Function at 0x4038d2
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x668
mov eax, dword [0x407004]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x654], ecx
lea edi, [ebp - 0x668]
xor ecx, ecx
stosd dword es:[edi], eax
mov ebx, edx
push 0x240
push ecx
mov esi, ecx
mov dword [ebp - 0x658], ebx
stosd dword es:[edi], eax
mov dword [ebp - 0x650], esi
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x24c]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
test ebx, ebx
jne 0x40392e
xor al, al
jmp 0x403b4c
push ebx
xor edx, edx
push edx
push 0x410
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_1.dll_OpenProcess]
xor ebx, ebx
mov edi, eax
inc ebx
test edi, edi
jne 0x40395f
push 0x278f
push ebx
call fcn.00406139
pop ecx
push eax
call fcn.0040485e
pop ecx
pop ecx
jmp 0x403b2a
cmp dword [ebp + 8], esi
jne 0x403a13
push 0x200
lea eax, [ebp - 0x64c]
push eax
xor eax, eax
push eax
push edi
call dword [sym.imp.api_ms_win_core_psapi_l1_1_0.dll_K32GetModuleBaseNameW]
test eax, eax
je 0x403a13
lea esi, [ebp - 0x64c]
xor edx, edx
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
cmp ax, dx
jne 0x403991
sub esi, ecx
sar esi, 1
cmp esi, 0xb
jne 0x4039c3
push 0xffffffffffffffff
push 0x4011ec
push 0xffffffffffffffff
lea eax, [ebp - 0x64c]
push eax
push ebx
push 0x7f
call dword [sym.imp.api_ms_win_core_string_l1_1_0.dll_CompareStringW]
cmp eax, 2
je 0x403a0d
cmp esi, 0xc
jne 0x4039e6
push 0xffffffffffffffff
push 0x401204
push 0xffffffffffffffff
lea eax, [ebp - 0x64c]
push eax
push ebx
push 0x7f
call dword [sym.imp.api_ms_win_core_string_l1_1_0.dll_CompareStringW]
cmp eax, 2
je 0x403a0d
lea eax, [ebp - 0x64c]
push eax
push 0x2793
push ebx
call fcn.00406139
pop ecx
push eax
call fcn.0040485e
mov esi, dword [ebp - 0x650]
add esp, 0xc
jmp 0x403b23
mov esi, dword [ebp - 0x650]
mov ecx, dword [ebp - 0x654]
mov eax, dword [ecx]
or eax, dword [ecx + 4]
je 0x403ad7
push 0x104
lea eax, [ebp - 0x24c]
push eax
call dword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetSystemDirectoryW]
test eax, eax
je 0x403ad7
push 0x401220
mov edx, 0x120
lea ecx, [ebp - 0x24c]
call fcn.004015f0
xor eax, eax
push eax
push eax
lea eax, [ebp - 0x24c]
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
je 0x403ad7
push 0x40123c
push esi
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
mov dword [ebp - 0x650], eax
mov dword [0x407f04], eax
test eax, eax
je 0x403ad7
mov ecx, dword [ebp - 0x658]
xor edx, edx
mov dword [ebp - 0x668], ecx
mov ecx, dword [ebp - 0x654]
mov ecx, dword [ecx]
mov dword [ebp - 0x664], ecx
lea ecx, [ebp - 0x668]
push ecx
push ebx
push edx
mov ecx, eax
call dword [0x4081d4]
call dword [ebp - 0x650]
test eax, eax
jne 0x403ad7
push dword [ebp - 0x65c]
push 0x2792
push ebx
call fcn.00406139
pop ecx
push eax
call fcn.0040485e
add esp, 0xc
push 0x200
lea eax, [ebp - 0x64c]
push eax
xor eax, eax
push eax
push edi
call dword [sym.imp.api_ms_win_core_psapi_l1_1_0.dll_K32GetModuleBaseNameW]
test eax, eax
je 0x403b0f
lea eax, [ebp - 0x64c]
push eax
push 0x2793
push ebx
call fcn.00406139
pop ecx
push eax
call fcn.0040485e
add esp, 0xc
jmp 0x403b23
push 0x2790
push ebx
call fcn.00406139
pop ecx
push eax
call fcn.0040485e
pop ecx
pop ecx
push edi
call dword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
cmp dword [ebp - 0x65c], 0
je 0x403b3f
push dword [ebp - 0x65c]
call dword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
test esi, esi
je 0x403b4a
push esi
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
mov al, bl
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00405c20
leave
ret 4