Function at 0x40c090
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1a4
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
test ebx, ebx
je 0x40c468
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x40c468
and dword [esp + 0x18], 0
lea ecx, [esp + 0x10]
and dword [esp + 0x1c], 0
push str.WindowsSystem32_ntdll.dll
push ebx
call fcn.0043c2b8
mov edx, eax
lea ecx, [esp + 0x18]
call fcn.0043baed
pop ecx
push 0
lea edx, [esp + 0x1c]
mov ecx, dword [eax]
call fcn.0044d9a9
pop ecx
mov ecx, dword [esp + 0x14]
mov edi, eax
add ecx, 0xfffffff0
call fcn.0043d912
mov ecx, dword [esp + 0x10]
add ecx, 0xfffffff0
call fcn.0043d912
test edi, edi
je 0x40c10d
mov eax, edi
jmp 0x40c46d
mov edi, 0x60000
cmp dword [esp + 0x1c], edi
jae 0x40c122
mov eax, 0x80004001
jmp 0x40c46d
call fcn.0043d5bb
push eax
lea ecx, [esp + 0x14]
call fcn.0043bbe8
mov eax, 0x104
lea ecx, [esp + 0x10]
push eax
push eax
call fcn.0043d810
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push eax
lea ecx, [esp + 0x14]
call fcn.0043d882
mov edx, str.bcdboot.exe
lea ecx, [esp + 0x10]
call fcn.0044c3a9
cmp dword [esp + 0x1c], edi
jne 0x40c194
mov edi, dword [esp + 0x10]
lea edx, [esp + 0x18]
push 0
mov ecx, edi
call fcn.0044d9a9
pop ecx
test eax, eax
jne 0x40c18a
cmp dword [esp + 0x1c], 0x60001
je 0x40c218
mov ebx, 0x80004001
jmp 0x40c2a4
push str.Configx86
mov edx, 0x4ad284
lea ecx, [esp + 0x18]
call fcn.0043baed
pop ecx
mov edx, str.bcdboot.exe
lea ecx, [esp + 0x14]
call fcn.0044c3a9
mov esi, dword [esp + 0x14]
lea edx, [esp + 0x20]
push 0
mov ecx, esi
call fcn.0044d9a9
mov edi, dword [esp + 0x14]
pop ecx
mov ecx, edi
test eax, eax
jne 0x40c279
push eax
lea edx, [esp + 0x1c]
call fcn.0044d9a9
pop ecx
test eax, eax
jne 0x40c1fb
mov eax, dword [esp + 0x1c]
cmp eax, dword [esp + 0x24]
ja 0x40c20d
jb 0x40c1fb
mov eax, dword [esp + 0x18]
cmp eax, dword [esp + 0x20]
jae 0x40c20d
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x14]
call fcn.0043c5cb
mov edi, dword [esp + 0x10]
lea ecx, [esi - 0x10]
call fcn.0043d912
mov esi, dword [ebp + 0xc]
mov ecx, ebx
call fcn.0044c5df
lea edx, [esp + 0x28]
mov dword [esp + 0x14], eax
mov ecx, eax
call fcn.0044c73d
lea ecx, [esp + 0x14]
mov ebx, eax
call fcn.0043bb32
test ebx, ebx
jne 0x40c2a4
mov ecx, esi
call fcn.0044c5df
lea edx, [esp + 0x120]
mov dword [esp + 0x14], eax
mov ecx, eax
call fcn.0044c73d
lea ecx, [esp + 0x14]
mov ebx, eax
call fcn.0043bb32
test ebx, ebx
jne 0x40c2a4
mov eax, dword [ebp + 0x10]
sub eax, 1
je 0x40c2b3
sub eax, 1
je 0x40c290
mov ebx, 0x80070057
jmp 0x40c2a4
call fcn.0044d9e7
cmp eax, 1
je 0x40c20d
lea ecx, [esi - 0x10]
call fcn.0043d912
jmp 0x40c18a
cmp dword [esp + 0x28], 1
jne 0x40c2a1
cmp dword [esp + 0x120], 1
je 0x40c2d0
push 0xb
pop ebx
lea ecx, [edi - 0x10]
call fcn.0043d912
mov eax, ebx
jmp 0x40c46d
cmp dword [esp + 0x28], 0
jne 0x40c2a1
cmp dword [esp + 0x120], 0
jne 0x40c2a1
mov al, byte [esp + 0x48]
cmp al, 5
je 0x40c2a1
cmp al, 0xf
je 0x40c2a1
call fcn.0043d5bb
push eax
lea ecx, [esp + 0x14]
call fcn.0043bbe8
push 0
push 0x32
lea eax, [esp + 0xc0]
push eax
call dword [sym.imp.KERNEL32.dll_GetThreadLocale]
movzx eax, ax
push eax
call dword [sym.imp.KERNEL32.dll_LCIDToLocaleName]
lea eax, [esi + 0x1c]
push eax
lea eax, [esp + 0xbc]
push eax
push dword [ebp + 8]
lea eax, [esp + 0x1c]
push str.Bcdboot__sWindows__l__s__s__s
push eax
call fcn.0043c575
add esp, 0x14
lea edx, [esp + 0x18]
mov ecx, edi
push 0
call fcn.0044d9a9
mov ebx, eax
pop ecx
test ebx, ebx
jne 0x40c457
call sym.Dismx86.exe_BcdGetFirmwareType
mov ecx, dword [sym.imp.msvcrt.dll_wcslen]
cmp eax, dword [ebp + 0x10]
je 0x40c388
cmp dword [esp + 0x1c], 0x10006
jae 0x40c358
mov ebx, 0x80004002
jmp 0x40c457
mov eax, dword [ebp + 0x10]
sub eax, 1
je 0x40c374
sub eax, 1
je 0x40c36d
push 0x57
pop ebx
jmp 0x40c457
mov esi, str.__f_UEFI
jmp 0x40c379
mov esi, str.__f_BIOS
push esi
call ecx
pop ecx
push eax
push esi
lea ecx, [esp + 0x18]
call fcn.0043c99e
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
push ecx
mov ecx, eax
mov dword [esp + 0x1c], eax
mov esi, esp
call fcn.0043cad2
add eax, 0x10
xor dl, dl
mov ecx, edi
mov dword [esi], eax
call fcn.0044b9b6
mov ebx, eax
pop ecx
cmp ebx, 0x3f1
jne 0x40c418
push dword [ebp + 0xc]
lea ecx, [esp + 0x18]
call fcn.0043c2b8
cmp dword [ebp + 0x10], 1
mov esi, str._boot
je 0x40c3d2
mov esi, str.efi
push esi
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
push eax
push esi
lea ecx, [esp + 0x1c]
call fcn.0043c99e
mov esi, dword [esp + 0x14]
xor edx, edx
inc edx
mov ecx, esi
call fcn.0044d00c
push ecx
mov ecx, dword [esp + 0x1c]
mov ebx, esp
call fcn.0043cad2
add eax, 0x10
xor dl, dl
mov ecx, edi
mov dword [ebx], eax
call fcn.0044b9b6
pop ecx
lea ecx, [esi - 0x10]
mov ebx, eax
call fcn.0043d912
test ebx, ebx
jne 0x40c457
cmp dword [ebp + 0x10], 1
jne 0x40c42c
mov ecx, dword [ebp + 0xc]
call fcn.0044b1fa
jmp 0x40c44a
cmp dword [ebp + 0x10], 2
jne 0x40c457
call sym.Dismx86.exe_BcdGetFirmwareType
cmp eax, 2
jne 0x40c457
mov ecx, dword [ebp + 0xc]
call fcn.0040376a
test eax, eax
je 0x40c457
jg 0x40c44e
mov ebx, eax
jmp 0x40c457
movzx ebx, ax
or ebx, 0x80070000
mov ecx, dword [esp + 0x10]
lea ecx, [ecx - 0x10]
call fcn.0043d912
jmp 0x40c2a4
mov eax, 0x80070057
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc