Function at 0x40be2d
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a8
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
test ebx, ebx
je 0x40c1d8
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x40c1d8
and dword [ebp - 0x14], 0
lea ecx, [ebp - 8]
and dword [ebp - 0x10], 0
push str.WindowsSystem32_ntdll.dll
push ebx
call fcn.0043b487
mov edx, eax
lea ecx, [ebp - 0xc]
call fcn.0043ab55
pop ecx
push 0
lea edx, [ebp - 0x14]
mov ecx, dword [eax]
call fcn.0044c96a
pop ecx
mov ecx, dword [ebp - 0xc]
mov edi, eax
add ecx, 0xfffffff0
call fcn.0043c924
mov ecx, dword [ebp - 8]
add ecx, 0xfffffff0
call fcn.0043c924
test edi, edi
je 0x40bea0
mov eax, edi
jmp 0x40c1dd
mov edi, 0x60000
cmp dword [ebp - 0x10], edi
jae 0x40beb4
mov eax, 0x80004001
jmp 0x40c1dd
call fcn.0043c5cd
push eax
lea ecx, [ebp - 8]
call fcn.0043ac50
mov eax, 0x104
lea ecx, [ebp - 8]
push eax
push eax
call fcn.0043c822
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push eax
lea ecx, [ebp - 8]
call fcn.0043c894
mov edx, str.bcdboot.exe
lea ecx, [ebp - 8]
call fcn.0044b36a
cmp dword [ebp - 0x10], edi
jne 0x40bf1e
mov edi, dword [ebp - 8]
lea edx, [ebp - 0x14]
push 0
mov ecx, edi
call fcn.0044c96a
pop ecx
test eax, eax
jne 0x40bf14
cmp dword [ebp - 0x10], 0x60001
je 0x40bf95
mov ebx, 0x80004001
jmp 0x40c01f
push str.Configx86
mov edx, 0x4ab30c
lea ecx, [ebp - 0xc]
call fcn.0043ab55
pop ecx
mov edx, str.bcdboot.exe
lea ecx, [ebp - 0xc]
call fcn.0044b36a
mov esi, dword [ebp - 0xc]
lea edx, [ebp - 0x1c]
push 0
mov ecx, esi
call fcn.0044c96a
mov edi, dword [ebp - 8]
pop ecx
mov ecx, edi
test eax, eax
jne 0x40bff3
push eax
lea edx, [ebp - 0x14]
call fcn.0044c96a
pop ecx
test eax, eax
jne 0x40bf7b
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x18]
ja 0x40bf8a
jb 0x40bf7b
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x1c]
jae 0x40bf8a
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 8]
call fcn.0043b599
mov edi, dword [ebp - 8]
lea ecx, [esi - 0x10]
call fcn.0043c924
mov esi, dword [ebp + 0xc]
mov ecx, ebx
call fcn.0044b5a0
lea edx, [ebp - 0xac]
mov dword [ebp - 0xc], eax
mov ecx, eax
call fcn.0044b6fe
lea ecx, [ebp - 0xc]
mov ebx, eax
call fcn.0043ab9a
test ebx, ebx
jne 0x40c01f
mov ecx, esi
call fcn.0044b5a0
lea edx, [ebp - 0x1a4]
mov dword [ebp - 0xc], eax
mov ecx, eax
call fcn.0044b6fe
lea ecx, [ebp - 0xc]
mov ebx, eax
call fcn.0043ab9a
test ebx, ebx
jne 0x40c01f
mov eax, dword [ebp + 0x10]
sub eax, 1
je 0x40c02e
sub eax, 1
je 0x40c00a
mov ebx, 0x80070057
jmp 0x40c01f
call fcn.0044c9a8
cmp eax, 1
je 0x40bf8a
lea ecx, [esi - 0x10]
call fcn.0043c924
jmp 0x40bf14
cmp dword [ebp - 0xac], 1
jne 0x40c01c
cmp dword [ebp - 0x1a4], 1
je 0x40c04e
push 0xb
pop ebx
lea ecx, [edi - 0x10]
call fcn.0043c924
mov eax, ebx
jmp 0x40c1dd
cmp dword [ebp - 0xac], 0
jne 0x40c01c
cmp dword [ebp - 0x1a4], 0
jne 0x40c01c
mov al, byte [ebp - 0x8c]
cmp al, 5
je 0x40c01c
cmp al, 0xf
je 0x40c01c
call fcn.0043c5cd
push eax
lea ecx, [ebp - 8]
call fcn.0043ac50
push 0
push 0x32
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_GetThreadLocale]
movzx eax, ax
push eax
call dword [sym.imp.KERNEL32.dll_LCIDToLocaleName]
lea eax, [esi + 0x1c]
push eax
lea eax, [ebp - 0x114]
push eax
push dword [ebp + 8]
lea eax, [ebp - 8]
push str.Bcdboot__sWindows__l__s__s__s
push eax
call fcn.0043b543
add esp, 0x14
lea edx, [ebp - 0x14]
mov ecx, edi
push 0
call fcn.0044c96a
mov ebx, eax
pop ecx
test ebx, ebx
jne 0x40c1c8
call sym.Dismx86.exe_BcdGetFirmwareType
mov ecx, dword [sym.imp.msvcrt.dll_wcslen]
cmp eax, dword [ebp + 0x10]
je 0x40c0ff
cmp dword [ebp - 0x10], 0x10006
jae 0x40c0d0
mov ebx, 0x80004002
jmp 0x40c1c8
mov eax, dword [ebp + 0x10]
sub eax, 1
je 0x40c0ec
sub eax, 1
je 0x40c0e5
push 0x57
pop ebx
jmp 0x40c1c8
mov esi, str.__f_UEFI
jmp 0x40c0f1
mov esi, str.__f_BIOS
push esi
call ecx
pop ecx
push eax
push esi
lea ecx, [ebp - 8]
call fcn.0043b96c
mov eax, dword [ebp - 8]
add eax, 0xfffffff0
push ecx
mov ecx, eax
mov dword [ebp - 0xc], eax
mov esi, esp
call fcn.0043baa0
add eax, 0x10
xor dl, dl
mov ecx, edi
mov dword [esi], eax
call fcn.0044a960
mov ebx, eax
pop ecx
cmp ebx, 0x3f1
jne 0x40c189
push dword [ebp + 0xc]
lea ecx, [ebp + 8]
call fcn.0043b487
cmp dword [ebp + 0x10], 1
mov esi, str._boot
je 0x40c146
mov esi, str.efi
push esi
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
push eax
push esi
lea ecx, [ebp + 8]
call fcn.0043b96c
mov esi, dword [ebp + 8]
xor edx, edx
inc edx
mov ecx, esi
call fcn.0044bfcd
push ecx
mov ecx, dword [ebp - 0xc]
mov ebx, esp
call fcn.0043baa0
add eax, 0x10
xor dl, dl
mov ecx, edi
mov dword [ebx], eax
call fcn.0044a960
pop ecx
lea ecx, [esi - 0x10]
mov ebx, eax
call fcn.0043c924
test ebx, ebx
jne 0x40c1c8
cmp dword [ebp + 0x10], 1
jne 0x40c19d
mov ecx, dword [ebp + 0xc]
call fcn.0044a1a4
jmp 0x40c1bb
cmp dword [ebp + 0x10], 2
jne 0x40c1c8
call sym.Dismx86.exe_BcdGetFirmwareType
cmp eax, 2
jne 0x40c1c8
mov ecx, dword [ebp + 0xc]
call fcn.004036d7
test eax, eax
je 0x40c1c8
jg 0x40c1bf
mov ebx, eax
jmp 0x40c1c8
movzx ebx, ax
or ebx, 0x80070000
mov ecx, dword [ebp - 8]
lea ecx, [ecx - 0x10]
call fcn.0043c924
jmp 0x40c01f
mov eax, 0x80070057
pop edi
pop esi
pop ebx
leave
ret 0xc