Function at 0x41b560
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x66db88
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push esi
push edi
mov eax, dword [0x726100]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x10], 0
call fcn.00411760
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0
call fcn.00423b90
mov eax, dword [ebp + 0xc]
mov byte [ebp - 4], 1
cmp eax, 6
ja case.default.0x41b5ba
jmp dword [eax*4 + 0x41b850]
mov edx, dword [ebp - 0x1c]
mov ecx, 1
mov eax, dword [edx - 8]
sub ecx, dword [edx - 4]
sub eax, 0x104
or ecx, eax
jge 0x41b5e8
push 0x104
lea ecx, [ebp - 0x1c]
call fcn.004049c0
mov edx, dword [ebp - 0x1c]
push 0x104
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov eax, dword [ebp - 0x1c]
push dword [eax - 8]
push eax
call fcn.0063465b
mov ecx, eax
add esp, 8
test ecx, ecx
js 0x41b64d
mov eax, dword [ebp - 0x1c]
cmp ecx, dword [eax - 8]
jg 0x41b64d
mov dword [eax - 0xc], ecx
xor edx, edx
mov eax, dword [ebp - 0x1c]
mov word [eax + ecx*2], dx
lea eax, [ebp - 0x20]
mov ecx, dword [ebp + 8]
push eax
call fcn.00412fc0
lea ecx, [ebp - 0x28]
call fcn.00423be0
lea ecx, [ebp - 0x20]
call fcn.004117a0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0x80070057
call fcn.00404730
mov edx, dword [ebp - 0x1c]
mov ecx, 1
mov eax, dword [edx - 8]
sub ecx, dword [edx - 4]
sub eax, 0x104
or ecx, eax
jge 0x41b67e
push 0x104
lea ecx, [ebp - 0x1c]
call fcn.004049c0
mov edx, dword [ebp - 0x1c]
push 0x104
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
jmp 0x41b5f4
mov edx, dword [ebp - 0x1c]
mov ecx, 1
mov eax, dword [edx - 8]
sub ecx, dword [edx - 4]
sub eax, 0x104
or ecx, eax
jge 0x41b6b6
push 0x104
lea ecx, [ebp - 0x1c]
call fcn.004049c0
mov edx, dword [ebp - 0x1c]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
jmp 0x41b5f4
push 0xf003f
push 0
push dword [0x725094]
lea ecx, [ebp - 0x28]
call fcn.00423d90
push 0x6910b0
push dword [0x72509c]
lea eax, [ebp + 0xc]
push eax
lea ecx, [ebp - 0x28]
call fcn.00423df0
mov byte [ebp - 4], 2
mov edi, dword [ebp + 8]
lea esi, [edi + 4]
mov dword [ebp - 0x14], esi
mov eax, dword [eax]
sub eax, 0x10
push eax
call fcn.00404750
add eax, 0x10
mov byte [ebp - 4], 1
mov dword [esi], eax
add esp, 4
mov esi, dword [ebp + 0xc]
or eax, 0xffffffff
add esi, 0xfffffff0
mov dword [edi], vtable.CPathEx.0
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x41b738
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
lea ecx, [ebp - 0x28]
call fcn.00423be0
lea ecx, [ebp - 0x20]
call fcn.004117a0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0xf003f
push 0
push dword [0x725094]
lea ecx, [ebp - 0x28]
call fcn.00423d90
push 0x6910b0
push dword [0x725098]
lea eax, [ebp + 0xc]
push eax
lea ecx, [ebp - 0x28]
call fcn.00423df0
mov byte [ebp - 4], 3
jmp 0x41b6f7
lea eax, [ebp - 0x18]
push 5
push eax
call fcn.0041bee0
add esp, 8
mov byte [ebp - 4], 4
test eax, eax
je 0x41b7ab
add eax, 4
jmp 0x41b7ad
xor eax, eax
mov edi, dword [ebp + 8]
lea esi, [edi + 4]
mov dword [ebp + 0xc], esi
mov eax, dword [eax]
sub eax, 0x10
push eax
call fcn.00404750
add esp, 4
lea ecx, [ebp - 0x18]
add eax, 0x10
mov dword [esi], eax
mov dword [edi], vtable.CPathEx.0
call fcn.004093e0
jmp 0x41b738
mov edx, dword [ebp - 0x1c]
mov ecx, 1
mov eax, dword [edx - 8]
sub ecx, dword [edx - 4]
sub eax, 0x104
or ecx, eax
jge 0x41b803
push 0x104
lea ecx, [ebp - 0x1c]
call fcn.004049c0
mov edx, dword [ebp - 0x1c]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
jmp 0x41b5f4
mov esi, dword [ebp + 8]
push 0x691138
lea ecx, [esi + 4]
call fcn.00403070
lea ecx, [ebp - 0x28]
mov dword [esi], vtable.CPathEx.0
call fcn.00423be0
lea ecx, [ebp - 0x20]
call fcn.004117a0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret