Function at 0x409790
Capabilities:
Get common file path
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x4241dc]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov esi, ecx
push 0x104
lea eax, [ebp - 0x108]
push eax
mov dword [esi], vtable.DynamicLoadLibraryHelper.0
mov dword [esi + 4], 0
mov byte [esi + 8], 1
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x40981a
push 0x41a47c
lea eax, [ebp - 0x108]
push 0x104
push eax
call fcn.00410275
push str.kernel32.dll
lea eax, [ebp - 0x108]
push 0x104
push eax
call fcn.00410275
add esp, 0x18
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [esi + 4], eax
test eax, eax
je 0x409816
cmp eax, 0xffffffff
jne 0x40981a
mov byte [esi + 8], 0
mov eax, dword [esi + 4]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
xor ecx, ecx
mov dword [esi], vtable.Kernel32DllHelper.0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov dword [esi + 0x54], 0
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [esi + 0x68], 0
test eax, eax
je 0x4098e6
cmp eax, 0xffffffff
je 0x4098e6
push str.GetUserDefaultUILanguage
push eax
call edi
mov ecx, eax
mov eax, dword [esi + 4]
mov dword [esi + 0x20], ecx
xor ecx, ecx
test eax, eax
je 0x409905
cmp eax, 0xffffffff
je 0x409905
push 0x41b5c4
push eax
call edi
mov ecx, eax
test ecx, ecx
jne 0x409909
mov byte [esi + 8], 0
mov eax, dword [esi + 4]
mov dword [esi + 0xc], ecx
xor ecx, ecx
test eax, eax
je 0x409928
cmp eax, 0xffffffff
je 0x409928
push 0x41b5d8
push eax
call edi
mov ecx, eax
test ecx, ecx
jne 0x40992c
mov byte [esi + 8], 0
mov eax, dword [esi + 4]
mov dword [esi + 0x10], ecx
xor ecx, ecx
test eax, eax
je 0x40994b
cmp eax, 0xffffffff
je 0x40994b
push str.CreateProcessW
push eax
call edi
mov ecx, eax
test ecx, ecx
jne 0x40994f
mov byte [esi + 8], 0
mov eax, dword [esi + 4]
mov dword [esi + 0x14], ecx
xor ecx, ecx
test eax, eax
je 0x40996e
cmp eax, 0xffffffff
je 0x40996e
push 0x41b5f4
push eax
call edi
mov ecx, eax
test ecx, ecx
jne 0x409972
mov byte [esi + 8], 0
mov eax, dword [esi + 4]
mov dword [esi + 0x18], ecx
xor ecx, ecx
test eax, eax
je 0x409991
cmp eax, 0xffffffff
je 0x409991
push 0x41b600
push eax
call edi
mov ecx, eax
test ecx, ecx
jne 0x409995
mov byte [esi + 8], 0
mov eax, dword [esi + 4]
mov dword [esi + 0x1c], ecx
xor ecx, ecx
test eax, eax
je 0x4099b4
cmp eax, 0xffffffff
je 0x4099b4
push str.MoveFileExA
push eax
call edi
mov ecx, eax
test ecx, ecx
jne 0x4099b8
mov byte [esi + 8], 0
mov eax, dword [esi + 4]
mov dword [esi + 0x24], ecx
xor ecx, ecx
test eax, eax
je 0x4099d7
cmp eax, 0xffffffff
je 0x4099d7
push str.MoveFileExW
push eax
call edi
mov ecx, eax
test ecx, ecx
jne 0x4099db
mov byte [esi + 8], 0
mov eax, dword [esi + 4]
mov dword [esi + 0x28], ecx
xor ecx, ecx
test eax, eax
je 0x4099fa
cmp eax, 0xffffffff
je 0x4099fa
push 0x41b62c
push eax
call edi
mov ecx, eax
test ecx, ecx
jne 0x4099fe
mov byte [esi + 8], 0
mov eax, dword [esi + 4]
mov dword [esi + 0x2c], ecx
xor ecx, ecx
test eax, eax
je 0x409a1d
cmp eax, 0xffffffff
je 0x409a1d
push 0x41b640
push eax
call edi
mov ecx, eax
test ecx, ecx
jne 0x409a21
mov byte [esi + 8], 0
mov eax, dword [esi + 4]
mov dword [esi + 0x30], ecx
xor ecx, ecx
test eax, eax
je 0x409a40
cmp eax, 0xffffffff
je 0x409a40
push str.ExpandEnvironmentStringsW
push eax
call edi
mov ecx, eax
test ecx, ecx
jne 0x409a44
mov byte [esi + 8], 0
mov eax, dword [esi + 4]
mov dword [esi + 0x34], ecx
xor ecx, ecx
test eax, eax
je 0x409a63
cmp eax, 0xffffffff
je 0x409a63
push 0x41b670
push eax
call edi
mov ecx, eax
test ecx, ecx
jne 0x409a67
mov byte [esi + 8], 0
mov eax, dword [esi + 4]
mov dword [esi + 0x38], ecx
xor ecx, ecx
test eax, eax
je 0x409a86
cmp eax, 0xffffffff
je 0x409a86
push 0x41b680
push eax
call edi
mov ecx, eax
test ecx, ecx
jne 0x409a8a
mov byte [esi + 8], 0
mov eax, dword [esi + 4]
mov dword [esi + 0x3c], ecx
xor ecx, ecx
test eax, eax
je 0x409aa9
cmp eax, 0xffffffff
je 0x409aa9
push 0x41b690
push eax
call edi
mov ecx, eax
test ecx, ecx
jne 0x409aad
mov byte [esi + 8], 0
mov eax, dword [esi + 4]
mov dword [esi + 0x40], ecx
xor ecx, ecx
test eax, eax
je 0x409acc
cmp eax, 0xffffffff
je 0x409acc
push 0x41b6a4
push eax
call edi
mov ecx, eax
test ecx, ecx
jne 0x409ad0
mov byte [esi + 8], 0
mov eax, dword [esi + 4]
mov dword [esi + 0x44], ecx
xor ecx, ecx
test eax, eax
je 0x409aef
cmp eax, 0xffffffff
je 0x409aef
push str.GetFileAttributesExW
push eax
call edi
mov ecx, eax
test ecx, ecx
jne 0x409af3
mov byte [esi + 8], 0
mov eax, dword [esi + 4]
mov dword [esi + 0x48], ecx
xor ecx, ecx
test eax, eax
je 0x409b12
cmp eax, 0xffffffff
je 0x409b12
push 0x41b6d0
push eax
call edi
mov ecx, eax
test ecx, ecx
jne 0x409b16
mov byte [esi + 8], 0
mov eax, dword [esi + 4]
mov dword [esi + 0x4c], ecx
xor ecx, ecx
test eax, eax
je 0x409b35
cmp eax, 0xffffffff
je 0x409b35
push 0x41b6e8
push eax
call edi
mov ecx, eax
test ecx, ecx
jne 0x409b39
mov byte [esi + 8], 0
mov eax, dword [esi + 4]
mov dword [esi + 0x50], ecx
xor ecx, ecx
test eax, eax
je 0x409b58
cmp eax, 0xffffffff
je 0x409b58
push str.GetTempPathW
push eax
call edi
mov ecx, eax
test ecx, ecx
jne 0x409b5c
mov byte [esi + 8], 0
mov eax, dword [esi + 4]
mov dword [esi + 0x54], ecx
xor ecx, ecx
test eax, eax
je 0x409b7b
cmp eax, 0xffffffff
je 0x409b7b
push 0x41b710
push eax
call edi
mov ecx, eax
test ecx, ecx
jne 0x409b7f
mov byte [esi + 8], 0
mov eax, dword [esi + 4]
mov dword [esi + 0x58], ecx
xor ecx, ecx
test eax, eax
je 0x409b9e
cmp eax, 0xffffffff
je 0x409b9e
push 0x41b724
push eax
call edi
mov ecx, eax
test ecx, ecx
jne 0x409ba2
mov byte [esi + 8], 0
mov eax, dword [esi + 4]
mov dword [esi + 0x5c], ecx
xor ecx, ecx
test eax, eax
je 0x409bc1
cmp eax, 0xffffffff
je 0x409bc1
push str.GetFullPathNameW
push eax
call edi
mov ecx, eax
test ecx, ecx
jne 0x409bc5
mov byte [esi + 8], 0
mov eax, dword [esi + 4]
mov dword [esi + 0x60], ecx
xor ecx, ecx
test eax, eax
je 0x409be4
cmp eax, 0xffffffff
je 0x409be4
push str.GetVolumeInformationW
push eax
call edi
mov ecx, eax
test ecx, ecx
jne 0x409be8
mov byte [esi + 8], 0
mov eax, dword [esi + 4]
mov dword [esi + 0x64], ecx
xor ecx, ecx
test eax, eax
je 0x409c16
cmp eax, 0xffffffff
je 0x409c16
push str.QueryFullProcessImageNameW
push eax
call edi
mov dword [esi + 0x68], eax
pop edi
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040e7d5
mov esp, ebp
pop ebp
ret
mov dword [esi + 0x68], ecx
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0040e7d5
mov esp, ebp
pop ebp
ret