Function at 0x41c7be
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x70]
sub esp, 0xd0
push ebx
xor ebx, ebx
cmp dword [0x4e321c], ebx
push esi
push edi
jne 0x41c7e1
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov dword [0x4e321c], eax
call fcn.00410193
call fcn.00406378
call fcn.00414751
mov esi, 0x4e3110
push ebx
mov ecx, esi
call fcn.00410e13
call fcn.00406210
mov edi, 0x4e3d84
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x4e2d48]
or eax, dword [0x4e2d4c]
jne 0x41c826
push 0x4e2d48
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0x4e2d50
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
push 0x4e3044
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
push ebx
push 0x39ff
call fcn.00413915
push 0xd6fd2
push 0x311f1
lea eax, [ebp - 0x60]
push str._06lu_06lu
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x18
lea eax, [ebp - 0x60]
push eax
push 0x4ca922
mov ecx, esi
call fcn.00445c44
lea eax, [ebp - 0x60]
push eax
push str.PECMDVER
mov ecx, esi
call fcn.00445c44
push str.X86_U
lea ecx, [ebp + 0x68]
call fcn.004505eb
push dword [0x4e1100]
lea ecx, [ebp + 0x68]
call fcn.004465fa
push dword [ebp + 0x68]
mov ecx, esi
push 0x4ca8f8
call fcn.00445c44
push 0x4ca8f4
push 0x4ca8e4
mov ecx, esi
call fcn.00445c94
push ebx
push 0x3a0c
call fcn.00413915
call fcn.00413773
push ebx
push 0x3a0e
call fcn.00413915
mov eax, dword [ebp + 0x78]
add esp, 0x10
cmp dword [0x4e2c88], ebx
mov dword [0x4e2fc8], eax
jne 0x41c8f8
mov dword [0x4e2c88], eax
mov eax, dword [ebp + 0x7c]
mov dword [0x4e12bc], eax
call fcn.00440818
push str.WM_TaskbarRestart
push dword [0x4e3274]
mov esi, 0x4e3110
push esi
call fcn.00448c53
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
add esp, 0xc
push str.__PID
call edi
push eax
push esi
call fcn.00448c53
add esp, 0xc
call edi
push eax
call fcn.00404ea4
mov dword [esp], str.__PPID
push eax
push esi
call fcn.00448c53
push str.__HINST
push dword [0x4e2fc8]
push esi
call fcn.00448c53
add esp, 0x18
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 0x4ca878
push eax
push esi
mov dword [0x4e2e7c], eax
call fcn.00448c53
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetTickCount]
add eax, 0x3a17
push ebx
push eax
call fcn.00413915
movzx eax, word [0x4e6018]
push str.SYSCODEPAGE
push eax
push esi
call fcn.00448c53
add esp, 0x14
push 0x20a
lea ecx, [ebp + 0x6c]
call fcn.004465ac
push dword [ebp + 0x6c]
mov edi, 0x208
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push dword [ebp + 0x6c]
mov ecx, esi
push 0x4ca518
call fcn.00445c94
push dword [ebp + 0x6c]
mov ecx, esi
push str._CD
call fcn.00445c94
mov eax, dword [ebp + 0x6c]
mov word [eax + 4], bx
push dword [ebp + 0x6c]
mov ecx, esi
push str.CurDrv
call fcn.00445c94
mov eax, dword [ebp + 0x6c]
push edi
push eax
push ebx
mov word [eax], bx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push dword [ebp + 0x6c]
mov ecx, esi
push str.CurFile
call fcn.00445c94
call fcn.00413925
lea ecx, [ebp + 0x6c]
call fcn.0043fe25
lea ecx, [ebp + 0x68]
call fcn.0043fe25
pop edi
pop esi
pop ebx
add ebp, 0x70
leave
ret