Function at 0x41c0d1
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x70]
sub esp, 0xd0
push ebx
xor ebx, ebx
cmp dword [0x4dc204], ebx
push esi
push edi
jne 0x41c0f4
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov dword [0x4dc204], eax
call fcn.0040fedc
call fcn.004062f5
call fcn.00414321
mov esi, 0x4dc0f8
push ebx
mov ecx, esi
call fcn.00410b5c
call fcn.0040618d
mov edi, 0x4dcd58
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x4dbd50]
or eax, dword [0x4dbd54]
jne 0x41c139
push 0x4dbd50
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0x4dbd58
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
push 0x4dc02c
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
push ebx
push 0x393a
call fcn.00413426
push 0xd6fd2
push 0x311f1
lea eax, [ebp - 0x60]
push str._06lu_06lu
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x18
lea eax, [ebp - 0x60]
push eax
push 0x4c486e
mov ecx, esi
call fcn.0044451e
lea eax, [ebp - 0x60]
push eax
push str.PECMDVER
mov ecx, esi
call fcn.0044451e
push str.X86_U
lea ecx, [ebp + 0x68]
call fcn.0044e66d
push dword [0x4da0f0]
lea ecx, [ebp + 0x68]
call fcn.00444e9e
push dword [ebp + 0x68]
mov ecx, esi
push 0x4c4844
call fcn.0044451e
push 0x4c4840
push 0x4c4830
mov ecx, esi
call fcn.0044456e
push ebx
push 0x3947
call fcn.00413426
call fcn.00413284
push ebx
push 0x3949
call fcn.00413426
mov eax, dword [ebp + 0x78]
add esp, 0x10
cmp dword [0x4dbc90], ebx
mov dword [0x4dbfb0], eax
jne 0x41c20b
mov dword [0x4dbc90], eax
mov eax, dword [ebp + 0x7c]
mov dword [0x4da2c4], eax
call fcn.0043f065
push str.WM_TaskbarRestart
push dword [0x4dc25c]
mov esi, 0x4dc0f8
push esi
call fcn.00447471
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
add esp, 0xc
push str.__PID
call edi
push eax
push esi
call fcn.00447471
add esp, 0xc
call edi
push eax
call fcn.00404dff
mov dword [esp], str.__PPID
push eax
push esi
call fcn.00447471
push str.__HINST
push dword [0x4dbfb0]
push esi
call fcn.00447471
add esp, 0x18
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 0x4c47c4
push eax
push esi
mov dword [0x4dbe80], eax
call fcn.00447471
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetTickCount]
add eax, 0x3952
push ebx
push eax
call fcn.00413426
movzx eax, word [0x4dbc18]
push str.SYSCODEPAGE
push eax
push esi
call fcn.00447471
add esp, 0x14
push 0x20a
lea ecx, [ebp + 0x6c]
call fcn.00444e50
push dword [ebp + 0x6c]
mov edi, 0x208
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push dword [ebp + 0x6c]
mov ecx, esi
push 0x4c4474
call fcn.0044456e
push dword [ebp + 0x6c]
mov ecx, esi
push str._CD
call fcn.0044456e
mov eax, dword [ebp + 0x6c]
mov word [eax + 4], bx
push dword [ebp + 0x6c]
mov ecx, esi
push str.CurDrv
call fcn.0044456e
mov eax, dword [ebp + 0x6c]
push edi
push eax
push ebx
mov word [eax], bx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push dword [ebp + 0x6c]
mov ecx, esi
push str.CurFile
call fcn.0044456e
call fcn.00413436
lea ecx, [ebp + 0x6c]
call fcn.0043e679
lea ecx, [ebp + 0x68]
call fcn.0043e679
pop edi
pop esi
pop ebx
add ebp, 0x70
leave
ret