Function at 0x40e5d0
Capabilities:
Get common file path

Disassembly:
push ebx
push ebp
push esi
push edi
push 0x104
push 0x449080
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp byte [0x449080], 0
mov ebx, 0x5c
je 0x40e611
mov eax, 0x449080
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40e600
sub eax, edx
cmp byte [eax + 0x44907f], bl
je 0x40e628
mov edi, 0x449080
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x40e617
mov ax, word [0x43b288]
mov word [edi], ax
push 0x449080
push str._sDomainTimeSetup.log
push 0x448d68
call fcn.0041fa79
add esp, 0xc
test esi, esi
je 0x40e65c
mov edx, 0x448840
mov eax, esi
sub edx, esi
lea esp, [esp]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x40e650
jmp 0x40e696
push 0x104
push 0x448840
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push ebx
push 0x448840
call fcn.00420230
add esp, 8
test eax, eax
jne 0x40e693
push 0x2f
push 0x448840
call fcn.00420230
add esp, 8
test eax, eax
je 0x40e696
mov byte [eax], 0
mov eax, 0x448840
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40e6a0
sub eax, edx
push eax
push 0x448840
call dword [sym.imp.USER32.dll_CharLowerBuffA]
cmp byte [0x448840], 0
je 0x40e6d7
mov eax, 0x448840
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40e6c6
sub eax, edx
cmp byte [eax + 0x44883f], bl
je 0x40e6f2
mov edi, 0x448840
dec edi
lea ecx, [ecx]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x40e6e0
mov cx, word [0x43b288]
mov word [edi], cx
xor eax, eax
jmp 0x40e700
mov cl, byte [eax + 0x448840]
mov byte [eax + 0x448e70], cl
inc eax
test cl, cl
jne 0x40e700
xor eax, eax
mov cl, byte [eax + 0x448840]
mov byte [eax + 0x448738], cl
inc eax
test cl, cl
jne 0x40e713
push str.i386_
push 0x448738
call fcn.0041fd70
add esp, 8
test eax, eax
je 0x40e77f
mov byte [eax], 0
xor ecx, ecx
nop
mov dl, byte [ecx + 0x448738]
mov byte [ecx + 0x449398], dl
inc ecx
test dl, dl
jne 0x40e740
mov edi, 0x449398
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x40e757
mov dx, word [0x43b288]
mov ecx, dword [str.AMD64_]
mov word [edi], dx
mov dword [eax], ecx
mov edx, dword [0x43b290]
mov dword [eax + 4], edx
jmp 0x40e808
push str.x86_
push 0x448738
call fcn.0041fd70
add esp, 8
test eax, eax
je 0x40e7de
mov byte [eax], 0
xor ecx, ecx
lea ebx, [ebx]
mov dl, byte [ecx + 0x448738]
mov byte [ecx + 0x449398], dl
inc ecx
test dl, dl
jne 0x40e7a0
mov edi, 0x449398
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x40e7b7
movzx ecx, word [0x43b288]
mov edx, dword [0x43b29c]
mov word [edi], cx
mov dword [eax], edx
movzx ecx, word [0x43b2a0]
mov word [eax + 4], cx
jmp 0x40e808
mov eax, 0x448738
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x40e7e4
mov edx, dword [str...AMD64_]
mov ecx, dword [0x43b2a8]
mov dword [eax], edx
mov dx, word [0x43b2ac]
mov dword [eax + 4], ecx
mov word [eax + 8], dx
push 0x449398
push str._sLinux_
push 0x448948
call fcn.0041fa79
mov esi, 0x448e70
call fcn.004126f0
mov esi, 0x448738
call fcn.004126f0
mov esi, 0x448948
call fcn.004126f0
push 0x104
push str.Manager_File_Path
push str.SoftwareGreywareDomain_Time_II_ManagerParameters
mov eax, 0x4364e7
mov edi, 0x448c60
call fcn.00411bd0
add esp, 0x18
cmp byte [0x448c60], 0
je 0x40e8a6
mov eax, edi
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40e870
sub eax, edx
cmp byte [eax + 0x448c5f], bl
je 0x40e93e
mov edi, 0x448c60
dec edi
jmp 0x40e890
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x40e890
mov ax, word [0x43b288]
mov word [edi], ax
jmp 0x40e93e
push 0x104
push str.ProgramFilesDir
push str.SoftwareMicrosoftWindowsCurrentVersion
mov eax, str.c:program_files
mov edi, 0x448c60
call fcn.00411bd0
add esp, 0xc
cmp byte [0x448c60], 0
je 0x40e8e6
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40e8d5
sub eax, edx
cmp byte [eax + 0x448c5f], bl
je 0x40e902
mov edi, 0x448c60
dec edi
lea esp, [esp]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x40e8f0
mov cx, word [0x43b288]
mov word [edi], cx
mov eax, 0x448c60
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x40e908
mov edx, dword [str.Domain_Time_II]
mov ecx, dword [0x43b0b8]
mov dword [eax], edx
mov edx, dword [0x43b0bc]
mov dword [eax + 4], ecx
mov cx, word [0x43b0c0]
mov dword [eax + 8], edx
mov dl, byte [0x43b0c2]
mov word [eax + 0xc], cx
mov byte [eax + 0xe], dl
push 0x448c60
call fcn.004174f0
add esp, 4
cmp byte [0x448c60], 0
je 0x40e971
mov eax, 0x448c60
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40e960
sub eax, edx
cmp byte [eax + 0x448c5f], bl
je 0x40e988
mov edi, 0x448c60
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x40e977
mov ax, word [0x43b288]
mov word [edi], ax
push str.DTLinuxUpdates_
push 0x448c60
push 0x436a34
push 0x449290
call fcn.0041fa79
add esp, 0x10
xor eax, eax
jmp 0x40e9b0
mov cl, byte [eax + 0x448c60]
mov byte [eax + 0x449188], cl
inc eax
test cl, cl
jne 0x40e9b0
xor eax, eax
mov cl, byte [eax + 0x448c60]
mov byte [eax + 0x448f78], cl
inc eax
test cl, cl
jne 0x40e9c3
mov eax, 0x449188
dec eax
lea ebx, [ebx]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x40e9e0
mov ecx, dword [str.x64_]
mov dl, byte [0x43b2e8]
push 0x104
mov dword [eax], ecx
mov byte [eax + 4], dl
push str.Common_Programs
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
mov eax, 0x4364e7
mov edi, 0x448b58
call fcn.00411bd0
mov ebp, dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
add esp, 0xc
cmp byte [0x448b58], 0
jne 0x40eae7
push 0x104
push edi
call ebp
cmp dword [0x449ef4], 0
je 0x40eac4
mov eax, dword [0x44c2a4]
cmp eax, 5
jb 0x40ea92
mov eax, dword [str.Documents_and_Settings]
mov ecx, dword [0x43b348]
mov edx, dword [0x43b34c]
mov dword [0x448b5a], eax
mov eax, dword [0x43b350]
mov dword [0x448b5e], ecx
mov ecx, dword [0x43b354]
mov dword [0x448b62], edx
mov edx, dword [0x43b358]
mov dword [0x448b66], eax
mov dword [0x448b6a], ecx
mov dword [0x448b6e], edx
jmp 0x40eac4
cmp eax, 4
jne 0x40eac4
mov eax, 0x448b58
dec eax
lea ecx, [ecx]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x40eaa0
mov ecx, dword [str.Profiles]
mov edx, dword [0x43b360]
mov dword [eax], ecx
mov cx, word [0x43b364]
mov dword [eax + 4], edx
mov word [eax + 8], cx
mov edi, 0x448b58
dec edi
lea ebx, [ebx]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x40ead0
mov ecx, 7
mov esi, str.All_UsersStart_MenuPrograms
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
push 0x448b58
call fcn.004174f0
add esp, 4
cmp byte [0x448b58], 0
je 0x40eb16
mov eax, 0x448b58
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40eb05
sub eax, edx
cmp byte [eax + 0x448b57], bl
je 0x40eb32
mov edi, 0x448b58
dec edi
lea esp, [esp]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x40eb20
mov dx, word [0x43b288]
mov word [edi], dx
mov eax, 0x448b58
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x40eb38
mov ecx, dword [str.Domain_Time_II]
mov edx, dword [0x43b0b8]
mov dword [eax], ecx
mov ecx, dword [0x43b0bc]
mov dword [eax + 4], edx
mov dx, word [0x43b0c0]
mov dword [eax + 8], ecx
mov cl, byte [0x43b0c2]
mov word [eax + 0xc], dx
push 0x448b58
mov byte [eax + 0xe], cl
call fcn.004174f0
add esp, 4
cmp byte [0x448b58], 0
je 0x40eba1
mov eax, 0x448b58
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40eb90
sub eax, edx
cmp byte [eax + 0x448b57], bl
je 0x40ebb9
mov edi, 0x448b58
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x40eba7
mov dx, word [0x43b288]
mov word [edi], dx
push 0x104
push str.Common_Desktop
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
mov eax, 0x4364e7
mov edi, 0x448a50
call fcn.00411bd0
add esp, 0xc
cmp byte [0x448a50], 0
jne 0x40ecc9
push 0x104
push edi
call ebp
cmp dword [0x449ef4], 0
je 0x40ec7b
mov eax, dword [0x44c2a4]
cmp eax, 5
jb 0x40ec4c
mov eax, dword [str.Documents_and_Settings]
mov ecx, dword [0x43b348]
mov edx, dword [0x43b34c]
mov dword [0x448a52], eax
mov eax, dword [0x43b350]
mov dword [0x448a56], ecx
mov ecx, dword [0x43b354]
mov dword [0x448a5a], edx
mov edx, dword [0x43b358]
mov dword [0x448a5e], eax
mov dword [0x448a62], ecx
mov dword [0x448a66], edx
jmp 0x40ec7b
cmp eax, 4
jne 0x40ec7b
mov eax, 0x448a50
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x40ec57
mov ecx, dword [str.Profiles]
mov edx, dword [0x43b360]
mov dword [eax], ecx
mov cx, word [0x43b364]
mov dword [eax + 4], edx
mov word [eax + 8], cx
mov eax, 0x448a50
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x40ec81
mov edx, dword [str.All_UsersDesktop]
mov ecx, dword [0x43b39c]
mov dword [eax], edx
mov edx, dword [0x43b3a0]
mov dword [eax + 4], ecx
mov ecx, dword [0x43b3a4]
mov dword [eax + 8], edx
mov dx, word [0x43b3a8]
mov dword [eax + 0xc], ecx
mov cl, byte [0x43b3aa]
mov word [eax + 0x10], dx
mov byte [eax + 0x12], cl
cmp byte [0x448a50], 0
je 0x40ece2
mov eax, 0x448a50
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40ecd1
sub eax, edx
cmp byte [eax + 0x448a4f], bl
je 0x40ecfa
mov edi, 0x448a50
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x40ece8
mov dx, word [0x43b288]
mov word [edi], dx
pop edi
pop esi
pop ebp
pop ebx
ret