Function at 0x40217b
Capabilities:
Get common file path

Disassembly:
push ebp
mov edx, 0x97
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x402181
call fcn.0041ed30
mov edx, dword [esp + 0x264]
lea ecx, [esp]
call fcn.00413060
push edx
call fcn.0041ec80
pop edx
push eax
push edx
call fcn.0041ec80
pop edx
push eax
push 0x104
call fcn.00413ef0
lea eax, [esp + 8]
push eax
call fcn.0041ee20
push edx
call fcn.0041ec80
pop edx
push eax
push edx
call fcn.0041ec80
pop edx
push eax
push 0x104
call fcn.00413ef0
lea eax, [esp + 0xc]
push eax
call fcn.0041ee20
push 0x104
push dword [esp + 8]
call sub.KERNEL32.dll_GetSystemDirectoryW
mov eax, str.winlogon.exe
push eax
push dword [esp + 8]
call sub.KERNEL32.dll_lstrcatW
push edx
call fcn.0041ec80
pop edx
push eax
push dword [esp + 8]
call fcn.0040d190
lea eax, [esp + 8]
push eax
call fcn.0041ee20
push edx
call fcn.0041ec80
pop edx
push eax
push dword [esp + 4]
call fcn.0040d190
lea eax, [esp + 4]
push eax
call fcn.0041ee20
mov dword [esp + 0xc], 0
mov eax, str.Kernel32.dll
push eax
push 0
call fcn.00416db7
and eax, eax
je 0x40247b
mov eax, 0x422ca8
push eax
push 0
call fcn.00416e11
mov dword [esp + 0x10], eax
mov eax, str.Process32First
push eax
push 0
call fcn.00416e11
mov dword [esp + 0x14], eax
mov eax, str.Process32Next
push eax
push 0
call fcn.00416e11
mov dword [esp + 0x18], eax
cmp dword [esp + 0x10], 0
je 0x4022ae
cmp dword [esp + 0x14], 0
je 0x4022ae
mov eax, 1
jmp 0x4022b0
xor eax, eax
and eax, eax
je 0x4022c2
cmp dword [esp + 0x18], 0
je 0x4022c2
mov eax, 1
jmp 0x4022c4
xor eax, eax
and eax, eax
je 0x402471
lea ebp, [esp + 0x1c]
mov dword [ebp], 0x22c
push 0
push 2
push dword [esp + 0x18]
call fcn.00416f6d
mov dword [esp + 0x248], eax
cmp dword [esp + 0x248], 0
je 0x402465
lea eax, [esp + 0x1c]
push eax
push dword [esp + 0x24c]
push dword [esp + 0x1c]
call fcn.00416f6d
mov dword [esp + 0x24c], eax
cmp dword [esp + 0x24c], 0
je 0x402465
push edx
call fcn.0041ec80
pop edx
push eax
push edx
call fcn.0041ec80
pop edx
push eax
push edx
call fcn.0041ec80
pop edx
push eax
push 0x18
push 0xffffffff
lea ebp, [esp + 0x30]
lea eax, [ebp + 0x24]
push eax
call fcn.0041e850
call fcn.004131e2
add dword [esp], edx
call fcn.0040d190
lea eax, [esp + 0x254]
push eax
call fcn.0041ee20
push edx
call fcn.0041ec80
pop edx
push eax
push edx
call fcn.0041ec80
pop edx
push eax
push dword [esp + 0x258]
call fcn.004171a7
lea eax, [esp + 0x254]
push eax
call fcn.0041ee20
push dword [esp + 0x250]
mov edx, dword [esp + 4]
pop ecx
call fcn.00413210
je 0x402444
lea ebp, [esp + 0x1c]
push dword [ebp + 8]
push 0
push 0x400
call sub.KERNEL32.dll_OpenProcess
mov dword [esp + 0x254], eax
push 0x104
push dword [esp + 0xc]
push 0
push dword [esp + 0x260]
call fcn.00402e44
push edx
call fcn.0041ec80
pop edx
push eax
push dword [esp + 4]
call fcn.0040d190
call fcn.0041ecc0
push edx
call fcn.0041ec80
pop edx
push eax
push dword [esp + 0x10]
call fcn.0040d190
call fcn.00413250
mov edx, eax
call fcn.00413250
mov ecx, eax
call fcn.00413210
je 0x40242e
lea ebp, [esp + 0x1c]
mov eax, dword [ebp + 8]
jmp 0x402486
mov dword [esp + 0xc], 1
lea ebp, [esp + 0x1c]
mov eax, dword [ebp + 8]
mov dword [esp + 0x258], eax
lea eax, [esp + 0x1c]
push eax
push dword [esp + 0x24c]
push dword [esp + 0x20]
call fcn.00416f6d
mov dword [esp + 0x24c], eax
jmp 0x40231b
push dword [esp + 0x248]
call sub.KERNEL32.dll_CloseHandle
push 0
call fcn.00416cf7
mov eax, dword [esp + 0x258]
jmp 0x402486
push dword [esp + 0x250]
call fcn.0041ed90
push dword [esp]
call fcn.0041ed90
push dword [esp + 8]
call fcn.0041ed90
push dword [esp + 4]
call fcn.0041ed90
add esp, 0x25c
pop ebp
ret 4