Function at 0x4197d0
Capabilities:
Get common file path
Get hostname

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47118c
mov eax, dword fs:[0]
push eax
mov eax, 0x6330
call fcn.0044b8a0
mov eax, dword [0x496534]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x633c], 0x49ca68
call fcn.00423e60
mov dword [ebp - 4], 0
mov dword [0x49ca68], 0x487510
mov dword [0x49cad0], 7
mov dword [0x49cae8], 7
mov dword [0x49cb00], 7
mov dword [0x49cb18], 7
mov dword [0x49cb30], 7
mov dword [0x49cb48], 7
mov dword [0x49cb60], 7
xor eax, eax
mov byte [ebp - 4], 7
push 0x1000
push eax
mov word [0x49cabc], ax
mov dword [0x49cae4], eax
mov word [0x49cad4], ax
mov dword [0x49cafc], eax
mov word [0x49caec], ax
mov dword [0x49cb14], eax
mov word [0x49cb04], ax
mov dword [0x49cb2c], eax
mov word [0x49cb1c], ax
mov dword [0x49cb44], eax
mov word [0x49cb34], ax
mov dword [0x49cb5c], eax
mov word [0x49cb4c], ax
lea eax, [ebp - 0x5334]
push eax
mov dword [0x49cacc], 0
call fcn.0044f210
push 0x1000
lea eax, [ebp - 0x4334]
push 0
push eax
call fcn.0044f210
push 0x1000
lea eax, [ebp - 0x1328]
push 0
push eax
call fcn.0044f210
push 0x1000
lea eax, [ebp - 0x3334]
push 0
push eax
call fcn.0044f210
add esp, 0x30
lea eax, [ebp - 0x5334]
push 0x800
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x419be5
push 0x800
lea eax, [ebp - 0x4334]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x419be5
lea eax, [ebp - 0x1328]
push eax
push 0x800
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x419be5
push 0x800
lea eax, [ebp - 0x3334]
push eax
push dword [0x49c3ec]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x419be5
lea eax, [ebp - 0x5334]
mov ecx, 0x49cabc
push eax
call fcn.004055f0
lea eax, [ebp - 0x4334]
mov ecx, 0x49cad4
push eax
call fcn.004055f0
lea eax, [ebp - 0x3334]
mov ecx, 0x49cb1c
push eax
call fcn.004055f0
lea eax, [ebp - 0x1328]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push 0x104
push 0
lea esi, [eax - 1]
lea eax, [ebp - 0x224]
push eax
call fcn.0044f210
push 0x104
lea eax, [ebp - 0x120]
push 0
push eax
call fcn.0044f210
mov ebx, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea eax, [ebp - 0x6338]
add esp, 0x18
mov dword [ebp - 0x6338], 0
push eax
push 0x487508
push 0x104
lea eax, [ebp - 0x224]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x1328]
push eax
push 0
push 0
call ebx
lea eax, [ebp - 0x6338]
push eax
push 0x487508
push 0x104
lea eax, [ebp - 0x120]
push eax
lea edi, [esi + esi]
push 0xffffffffffffffff
lea esi, [ebp - 0x1328]
add esi, edi
push esi
push 0
push 0
call ebx
lea eax, [ebp - 0x120]
push eax
lea eax, [ebp - 0x224]
push eax
call fcn.00456bbd
add esp, 8
cmp word [esi], 0x5c
jne 0x419a7d
cmp eax, 0xffffffff
je 0x419a7d
cmp edi, 0x1000
jae 0x419c2b
xor eax, eax
mov word [esi], ax
lea eax, [ebp - 0x1328]
mov ecx, 0x49cb04
push eax
call fcn.004055f0
push 0
push 0
push 0
push 0
push 0x800
lea eax, [ebp - 0x6334]
push eax
push 5
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x3334]
push eax
call fcn.004563a3
lea eax, [ebp - 0x6334]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x2334]
push str._s_s
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x34
lea eax, [ebp - 0x2334]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push 0x104
push 0
lea esi, [eax - 1]
lea eax, [ebp - 0x120]
push eax
call fcn.0044f210
push 0x104
lea eax, [ebp - 0x224]
push 0
push eax
call fcn.0044f210
add esp, 0x18
mov dword [ebp - 0x6338], 0
lea eax, [ebp - 0x6338]
push eax
push 0x487508
push 0x104
lea eax, [ebp - 0x120]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x1328]
push eax
push 0
push 0
call ebx
lea eax, [ebp - 0x6338]
add esi, esi
push eax
push 0x487508
push 0x104
lea eax, [ebp - 0x224]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x1328]
add eax, esi
push eax
push 0
push 0
call ebx
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x120]
push eax
call fcn.00456bbd
add esp, 8
cmp word [ebp + esi - 0x2334], 0x5c
jne 0x419ba5
cmp eax, 0xffffffff
je 0x419ba5
cmp esi, 0x100a
jae 0x419c2b
xor eax, eax
mov word [ebp + esi - 0x2334], ax
lea eax, [ebp - 0x2334]
mov ecx, 0x49cb34
push eax
call fcn.004055f0
push 0
push 0
push 0
push 0
push 0
push 0
push 5
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x4334]
push eax
call fcn.004563a3
add esp, 0x24
lea eax, [ebp - 0x1c]
mov ecx, 0x49caec
push eax
call fcn.004055f0
push 0x208
lea eax, [ebp - 0x328]
push 0
push eax
call fcn.0044f210
add esp, 0xc
mov dword [ebp - 0x6338], 0x104
lea eax, [ebp - 0x6338]
push eax
lea eax, [ebp - 0x328]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
je 0x419c61
cmp word [ebp - 0x328], 0
jne 0x419c30
xor ecx, ecx
jmp 0x419c4f
call fcn.0044b12a
lea ecx, [ebp - 0x328]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x419c40
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x328]
mov ecx, 0x49cb4c
push eax
call fcn.004037c0
mov eax, 0x49ca68
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0044ae75
mov esp, ebp
pop ebp
ret