Function at 0x402390
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x6c
lea ebx, [ebp - 0x28]
mov dword [esp + 4], 0x10
mov dword [esp], ebx
call fcn.00409da0
mov dword [esp], ebx
call fcn.00409e90
cmp eax, 2
je 0x402703
cmp eax, 4
je 0x402483
call fcn.0040a010
test al, al
lea esi, [esi]
jne 0x4026d6
lea ebx, [ebp - 0x40]
mov ecx, ebx
mov dword [esp], 0x104
call fcn.0040ad30
mov edx, dword [ebp - 0x3c]
mov ecx, ebx
lea edi, [edx + 1]
sub esp, 4
call fcn.0040ac10
mov esi, dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov dword [esp + 4], edi
mov dword [esp], eax
call esi
sub esp, 8
cmp eax, dword [ebp - 0x3c]
ja 0x4024bb
test eax, eax
je 0x4026c0
cmp eax, dword [ebp - 0x3c]
je 0x4024fb
mov dword [esp], eax
mov ecx, ebx
call fcn.0040ac20
lea edi, [ebp - 0x44]
mov ecx, edi
lea esi, [ebp - 0x4c]
sub esp, 4
mov dword [esp], ebx
call fcn.0040b230
mov ecx, dword [ebp - 0x44]
mov edx, esi
mov dword [ebp - 0x60], esi
lea esi, [ebp - 0x30]
mov eax, dword [ecx - 0xc]
mov dword [ebp - 0x38], ecx
lea ecx, [ebp - 0x38]
sub esp, 4
mov dword [ebp - 0x30], str.Sysnative
mov dword [ebp - 0x2c], 9
mov dword [ebp - 0x34], eax
mov dword [esp + 0xc], 1
mov dword [esp + 8], esi
mov dword [ebp - 0x5c], ecx
mov dword [esp + 4], ecx
mov dword [esp], edx
jmp 0x402547
lea ebx, [ebp - 0x40]
mov ecx, ebx
mov dword [esp], 0x104
call fcn.0040ad30
mov eax, dword [ebp - 0x3c]
mov ecx, ebx
lea esi, [eax + 1]
sub esp, 4
call fcn.0040ac10
mov dword [esp + 4], esi
mov esi, dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov dword [esp], eax
call esi
sub esp, 8
cmp eax, dword [ebp - 0x3c]
jbe 0x4024e1
mov dword [esp], eax
mov ecx, ebx
call fcn.0040ac20
mov ecx, ebx
mov edi, dword [ebp - 0x3c]
lea edi, [edi + 1]
sub esp, 4
call fcn.0040ac10
mov dword [esp + 4], edi
mov dword [esp], eax
call esi
sub esp, 8
test eax, eax
je 0x4026c0
cmp eax, dword [ebp - 0x3c]
je 0x4024fb
mov dword [esp], eax
mov ecx, ebx
call fcn.0040ac20
sub esp, 4
lea edi, [ebp - 0x44]
mov ecx, edi
mov dword [esp], ebx
call fcn.0040b230
mov eax, dword [ebp - 0x44]
lea ecx, [ebp - 0x4c]
lea edx, [ebp - 0x38]
mov dword [ebp - 0x60], ecx
mov dword [ebp - 0x5c], edx
mov esi, dword [eax - 0xc]
mov dword [ebp - 0x30], str.Sysnative
sub esp, 4
mov dword [ebp - 0x2c], 9
mov dword [ebp - 0x34], esi
lea esi, [ebp - 0x30]
mov dword [ebp - 0x38], eax
mov dword [esp + 0xc], 1
mov dword [esp + 8], esi
mov dword [esp + 4], edx
mov dword [esp], ecx
call fcn.00403d40
mov eax, dword [ebp - 0x44]
lea ecx, [eax - 0xc]
cmp ecx, 0x484aa4
jne 0x4027c3
mov ecx, dword [ebp - 0x4c]
mov dword [esp], ecx
call fcn.00409160
test eax, eax
je 0x402626
mov ecx, dword [ebp - 0x4c]
mov edx, dword [ebp - 0x5c]
mov eax, dword [ecx - 0xc]
mov dword [esp + 4], edx
mov dword [esp], edi
mov dword [esp + 0xc], 1
mov dword [esp + 8], esi
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], str.vmms.exe
mov dword [ebp - 0x2c], 8
call fcn.00403d40
mov edi, dword [ebp - 0x44]
mov dword [esp], edi
call fcn.004091c0
mov ecx, dword [ebp + 8]
test eax, eax
je 0x402610
mov dword [ecx], 1
lea ecx, [ecx + 4]
mov dword [esp + 4], esi
mov dword [esp], str.Hyper_V_is_disabled
call fcn.00455060
mov eax, dword [ebp - 0x44]
lea ecx, [eax - 0xc]
sub esp, 8
cmp ecx, 0x484aa4
jne 0x402787
mov edi, dword [ebp - 0x4c]
lea ecx, [edi - 0xc]
cmp ecx, 0x484aa4
jne 0x4027a5
mov ecx, ebx
call fcn.0040abf0
mov eax, dword [ebp + 8]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [ecx], 0
lea ecx, [ecx + 4]
mov dword [esp + 4], esi
mov dword [esp], str.Hyper_V_is_not_installed
jmp 0x4025cc
lea ecx, [ebp - 0x48]
mov dword [esp], ebx
call fcn.0040b230
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x5c]
mov edx, dword [eax - 0xc]
mov dword [ebp - 0x38], eax
sub esp, 4
mov dword [esp + 4], ecx
mov dword [esp + 0xc], 1
mov dword [esp + 8], esi
mov dword [esp], edi
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x30], str.System32
mov dword [ebp - 0x2c], 8
call fcn.00403d40
mov ecx, dword [ebp - 0x60]
mov dword [esp], edi
call fcn.00453bc0
mov eax, dword [ebp - 0x44]
lea ecx, [eax - 0xc]
sub esp, 4
cmp ecx, 0x484aa4
jne 0x4027e1
mov eax, dword [ebp - 0x48]
lea ecx, [eax - 0xc]
cmp ecx, 0x484aa4
je 0x402571
or edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x402571
mov dword [esp], esi
call fcn.00453930
push ecx
jmp 0x402571
mov dword [esp], str.C:Windows
mov ecx, ebx
call fcn.0040aea0
sub esp, 4
jmp 0x4024fb
mov ebx, dword [ebp + 8]
lea esi, [ebp - 0x30]
mov dword [ebx], 0
lea ecx, [ebx + 4]
mov dword [esp + 4], esi
mov dword [esp], str.Running_in_a_guest_VM__Hyper_V_is_not_supported
call fcn.00455060
mov eax, dword [ebp + 8]
sub esp, 8
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
lea ecx, [ebp - 0x30]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], ecx
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0x40000003
call fcn.00409ba0
mov edx, dword [ebp + 8]
test byte [ebp - 0x30], 1
je 0x402763
lea eax, [ebp - 0x38]
mov dword [edx], 2
lea ecx, [edx + 4]
mov dword [esp + 4], eax
mov dword [esp], str.Hyper_V_is_enabled
call fcn.00455060
sub esp, 8
jmp 0x4025ff
lea edi, [ebp - 0x38]
mov dword [edx], 0
lea ecx, [edx + 4]
mov dword [esp + 4], edi
mov dword [esp], str.Running_in_a_guest_Hyper_V_VM__Hyper_V_is_not_supported
call fcn.00455060
sub esp, 8
jmp 0x4025ff
or edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x4025e6
mov dword [esp], esi
call fcn.00453930
push edx
jmp 0x4025e6
or eax, 0xffffffff
lock xadd dword [edi - 4], eax
test eax, eax
jg 0x4025f8
mov dword [esp], esi
call fcn.00453930
push eax
jmp 0x4025f8
or edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x40255e
mov dword [esp], esi
call fcn.00453930
push eax
jmp 0x40255e
or edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x402689
mov dword [esp], esi
call fcn.00453930
push eax
jmp 0x402689