Function at 0x405f30
Capabilities:
Get common file path

Disassembly:
push 0x8bc
mov eax, 0x4110b5
call fcn.00402f84
push 0x406570
call fcn.00405d26
mov esi, dword [0x41556c]
xor ebx, ebx
mov edi, ebx
mov eax, ebx
mov dword [ebp - 0x63c], edi
mov dword [ebp - 0x648], eax
pop ecx
test esi, esi
jne 0x405fb6
cmp byte [0x415570], al
jne 0x405fb2
push ebx
push ebx
push 0x4069f4
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
test eax, eax
je 0x405f95
push 0x406a20
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
mov dword [0x41556c], esi
jmp 0x405f9b
mov esi, dword [0x41556c]
mov byte [0x415570], 1
test esi, esi
jne 0x405fb6
mov edi, dword [ebp - 0x63c]
mov eax, dword [ebp - 0x648]
mov ecx, ebx
jmp 0x405fe0
lea eax, [ebp - 0x648]
mov ecx, esi
push eax
lea eax, [ebp - 0x63c]
push eax
push 1
push ebx
push ebx
call dword [0x416268]
call esi
mov edi, dword [ebp - 0x63c]
mov ecx, eax
mov eax, dword [ebp - 0x648]
test ecx, ecx
jne 0x405ffb
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x4065b8
call fcn.00405d26
pop ecx
jmp 0x406569
mov ecx, ebx
test eax, eax
je 0x40601d
lea edx, [edi + 8]
cmp dword [edx], ebx
je 0x406012
inc ecx
add edx, 0xc
cmp ecx, eax
jae 0x40601d
jmp 0x406004
imul eax, ecx, 0xc
mov eax, dword [eax + edi]
mov dword [0x4150fc], eax
mov esi, dword [0x41558c]
test esi, esi
jne 0x406067
cmp byte [0x415573], bl
jne 0x406072
push ebx
push ebx
push 0x4069f4
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
test eax, eax
je 0x406056
push 0x406a10
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
mov dword [0x41558c], esi
jmp 0x40605c
mov esi, dword [0x41558c]
mov byte [0x415573], 1
test esi, esi
je 0x406072
push edi
mov ecx, esi
call dword [0x416268]
call esi
mov eax, dword [0x4150fc]
mov dword [ebp - 0x63c], ebx
cmp eax, 0xffffffff
je 0x40608a
push eax
push 0x406630
jmp 0x4060e2
push 0x406668
call fcn.00405d26
mov eax, dword [0x415050]
pop ecx
mov dword [ebp - 0x658], eax
mov eax, dword [0x415038]
push 0xffffffffffffffff
mov dword [ebp - 0x654], eax
lea eax, [ebp - 0x658]
push ebx
push eax
push 2
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov ecx, eax
sub ecx, ebx
je 0x40655f
sub ecx, 1
je 0x4060d7
push eax
push 0x406750
jmp 0x405ff0
push dword [0x4150fc]
push 0x40670c
call fcn.00405d26
or dword [ebp - 0x650], 0xffffffff
pop ecx
pop ecx
mov dword [ebp - 0x64c], ebx
mov dword [ebp - 4], 2
lea eax, [ebp - 0x654]
push eax
lea ecx, [ebp - 0x650]
call fcn.00407c95
mov byte [ebp - 4], 3
mov edi, dword [eax]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov esi, dword [0x415588]
mov ebx, eax
test esi, esi
jne 0x40616e
cmp byte [0x415590], 0
jne 0x406168
push esi
push esi
push 0x404640
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
test eax, eax
je 0x406157
push 0x406a38
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
mov dword [0x415588], esi
jmp 0x40615d
mov esi, dword [0x415588]
mov byte [0x415590], 1
test esi, esi
jne 0x40616e
xor ebx, ebx
mov eax, ebx
jmp 0x406181
push edi
push 0x2000000
push ebx
mov ecx, esi
call dword [0x416268]
call esi
xor ebx, ebx
test eax, eax
sete cl
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x654]
cmp dword [eax], 0xffffffff
je 0x40619c
mov dword [eax + 4], 1
test cl, cl
je 0x4061b8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x4067b8
call fcn.00405d26
pop ecx
pop ecx
jmp 0x406535
or dword [ebp - 0x644], 0xffffffff
mov dword [ebp - 0x640], ebx
mov byte [ebp - 4], 9
lea eax, [ebp - 0x654]
push eax
lea ecx, [ebp - 0x644]
call fcn.00407c95
mov byte [ebp - 4], 0xa
push dword [eax]
push 1
push 1
push ebx
push 0x2000000
push dword [ebp - 0x650]
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
mov ecx, eax
neg ecx
sbb cl, cl
inc cl
mov byte [ebp - 4], 9
mov eax, dword [ebp - 0x654]
cmp dword [eax], 0xffffffff
je 0x406215
mov dword [eax + 4], 1
test cl, cl
je 0x406227
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x406818
jmp 0x40624c
push 4
push 0x4150fc
push 0xc
push dword [ebp - 0x644]
call dword [sym.imp.ADVAPI32.dll_SetTokenInformation]
test eax, eax
jne 0x406258
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x406880
call fcn.00405d26
pop ecx
pop ecx
jmp 0x40650d
mov esi, 0x104
lea eax, [ebp - 0x218]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x40650d
cmp eax, esi
jae 0x40650d
mov dword [ebp - 0x428], ebx
mov dword [ebp - 0x424], ebx
mov dword [ebp - 0x420], ebx
mov dword [ebp - 0x41c], ebx
lea eax, [ebp - 0x418]
mov dword [ebp - 0x424], 0x200
mov dword [ebp - 0x41c], eax
mov byte [ebp - 4], 0x18
push 2
pop ebx
mov dword [ebp - 0x428], ebx
mov eax, dword [ebp - 0x41c]
xor ecx, ecx
mov word [eax], cx
mov byte [ebp - 4], 0x19
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x428]
call fcn.0040c4d5
mov byte [ebp - 4], 0x1a
mov dword [ebp - 0x660], ebx
mov dword [ebp - 0x65c], ebx
mov dword [ebp - 0x658], 0x10
mov dword [ebp - 0x654], 0x401288
mov byte [ebp - 4], 0x1b
push ecx
lea ecx, [ebp - 0x660]
call fcn.0040c586
mov byte [ebp - 4], 0x1c
lea eax, [ebp - 0x660]
push eax
lea ecx, [ebp - 0x428]
call fcn.0040cbcb
mov ebx, eax
neg ebx
sbb bl, bl
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0x660]
call fcn.00402e57
add bl, 1
je 0x406347
push ecx
lea ecx, [ebp - 0x428]
call fcn.00404d6a
push 0x4068d8
lea ecx, [ebp - 0x428]
call fcn.00404d0b
lea eax, [ebp - 0x428]
push eax
lea ecx, [ebp - 0x8c8]
call fcn.00404b2c
mov byte [ebp - 4], 0x1d
mov ecx, 0x80
lea esi, [ebp - 0x418]
lea edi, [ebp - 0x8b8]
rep movsd dword es:[edi], dword [esi]
mov byte [ebp - 4], 0x1e
lea ecx, [ebp - 0x8c8]
push 0x406914
call fcn.00404d0b
xor ebx, ebx
mov dword [ebp - 0x638], ebx
mov dword [ebp - 0x634], ebx
mov dword [ebp - 0x630], ebx
mov dword [ebp - 0x62c], ebx
lea eax, [ebp - 0x628]
mov dword [ebp - 0x634], 0x200
mov dword [ebp - 0x62c], eax
mov byte [ebp - 4], 0x1f
mov dword [ebp - 0x638], 2
mov eax, dword [ebp - 0x62c]
xor ecx, ecx
mov word [eax], cx
mov byte [ebp - 4], 0x21
lea ecx, [ebp - 0x8c8]
call fcn.00404eb9
mov ecx, dword [ebp - 0x8c0]
mov eax, dword [ebp - 0x8c8]
not ecx
and ecx, 1
shr eax, cl
push eax
push ecx
lea ecx, [ebp - 0x638]
call fcn.00404e71
mov edi, dword [ebp - 0x62c]
lea ecx, [ebp - 0x8c8]
call fcn.0040c698
mov esi, dword [ebp - 0x8bc]
lea ecx, [ebp - 0x8c8]
call fcn.00404eb9
mov ecx, dword [ebp - 0x8c0]
mov eax, dword [ebp - 0x8c8]
not ecx
push 0xffffffffffffffff
and ecx, 1
push esi
shr eax, cl
push eax
push edi
call dword [sym.imp.MSVCR120_CLR0400.dll_wcsncpy_s]
push 0x40
lea eax, [ebp - 0x6b4]
mov dword [ebp - 0x6b8], 0x44
push ebx
push eax
call sub.MSVCR120_CLR0400.dll_memset
add esp, 0x1c
lea ecx, [ebp - 0x428]
call fcn.0040c698
mov edx, dword [ebp - 0x41c]
lea eax, [ebp - 0x670]
mov ecx, dword [ebp - 0x644]
push eax
lea eax, [ebp - 0x6b8]
push eax
sub esp, 0x18
push edi
call fcn.00407eb6
test eax, eax
jne 0x4064af
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x406930
call fcn.00405d26
pop ecx
pop ecx
jmp 0x4064e0
push dword [ebp - 0x670]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x66c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x668]
push dword [0x4150fc]
push 0x406988
call fcn.00405d26
add esp, 0xc
mov byte [ebp - 4], 0x1e
lea ecx, [ebp - 0x638]
call fcn.00402e57
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0x8c8]
call fcn.00402e57
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x428]
call fcn.00402e57
mov byte [ebp - 4], 2
cmp dword [ebp - 0x640], 0
je 0x406535
cmp dword [ebp - 0x644], 0
je 0x40652f
push dword [ebp - 0x644]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x640], ebx
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x64c], 0
je 0x40656a
cmp dword [ebp - 0x650], 0
je 0x406557
push dword [ebp - 0x650]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x64c], ebx
jmp 0x40656a
push 0x4066b8
call fcn.00405d26
pop ecx
call fcn.00401f50
ret