Function at 0x47e550
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x4c32cc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov ebx, ecx
push edi
mov dword [ebp - 0x210], eax
push ebx
mov edx, 0x7ffffffe
mov eax, 0x104
lea ecx, [ebp - 0x108]
mov dword [ebp - 0x214], ebx
call fcn.00401000
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
lea ecx, [ebp - 0x108]
push ecx
call edi
mov esi, eax
test esi, esi
jle 0x47e5b8
mov bl, 0x5c
cmp byte [ebp + esi - 0x108], bl
je 0x47e5ef
dec esi
test esi, esi
jg 0x47e5a4
mov ebx, dword [ebp - 0x214]
push ebx
call edi
cmp eax, 0x20
jge 0x47ea40
push 0x104
lea ecx, [ebp - 0x108]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov edx, 0x104
lea eax, [ebp - 0x108]
cmp byte [eax], 0
je 0x47e646
inc eax
dec edx
jne 0x47e5e1
jmp 0x47e66e
lea edx, [ebp - 0x108]
push edx
mov byte [ebp + esi - 0x108], 0
call edi
cmp eax, 3
jge 0x47e614
mov byte [ebp + esi - 0x108], bl
mov byte [ebp + esi - 0x107], 0
mov esi, dword [ebp - 0x210]
lea eax, [ebp - 0x108]
push eax
mov edx, 0x7ffffffe
mov eax, 0x104
mov ecx, esi
call fcn.00401000
push esi
call edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a01d6
mov esp, ebp
pop ebp
ret
test edx, edx
je 0x47e66e
mov ecx, 0x104
sub ecx, edx
mov eax, 0x104
sub eax, ecx
push 0x4b17dc
lea ecx, [ebp + ecx - 0x108]
mov edx, 0x7fffffff
call fcn.00401000
mov eax, 0x104
lea ecx, [ebp - 0x108]
lea esp, [esp]
cmp byte [ecx], 0
je 0x47e68b
inc ecx
dec eax
jne 0x47e680
jmp 0x47e6af
test eax, eax
je 0x47e6af
mov ecx, 0x104
sub ecx, eax
mov eax, 0x104
sub eax, ecx
push ebx
lea ecx, [ebp + ecx - 0x108]
mov edx, 0x7fffffff
call fcn.00401000
push 0x104
lea edx, [ebp - 0x20c]
push edx
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileA]
test eax, eax
je 0x47e740
push 0
push 0
push 3
push 0
push 1
push 0x80000000
lea ecx, [ebp - 0x20c]
push ecx
call edi
mov esi, eax
cmp esi, 0xffffffff
je 0x47e740
push 0x104
lea edx, [ebp - 0x108]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov edi, dword [ebp - 0x210]
lea eax, [ebp - 0x108]
push eax
mov edx, 0x7ffffffe
mov eax, 0x104
mov ecx, edi
call fcn.00401000
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a01d6
mov esp, ebp
pop ebp
ret
mov ebx, dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x104
lea ecx, [ebp - 0x108]
push ecx
call ebx
mov eax, 0x104
lea ecx, [ebp - 0x108]
nop
cmp byte [ecx], 0
je 0x47e76b
inc ecx
dec eax
jne 0x47e760
jmp 0x47e793
test eax, eax
je 0x47e793
mov ecx, 0x104
sub ecx, eax
mov eax, 0x104
sub eax, ecx
push 0x4b17dc
lea ecx, [ebp + ecx - 0x108]
mov edx, 0x7fffffff
call fcn.00401000
mov eax, 0x104
lea ecx, [ebp - 0x108]
mov edi, edi
cmp byte [ecx], 0
je 0x47e7ab
inc ecx
dec eax
jne 0x47e7a0
jmp 0x47e7d5
test eax, eax
je 0x47e7d5
mov edx, dword [ebp - 0x214]
mov ecx, 0x104
sub ecx, eax
mov eax, 0x104
push edx
sub eax, ecx
lea ecx, [ebp + ecx - 0x108]
mov edx, 0x7fffffff
call fcn.00401000
push 0x104
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x108]
push ecx
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
test eax, eax
je 0x47e85c
push 0
push 0
push 3
push 0
push 1
push 0x80000000
lea edx, [ebp - 0x20c]
push edx
call edi
mov esi, eax
cmp esi, 0xffffffff
je 0x47e85c
push 0x104
lea eax, [ebp - 0x108]
push eax
call ebx
mov edi, dword [ebp - 0x210]
lea ecx, [ebp - 0x108]
push ecx
mov edx, 0x7ffffffe
mov eax, 0x104
mov ecx, edi
call fcn.00401000
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a01d6
mov esp, ebp
pop ebp
ret
mov ebx, dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0x104
lea edx, [ebp - 0x108]
push edx
call ebx
mov eax, 0x104
lea ecx, [ebp - 0x108]
jmp 0x47e880
cmp byte [ecx], 0
je 0x47e88b
inc ecx
dec eax
jne 0x47e880
jmp 0x47e8b3
test eax, eax
je 0x47e8b3
mov ecx, 0x104
sub ecx, eax
mov eax, 0x104
sub eax, ecx
push 0x4b17dc
lea ecx, [ebp + ecx - 0x108]
mov edx, 0x7fffffff
call fcn.00401000
mov edx, 0x104
lea eax, [ebp - 0x108]
mov edi, edi
cmp byte [eax], 0
je 0x47e8cb
inc eax
dec edx
jne 0x47e8c0
jmp 0x47e8f3
test edx, edx
je 0x47e8f3
mov ecx, 0x104
sub ecx, edx
mov eax, 0x104
sub eax, ecx
push str.SysWOW64_
lea ecx, [ebp + ecx - 0x108]
mov edx, 0x7fffffff
call fcn.00401000
mov eax, 0x104
lea ecx, [ebp - 0x108]
mov edi, edi
cmp byte [ecx], 0
je 0x47e90b
inc ecx
dec eax
jne 0x47e900
jmp 0x47e935
test eax, eax
je 0x47e935
mov ecx, 0x104
sub ecx, eax
mov eax, dword [ebp - 0x214]
push eax
mov eax, 0x104
sub eax, ecx
lea ecx, [ebp + ecx - 0x108]
mov edx, 0x7fffffff
call fcn.00401000
push 0x104
lea ecx, [ebp - 0x20c]
push ecx
lea edx, [ebp - 0x108]
push edx
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
test eax, eax
je 0x47ea40
push 0
push 0
push 3
push 0
push 1
push 0x80000000
lea eax, [ebp - 0x20c]
push eax
call edi
mov esi, eax
cmp esi, 0xffffffff
je 0x47ea40
push 0x104
lea ecx, [ebp - 0x108]
push ecx
call ebx
mov eax, 0x104
lea ecx, [ebp - 0x108]
cmp byte [ecx], 0
je 0x47e99d
inc ecx
dec eax
jne 0x47e992
jmp 0x47e9c5
test eax, eax
je 0x47e9c5
mov ecx, 0x104
sub ecx, eax
mov eax, 0x104
sub eax, ecx
push 0x4b17dc
lea ecx, [ebp + ecx - 0x108]
mov edx, 0x7fffffff
call fcn.00401000
mov eax, 0x104
lea ecx, [ebp - 0x108]
cmp byte [ecx], 0
je 0x47e9db
inc ecx
dec eax
jne 0x47e9d0
jmp 0x47ea03
test eax, eax
je 0x47ea03
mov ecx, 0x104
sub ecx, eax
mov eax, 0x104
sub eax, ecx
push str.SysWOW64_
lea ecx, [ebp + ecx - 0x108]
mov edx, 0x7fffffff
call fcn.00401000
mov edi, dword [ebp - 0x210]
lea edx, [ebp - 0x108]
push edx
mov edx, 0x7ffffffe
mov eax, 0x104
mov ecx, edi
call fcn.00401000
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a01d6
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.004a01d6
mov esp, ebp
pop ebp
ret