Function at 0x402b50
Capabilities:
Get common file path

Disassembly:
sub esp, 0x330
push ebx
push ebp
push esi
push edi
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x29]
mov byte [esp + 0x28], 0
rep stosd dword es:[edi], eax
mov ecx, 0x41
lea edi, [esp + 0x131]
mov byte [esp + 0x130], al
mov byte [esp + 0x238], al
rep stosd dword es:[edi], eax
mov ecx, 0x41
lea edi, [esp + 0x239]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x28]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edi, [esp + 0x28]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x130]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x130]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str._system32
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
mov ebx, dword [esp + 0x344]
lea eax, [esp + 0x28]
and ecx, 3
push eax
push ebx
rep movsb byte es:[edi], byte [esi]
call fcn.00405556
add esp, 8
test eax, eax
jne 0x402c28
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x330
ret
lea ecx, [esp + 0x130]
push ecx
push ebx
call fcn.00405556
add esp, 8
test eax, eax
jne 0x402c4d
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x330
ret
push str.c:_alsi_netmedico
push ebx
call fcn.00405556
add esp, 8
test eax, eax
jne 0x402c6f
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x330
ret
push str.c:_alsi_netmedico_
push ebx
call fcn.00405556
add esp, 8
test eax, eax
jne 0x402c91
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x330
ret
push str.c:Program_FilesInternet_Explorer
push ebx
call fcn.00405556
add esp, 8
test eax, eax
jne 0x402cb3
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x330
ret
push str.c:Program_FilesInternet_Explorer_
push ebx
call fcn.00405556
add esp, 8
test eax, eax
jne 0x402cd5
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x330
ret
push str.C:ALSIInterMANAGER
push ebx
call fcn.00405556
add esp, 8
test eax, eax
jne 0x402cf7
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x330
ret
push str.C:ALSIInterMANAGER_
push ebx
call fcn.00405556
add esp, 8
test eax, eax
jne 0x402d19
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x330
ret
mov edi, str.C:Documents_and_SettingsAll_Users
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push str.C:Documents_and_SettingsAll_Users
push ebx
call fcn.004056c4
add esp, 0xc
test eax, eax
jne 0x402d4b
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x330
ret
lea edx, [esp + 0x28]
push edx
push ebx
call fcn.00403540
add esp, 8
test eax, eax
jne 0x402d8d
push 0x5c
push ebx
call fcn.00405a27
push 0x5c
push ebx
mov esi, eax
call fcn.00405cac
add esp, 0x10
cmp eax, esi
jne 0x402f64
push 0x5c
push ebx
call fcn.00405cac
add esp, 8
test eax, eax
je 0x402f64
mov eax, dword [0x410e24]
mov ebp, dword [sym.imp.KERNEL32.dll_CreateFileA]
test eax, eax
jne 0x402ed5
push 8
call fcn.00405a92
mov dword [0x410e24], eax
or ecx, 0xffffffff
mov edi, 0x40e2c4
xor eax, eax
add esp, 4
lea edx, [esp + 0x28]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [esp + 0x238]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x28]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x238]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
mov edi, str.documents.prs
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x2000000
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push 3
push eax
and ecx, 3
push 5
lea eax, [esp + 0x24c]
push 0x80000000
push eax
rep movsb byte es:[edi], byte [esi]
call ebp
mov esi, eax
cmp esi, 0xffffffff
jne 0x402e8c
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0x2000000
push 3
push 0
push 5
lea ecx, [esp + 0x3c]
push 0x80000000
push ecx
call ebp
mov esi, eax
cmp esi, 0xffffffff
jne 0x402e8c
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x330
ret
lea edx, [esp + 0x10]
lea eax, [esp + 0x20]
push edx
lea ecx, [esp + 0x1c]
push eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileTime]
test eax, eax
jne 0x402eb6
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x330
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x410e24]
mov edx, dword [esp + 0x10]
mov dword [eax], edx
mov edx, dword [0x410e24]
mov ecx, dword [esp + 0x14]
mov dword [edx + 4], ecx
push 0
push 0x2000000
push 3
push 0
push 5
push 0x80000000
push ebx
call ebp
mov esi, eax
cmp esi, 0xffffffff
jne 0x402f01
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x330
ret
lea eax, [esp + 0x10]
lea ecx, [esp + 0x20]
push eax
lea edx, [esp + 0x1c]
push ecx
push edx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileTime]
test eax, eax
jne 0x402f2b
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x330
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call fcn.00401910
add esp, 4
test eax, eax
je 0x402f64
mov eax, dword [0x410e24]
lea ecx, [esp + 0x18]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CompareFileTime]
xor edx, edx
pop edi
test eax, eax
setle dl
pop esi
pop ebp
mov eax, edx
pop ebx
add esp, 0x330
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x330
ret