dword [ebp + 0x6c]
mov ecx, esi
push 0x4c548c
call fcn.004446e2
push dword [ebp + 0x6c]
mov ecx, esi
push str._CD
call fcn.004446e2
mov eax, dword [ebp + 0x6c]
mov word [eax + 4], bx
push dword [ebp + 0x6c]
mov ecx, esi
push str.CurDrv
call fcn.004446e2
mov eax, dword [ebp + 0x6c]
push edi
push eax
push ebx
mov word [eax], bx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push dword [ebp + 0x6c]
mov ecx, esi
push str.CurFile
call fcn.004446e2
call fcn.004135f2
lea ecx, [ebp + 0x6c]
call fcn.0043e825
lea ecx, [ebp + 0x68]
call fcn.0043e825
pop edi
pop esi
pop ebx
add ebp, 0x70
leave
ret