Function at 0x4019da
Capabilities:
Get common file path

Disassembly:
push ebp
mov edx, 0x97
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x4019e0
call fcn.00419540
mov edx, dword [esp + 0x264]
lea ecx, [esp]
call fcn.00412060
push edx
call fcn.00419490
pop edx
push eax
push edx
call fcn.00419490
pop edx
push eax
push 0x104
call fcn.00412dd0
lea eax, [esp + 8]
push eax
call fcn.004196c0
push edx
call fcn.00419490
pop edx
push eax
push edx
call fcn.00419490
pop edx
push eax
push 0x104
call fcn.00412dd0
lea eax, [esp + 0xc]
push eax
call fcn.004196c0
push 0x104
push dword [esp + 8]
call sub.KERNEL32.dll_GetSystemDirectoryW
mov eax, str.winlogon.exe
push eax
push dword [esp + 8]
call sub.KERNEL32.dll_lstrcatW
push edx
call fcn.00419490
pop edx
push eax
push dword [esp + 8]
call fcn.0040ccf8
lea eax, [esp + 8]
push eax
call fcn.004196c0
push edx
call fcn.00419490
pop edx
push eax
push dword [esp + 4]
call fcn.0040ccf8
lea eax, [esp + 4]
push eax
call fcn.004196c0
mov dword [esp + 0xc], 0
mov eax, str.Kernel32.dll
push eax
push 0
call fcn.00415d77
and eax, eax
je 0x401cda
mov eax, str.CreateToolhelp32Snapshot
push eax
push 0
call fcn.00415dd1
mov dword [esp + 0x10], eax
mov eax, str.Process32First
push eax
push 0
call fcn.00415dd1
mov dword [esp + 0x14], eax
mov eax, str.Process32Next
push eax
push 0
call fcn.00415dd1
mov dword [esp + 0x18], eax
cmp dword [esp + 0x10], 0
je 0x401b0d
cmp dword [esp + 0x14], 0
je 0x401b0d
mov eax, 1
jmp 0x401b0f
xor eax, eax
and eax, eax
je 0x401b21
cmp dword [esp + 0x18], 0
je 0x401b21
mov eax, 1
jmp 0x401b23
xor eax, eax
and eax, eax
je 0x401cd0
lea ebp, [esp + 0x1c]
mov dword [ebp], 0x22c
push 0
push 2
push dword [esp + 0x18]
call fcn.00415f38
mov dword [esp + 0x248], eax
cmp dword [esp + 0x248], 0
je 0x401cc4
lea eax, [esp + 0x1c]
push eax
push dword [esp + 0x24c]
push dword [esp + 0x1c]
call fcn.00415f38
mov dword [esp + 0x24c], eax
cmp dword [esp + 0x24c], 0
je 0x401cc4
push edx
call fcn.00419490
pop edx
push eax
push edx
call fcn.00419490
pop edx
push eax
push edx
call fcn.00419490
pop edx
push eax
push 0x18
push 0xffffffff
lea ebp, [esp + 0x30]
lea eax, [ebp + 0x24]
push eax
call fcn.00419010
call fcn.004121b2
add dword [esp], edx
call fcn.0040ccf8
lea eax, [esp + 0x254]
push eax
call fcn.004196c0
push edx
call fcn.00419490
pop edx
push eax
push edx
call fcn.00419490
pop edx
push eax
push dword [esp + 0x258]
call fcn.0041619e
lea eax, [esp + 0x254]
push eax
call fcn.004196c0
push dword [esp + 0x250]
mov edx, dword [esp + 4]
pop ecx
call fcn.004121e0
je 0x401ca3
lea ebp, [esp + 0x1c]
push dword [ebp + 8]
push 0
push 0x400
call sub.KERNEL32.dll_OpenProcess
mov dword [esp + 0x254], eax
push 0x104
push dword [esp + 0xc]
push 0
push dword [esp + 0x260]
call fcn.004024b4
push edx
call fcn.00419490
pop edx
push eax
push dword [esp + 4]
call fcn.0040ccf8
call fcn.004194d0
push edx
call fcn.00419490
pop edx
push eax
push dword [esp + 0x10]
call fcn.0040ccf8
call fcn.00412220
mov edx, eax
call fcn.00412220
mov ecx, eax
call fcn.004121e0
je 0x401c8d
lea ebp, [esp + 0x1c]
mov eax, dword [ebp + 8]
jmp 0x401ce5
mov dword [esp + 0xc], 1
lea ebp, [esp + 0x1c]
mov eax, dword [ebp + 8]
mov dword [esp + 0x258], eax
lea eax, [esp + 0x1c]
push eax
push dword [esp + 0x24c]
push dword [esp + 0x20]
call fcn.00415f38
mov dword [esp + 0x24c], eax
jmp 0x401b7a
push dword [esp + 0x248]
call sub.KERNEL32.dll_CloseHandle
push 0
call fcn.00415cb7
mov eax, dword [esp + 0x258]
jmp 0x401ce5
push dword [esp + 0x250]
call fcn.00419630
push dword [esp]
call fcn.00419630
push dword [esp + 8]
call fcn.00419630
push dword [esp + 4]
call fcn.00419630
add esp, 0x25c
pop ebp
ret 4