Function at 0x4098c3
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x424
push ebx
push esi
push edi
lea eax, [ebp - 0x424]
xor esi, esi
push 0x208
push eax
mov dword [ebp - 4], esi
mov dword [ebp - 0x10], 0xc
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
cmp dword [ebp + 0xc], esi
mov edi, dword [ebp + 8]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyA]
jne 0x409977
lea eax, [ebp - 0x21c]
push esi
push eax
push esi
push esi
push edi
call fcn.00412ee0
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
add esp, 0x14
lea eax, [ebp - 0x424]
push eax
push edi
call ebx
push edi
call fcn.00409f44
pop ecx
lea eax, [ebp - 0x21c]
push eax
push edi
call esi
push dword [ebp - 4]
lea eax, [ebp - 0x1c]
push 0x41c9d4
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x1c]
push eax
push edi
call esi
push str..MIF
push edi
call esi
push edi
call fcn.00409f75
test eax, eax
pop ecx
je 0x409975
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x3e7
jle 0x40991a
jmp 0x409bae
xor esi, esi
push esi
push 0x80000080
lea eax, [ebp - 0x10]
push 2
push eax
push esi
push 0x40000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x409bae
push dword [ebp + 0x14]
lea eax, [ebp - 0x11c]
push eax
call ebx
cmp byte [ebp - 0x11c], 0
lea eax, [ebp - 0x11c]
je 0x4099d1
mov cl, byte [eax]
cmp cl, 0xa
je 0x4099c2
cmp cl, 0xd
jne 0x4099c5
mov byte [eax], 0x20
push eax
call dword [sym.imp.USER32.dll_CharNextA]
cmp byte [eax], 0
jne 0x4099b6
push str.Start_Component_r_n
push esi
call fcn.00409e9f
pop ecx
test eax, eax
pop ecx
je 0x409ba7
push str._tName___Workstation__r_n
push esi
call fcn.00409e9f
pop ecx
test eax, eax
pop ecx
je 0x409ba7
push str._tStart_Group_r_n
push esi
call fcn.00409e9f
pop ecx
test eax, eax
pop ecx
je 0x409ba7
push str._t_tName___InstallStatus__r_n
push esi
call fcn.00409e9f
pop ecx
test eax, eax
pop ecx
je 0x409ba7
push str._t_tID__1_r_n
push esi
call fcn.00409e9f
pop ecx
test eax, eax
pop ecx
je 0x409ba7
push str._t_tClass___MICROSOFTJOBSTATUS1.0__r_n
push esi
call fcn.00409e9f
pop ecx
test eax, eax
pop ecx
je 0x409ba7
push str._t_tStart_Attribute_r_n
push esi
call fcn.00409e9f
pop ecx
test eax, eax
pop ecx
je 0x409ba7
push str._t_t_tName___Status__r_n
push esi
call fcn.00409e9f
pop ecx
test eax, eax
pop ecx
je 0x409ba7
push str._t_t_tID__1_r_n
push esi
call fcn.00409e9f
pop ecx
test eax, eax
pop ecx
je 0x409ba7
push str._t_t_tType__String_16__r_n
push esi
call fcn.00409e9f
pop ecx
test eax, eax
pop ecx
je 0x409ba7
mov ebx, str._t_t_tValue_
push ebx
push esi
call fcn.00409e9f
pop ecx
test eax, eax
pop ecx
je 0x409ba7
cmp dword [ebp + 0x10], 0
mov eax, str._SUCCESS__r_n
jne 0x409ac9
mov eax, str._FAILED__r_n
push eax
push esi
call fcn.00409e9f
pop ecx
test eax, eax
pop ecx
je 0x409ba7
mov edi, str._t_tEnd_Attribute_r_n
push edi
push esi
call fcn.00409e9f
pop ecx
test eax, eax
pop ecx
je 0x409ba7
push str._t_tStart_Attribute_r_n
push esi
call fcn.00409e9f
pop ecx
test eax, eax
pop ecx
je 0x409ba7
push str._t_t_tName___Description__r_n
push esi
call fcn.00409e9f
pop ecx
test eax, eax
pop ecx
je 0x409ba7
push str._t_t_tID__2_r_n
push esi
call fcn.00409e9f
pop ecx
test eax, eax
pop ecx
je 0x409ba7
push str._t_t_tType__String_256__r_n
push esi
call fcn.00409e9f
pop ecx
test eax, eax
pop ecx
je 0x409ba7
push ebx
push esi
call fcn.00409e9f
pop ecx
test eax, eax
pop ecx
je 0x409ba7
lea eax, [ebp - 0x11c]
push eax
push esi
call fcn.00409e9f
pop ecx
test eax, eax
pop ecx
je 0x409ba7
push 0x41c05c
push esi
call fcn.00409e9f
pop ecx
test eax, eax
pop ecx
je 0x409ba7
push edi
push esi
call fcn.00409e9f
pop ecx
test eax, eax
pop ecx
je 0x409ba7
push str._tEnd_Group_r_n
push esi
call fcn.00409e9f
pop ecx
test eax, eax
pop ecx
je 0x409ba7
push str.End_Component_r_n
push esi
call fcn.00409e9f
pop ecx
test eax, eax
pop ecx
je 0x409ba7
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x409bae
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
leave
ret