Function at 0x401180
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x46a461
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x328
push ebx
lea ecx, [esp + 8]
call fcn.00420c40
xor ebx, ebx
lea ecx, [esp + 0xc]
mov dword [esp + 0x334], ebx
call fcn.0045c634
push 0x20019
push str.SYSTEMCurrentControlSetControlSession_Manager
push SysFreeString
lea ecx, [esp + 0x14]
mov byte [esp + 0x340], 1
call fcn.00420ce0
test eax, eax
je 0x4011fc
mov ecx, dword [esp + 8]
lea eax, [esp + 0xc]
push eax
push str.PendingFileRenameOperations
push ebx
push ecx
call fcn.00401470
add esp, 0x10
lea ecx, [esp + 8]
call fcn.00420d40
mov eax, dword [esp + 0x14]
push esi
xor esi, esi
cmp eax, ebx
push edi
jle 0x40121d
mov edx, dword [esp + 0x18]
lea ecx, [edx + esi*4]
call fcn.0045e09d
mov eax, dword [esp + 0x1c]
inc esi
cmp esi, eax
jl 0x401208
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x29]
mov byte [esp + 0x28], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x28]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x12d]
mov byte [esp + 0x12c], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0x12c]
push 0x104
push ecx
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x231]
mov byte [esp + 0x230], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea edx, [esp + 0x230]
push 0x104
push edx
stosb byte es:[edi], al
call fcn.00404aa0
add esp, 8
mov edi, 0x47b110
mov eax, dword [0x48014c]
mov dword [esp + 0xc], eax
mov eax, dword [edi + 4]
mov byte [esp + 0x33c], 2
cmp eax, 1
jne 0x4012ca
mov ecx, dword [edi]
lea edx, [esp + 0x28]
push ecx
push edx
push 0x47c054
jmp 0x40130a
cmp eax, 2
jne 0x4012e1
mov ecx, dword [edi]
lea edx, [esp + 0x12c]
push ecx
push edx
push 0x47c054
jmp 0x40130a
cmp eax, 3
jne 0x4012f8
mov ecx, dword [edi]
lea edx, [esp + 0x230]
push ecx
push edx
push 0x47c054
jmp 0x40130a
cmp eax, 4
jne 0x401317
mov ecx, dword [edi]
lea edx, [esp + 0x28]
push ecx
push edx
push str._sdrivers_s
lea eax, [esp + 0x18]
push eax
call fcn.0045bca4
add esp, 0x10
mov ecx, dword [esp + 0xc]
cmp dword [ecx - 8], ebx
je 0x40138f
lea ecx, [esp + 0xc]
call fcn.0045e09d
mov eax, dword [esp + 0x1c]
xor esi, esi
cmp eax, ebx
jle 0x40138f
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0xc]
push edx
lea ecx, [eax + esi*4]
call fcn.0045b91e
cmp eax, 0xffffffff
je 0x401386
mov ecx, dword [esp + 0x18]
mov edx, dword [ecx + esi*4]
cmp byte [edx], 0x21
je 0x401386
push 1
push esi
lea ecx, [esp + 0x1c]
call fcn.0045ca4b
mov eax, dword [esp + 0x1c]
cmp eax, ebx
jle 0x401385
cmp eax, esi
jle 0x401385
mov eax, dword [esp + 0x18]
mov ecx, dword [eax + esi*4]
cmp dword [ecx - 8], ebx
jne 0x401385
push 1
push esi
lea ecx, [esp + 0x1c]
call fcn.0045ca4b
dec esi
mov eax, dword [esp + 0x1c]
inc esi
cmp esi, eax
jl 0x401333
lea ecx, [esp + 0xc]
mov byte [esp + 0x33c], 1
call fcn.0045db21
add edi, 8
cmp edi, str.sdconsole.exe
jb 0x4012a2
mov eax, dword [esp + 0x1c]
mov edx, eax
and edx, 0x80000001
jns 0x4013c2
dec edx
or edx, 0xfffffffe
inc edx
pop edi
pop esi
je 0x4013e2
mov ecx, dword [esp + 0x10]
mov edx, dword [ecx + eax*4 - 4]
cmp dword [edx - 8], ebx
je 0x4013e2
push 0x4858e0
push eax
lea ecx, [esp + 0x14]
call fcn.0045c8dd
push 0x20006
push str.SYSTEMCurrentControlSetControlSession_Manager
push SysFreeString
lea ecx, [esp + 0x14]
call fcn.00420ce0
test eax, eax
je 0x401430
cmp dword [esp + 0x14], ebx
jne 0x401414
push str.PendingFileRenameOperations
lea ecx, [esp + 0xc]
call fcn.00422bc0
jmp 0x401427
lea eax, [esp + 0xc]
lea ecx, [esp + 8]
push eax
push str.PendingFileRenameOperations
call fcn.004221f0
lea ecx, [esp + 8]
call fcn.00420d40
lea ecx, [esp + 0xc]
mov byte [esp + 0x334], bl
call fcn.0045c667
lea ecx, [esp + 8]
mov dword [esp + 0x334], 0xffffffff
call fcn.00420c60
mov ecx, dword [esp + 0x32c]
pop ebx
mov dword fs:[0], ecx
add esp, 0x334
ret