Function at 0x401cd0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x844
mov eax, dword [0x550070]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x844], ecx
mov dword [ebp - 0x808], 0
push 0x400
push 0
lea eax, [ebp - 0x404]
push eax
call fcn.004d43c0
add esp, 0xc
call fcn.0040d250
mov ecx, eax
call fcn.00405b60
push eax
push 0x511914
push 0x200
lea ecx, [ebp - 0x404]
push ecx
call fcn.004058e0
add esp, 0x10
mov edx, 2
imul eax, edx, 0x1ff
movzx ecx, word [ebp + eax - 0x404]
test ecx, ecx
je 0x401d4d
xor eax, eax
jmp 0x4021b6
lea edx, [ebp - 0x404]
mov dword [ebp - 0x80c], edx
mov eax, dword [ebp - 0x80c]
add eax, 2
mov dword [ebp - 0x82c], eax
mov ecx, dword [ebp - 0x80c]
mov dx, word [ecx]
mov word [ebp - 0x816], dx
add dword [ebp - 0x80c], 2
cmp word [ebp - 0x816], 0
jne 0x401d68
mov eax, dword [ebp - 0x80c]
sub eax, dword [ebp - 0x82c]
sar eax, 1
mov dword [ebp - 0x830], eax
mov ecx, dword [ebp - 0x830]
mov dword [ebp - 0x808], ecx
cmp dword [ebp - 0x808], 0
jbe 0x401df8
mov edx, dword [ebp - 0x808]
movzx eax, word [ebp + edx*2 - 0x406]
cmp eax, 0x5c
jne 0x401df8
mov ecx, dword [ebp - 0x808]
lea edx, [ecx + ecx - 2]
mov dword [ebp - 0x820], edx
cmp dword [ebp - 0x820], 0x400
jae 0x401de3
jmp 0x401de8
call fcn.004d1984
xor eax, eax
mov ecx, dword [ebp - 0x820]
mov word [ebp + ecx - 0x404], ax
push 0x400
push 0
lea edx, [ebp - 0x804]
push edx
call fcn.004d43c0
add esp, 0xc
lea eax, [ebp - 0x404]
push eax
push str.HRINSTDIR_s
push 0x200
lea ecx, [ebp - 0x804]
push ecx
call fcn.004058e0
add esp, 0x10
mov edx, 2
imul eax, edx, 0x1ff
movzx ecx, word [ebp + eax - 0x804]
test ecx, ecx
je 0x401e4c
xor eax, eax
jmp 0x4021b6
lea edx, [ebp - 0x804]
push edx
call fcn.004da751
add esp, 4
push 0x400
push 0
lea eax, [ebp - 0x404]
push eax
call fcn.004d43c0
add esp, 0xc
call fcn.0040d250
mov ecx, eax
call fcn.00405860
push eax
push 0x511938
push 0x200
lea ecx, [ebp - 0x404]
push ecx
call fcn.004058e0
add esp, 0x10
mov edx, 2
imul eax, edx, 0x1ff
movzx ecx, word [ebp + eax - 0x404]
test ecx, ecx
je 0x401eb5
xor eax, eax
jmp 0x4021b6
lea edx, [ebp - 0x404]
mov dword [ebp - 0x810], edx
mov eax, dword [ebp - 0x810]
add eax, 2
mov dword [ebp - 0x834], eax
mov ecx, dword [ebp - 0x810]
mov dx, word [ecx]
mov word [ebp - 0x818], dx
add dword [ebp - 0x810], 2
cmp word [ebp - 0x818], 0
jne 0x401ed0
mov eax, dword [ebp - 0x810]
sub eax, dword [ebp - 0x834]
sar eax, 1
mov dword [ebp - 0x838], eax
mov ecx, dword [ebp - 0x838]
mov dword [ebp - 0x808], ecx
cmp dword [ebp - 0x808], 0
jbe 0x401f60
mov edx, dword [ebp - 0x808]
movzx eax, word [ebp + edx*2 - 0x406]
cmp eax, 0x5c
jne 0x401f60
mov ecx, dword [ebp - 0x808]
lea edx, [ecx + ecx - 2]
mov dword [ebp - 0x824], edx
cmp dword [ebp - 0x824], 0x400
jae 0x401f4b
jmp 0x401f50
call fcn.004d1984
xor eax, eax
mov ecx, dword [ebp - 0x824]
mov word [ebp + ecx - 0x404], ax
push 0x400
push 0
lea edx, [ebp - 0x804]
push edx
call fcn.004d43c0
add esp, 0xc
lea eax, [ebp - 0x404]
push eax
push str.HRDATADIR_s
push 0x200
lea ecx, [ebp - 0x804]
push ecx
call fcn.004058e0
add esp, 0x10
mov edx, 2
imul eax, edx, 0x1ff
movzx ecx, word [ebp + eax - 0x804]
test ecx, ecx
je 0x401fb4
xor eax, eax
jmp 0x4021b6
lea edx, [ebp - 0x804]
push edx
call fcn.004da751
add esp, 4
push 0x200
lea eax, [ebp - 0x404]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
cmp eax, 0x200
jbe 0x401fe3
xor eax, eax
jmp 0x4021b6
lea ecx, [ebp - 0x404]
mov dword [ebp - 0x814], ecx
mov edx, dword [ebp - 0x814]
add edx, 2
mov dword [ebp - 0x83c], edx
mov eax, dword [ebp - 0x814]
mov cx, word [eax]
mov word [ebp - 0x81a], cx
add dword [ebp - 0x814], 2
cmp word [ebp - 0x81a], 0
jne 0x401ffe
mov edx, dword [ebp - 0x814]
sub edx, dword [ebp - 0x83c]
sar edx, 1
mov dword [ebp - 0x840], edx
mov eax, dword [ebp - 0x840]
mov dword [ebp - 0x808], eax
cmp dword [ebp - 0x808], 0
jbe 0x40208e
mov ecx, dword [ebp - 0x808]
movzx edx, word [ebp + ecx*2 - 0x406]
cmp edx, 0x5c
jne 0x40208e
mov eax, dword [ebp - 0x808]
lea ecx, [eax + eax - 2]
mov dword [ebp - 0x828], ecx
cmp dword [ebp - 0x828], 0x400
jae 0x402079
jmp 0x40207e
call fcn.004d1984
xor edx, edx
mov eax, dword [ebp - 0x828]
mov word [ebp + eax - 0x404], dx
push 0x400
push 0
lea ecx, [ebp - 0x804]
push ecx
call fcn.004d43c0
add esp, 0xc
lea edx, [ebp - 0x404]
push edx
push str.SYSTEMDIR_sSystem32
push 0x200
lea eax, [ebp - 0x804]
push eax
call fcn.004058e0
add esp, 0x10
mov ecx, 2
imul edx, ecx, 0x1ff
movzx eax, word [ebp + edx - 0x804]
test eax, eax
je 0x4020e2
xor eax, eax
jmp 0x4021b6
lea ecx, [ebp - 0x804]
push ecx
call fcn.004da751
add esp, 4
push 0x400
push 0
lea edx, [ebp - 0x804]
push edx
call fcn.004d43c0
add esp, 0xc
lea eax, [ebp - 0x404]
push eax
push str.DRIVERDIR_sSystem32drivers
push 0x200
lea ecx, [ebp - 0x804]
push ecx
call fcn.004058e0
add esp, 0x10
mov edx, 2
imul eax, edx, 0x1ff
movzx ecx, word [ebp + eax - 0x804]
test ecx, ecx
je 0x402142
xor eax, eax
jmp 0x4021b6
lea edx, [ebp - 0x804]
push edx
call fcn.004da751
add esp, 4
push 0x400
push 0
lea eax, [ebp - 0x804]
push eax
call fcn.004d43c0
add esp, 0xc
lea ecx, [ebp - 0x404]
push ecx
push str.SYSWOWDIR_sSysWOW64
push 0x200
lea edx, [ebp - 0x804]
push edx
call fcn.004058e0
add esp, 0x10
mov eax, 2
imul ecx, eax, 0x1ff
movzx edx, word [ebp + ecx - 0x804]
test edx, edx
je 0x4021a2
xor eax, eax
jmp 0x4021b6
lea eax, [ebp - 0x804]
push eax
call fcn.004da751
add esp, 4
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004d181f
mov esp, ebp
pop ebp
ret