Function at 0x409780
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x424
push ebx
push esi
push edi
lea eax, [ebp - 0x424]
xor esi, esi
push 0x208
push eax
mov dword [ebp - 4], esi
mov dword [ebp - 0x10], 0xc
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
cmp dword [ebp + 0xc], esi
mov edi, dword [ebp + 8]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyA]
jne 0x409834
lea eax, [ebp - 0x21c]
push esi
push eax
push esi
push esi
push edi
call fcn.00412da0
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
add esp, 0x14
lea eax, [ebp - 0x424]
push eax
push edi
call ebx
push edi
call fcn.00409e01
pop ecx
lea eax, [ebp - 0x21c]
push eax
push edi
call esi
push dword [ebp - 4]
lea eax, [ebp - 0x1c]
push 0x41c9d4
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x1c]
push eax
push edi
call esi
push str..MIF
push edi
call esi
push edi
call fcn.00409e32
test eax, eax
pop ecx
je 0x409832
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x3e7
jle 0x4097d7
jmp 0x409a6b
xor esi, esi
push esi
push 0x80000080
lea eax, [ebp - 0x10]
push 2
push eax
push esi
push 0x40000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x409a6b
push dword [ebp + 0x14]
lea eax, [ebp - 0x11c]
push eax
call ebx
cmp byte [ebp - 0x11c], 0
lea eax, [ebp - 0x11c]
je 0x40988e
mov cl, byte [eax]
cmp cl, 0xa
je 0x40987f
cmp cl, 0xd
jne 0x409882
mov byte [eax], 0x20
push eax
call dword [sym.imp.USER32.dll_CharNextA]
cmp byte [eax], 0
jne 0x409873
push str.Start_Component_r_n
push esi
call fcn.00409d5c
pop ecx
test eax, eax
pop ecx
je 0x409a64
push str._tName___Workstation__r_n
push esi
call fcn.00409d5c
pop ecx
test eax, eax
pop ecx
je 0x409a64
push str._tStart_Group_r_n
push esi
call fcn.00409d5c
pop ecx
test eax, eax
pop ecx
je 0x409a64
push str._t_tName___InstallStatus__r_n
push esi
call fcn.00409d5c
pop ecx
test eax, eax
pop ecx
je 0x409a64
push str._t_tID__1_r_n
push esi
call fcn.00409d5c
pop ecx
test eax, eax
pop ecx
je 0x409a64
push str._t_tClass___MICROSOFTJOBSTATUS1.0__r_n
push esi
call fcn.00409d5c
pop ecx
test eax, eax
pop ecx
je 0x409a64
push str._t_tStart_Attribute_r_n
push esi
call fcn.00409d5c
pop ecx
test eax, eax
pop ecx
je 0x409a64
push str._t_t_tName___Status__r_n
push esi
call fcn.00409d5c
pop ecx
test eax, eax
pop ecx
je 0x409a64
push str._t_t_tID__1_r_n
push esi
call fcn.00409d5c
pop ecx
test eax, eax
pop ecx
je 0x409a64
push str._t_t_tType__String_16__r_n
push esi
call fcn.00409d5c
pop ecx
test eax, eax
pop ecx
je 0x409a64
mov ebx, str._t_t_tValue_
push ebx
push esi
call fcn.00409d5c
pop ecx
test eax, eax
pop ecx
je 0x409a64
cmp dword [ebp + 0x10], 0
mov eax, str._SUCCESS__r_n
jne 0x409986
mov eax, str._FAILED__r_n
push eax
push esi
call fcn.00409d5c
pop ecx
test eax, eax
pop ecx
je 0x409a64
mov edi, str._t_tEnd_Attribute_r_n
push edi
push esi
call fcn.00409d5c
pop ecx
test eax, eax
pop ecx
je 0x409a64
push str._t_tStart_Attribute_r_n
push esi
call fcn.00409d5c
pop ecx
test eax, eax
pop ecx
je 0x409a64
push str._t_t_tName___Description__r_n
push esi
call fcn.00409d5c
pop ecx
test eax, eax
pop ecx
je 0x409a64
push str._t_t_tID__2_r_n
push esi
call fcn.00409d5c
pop ecx
test eax, eax
pop ecx
je 0x409a64
push str._t_t_tType__String_256__r_n
push esi
call fcn.00409d5c
pop ecx
test eax, eax
pop ecx
je 0x409a64
push ebx
push esi
call fcn.00409d5c
pop ecx
test eax, eax
pop ecx
je 0x409a64
lea eax, [ebp - 0x11c]
push eax
push esi
call fcn.00409d5c
pop ecx
test eax, eax
pop ecx
je 0x409a64
push 0x41c05c
push esi
call fcn.00409d5c
pop ecx
test eax, eax
pop ecx
je 0x409a64
push edi
push esi
call fcn.00409d5c
pop ecx
test eax, eax
pop ecx
je 0x409a64
push str._tEnd_Group_r_n
push esi
call fcn.00409d5c
pop ecx
test eax, eax
pop ecx
je 0x409a64
push str.End_Component_r_n
push esi
call fcn.00409d5c
pop ecx
test eax, eax
pop ecx
je 0x409a64
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x409a6b
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
leave
ret