Function at 0x41797f
Capabilities:
Get common file path
Link many functions at runtime

Disassembly:
push 0x23c
mov eax, 0x439ee7
call fcn.004368bd
cmp byte [0x44e0d0], 0
jne 0x4182d7
xor edi, edi
mov byte [0x44e0d0], 1
xor eax, eax
mov dword [ebp - 0x22c], edi
mov dword [ebp - 0x228], 7
mov word [ebp - 0x23c], ax
push 0x104
lea eax, [ebp - 0x224]
mov dword [ebp - 4], edi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x417a20
lea eax, [ebp - 0x224]
push eax
lea ecx, [ebp - 0x23c]
call fcn.004011c3
mov ecx, dword [ebp - 0x22c]
test ecx, ecx
je 0x4182dd
cmp dword [ebp - 0x228], 8
lea eax, [ebp - 0x23c]
push 0x5c
cmovae eax, dword [ebp - 0x23c]
pop edx
cmp word [eax + ecx*2 - 2], dx
je 0x417a20
push edx
lea ecx, [ebp - 0x23c]
call fcn.004152af
push ecx
push 0x44de20
mov edx, str.ntdll.dll
lea ecx, [ebp - 0x23c]
call fcn.0041792c
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
pop ecx
pop ecx
test al, al
je 0x417bf6
push str.NtQueryVolumeInformationFile
push dword [0x44de20]
call esi
push str.NtOpenSection
push dword [0x44de20]
mov dword [0x44ddc0], eax
call esi
push str.NtSetInformationKey
push dword [0x44de20]
mov dword [0x44ddc4], eax
call esi
push str.NtSetSystemInformation
push dword [0x44de20]
mov dword [0x44ddc8], eax
call esi
push str.NtFsControlFile
push dword [0x44de20]
mov dword [0x44ddcc], eax
call esi
push str.NtQueryObject
push dword [0x44de20]
mov dword [0x44ddd0], eax
call esi
push str.NtQuerySecurityObject
push dword [0x44de20]
mov dword [0x44ddd4], eax
call esi
push str.NtSetSecurityObject
push dword [0x44de20]
mov dword [0x44ddd8], eax
call esi
push str.NtSetInformationThread
push dword [0x44de20]
mov dword [0x44dddc], eax
call esi
push str.NtQueryInformationProcess
push dword [0x44de20]
mov dword [0x44dde0], eax
call esi
push str.NtCreateFile
push dword [0x44de20]
mov dword [0x44dde4], eax
call esi
push str.NtOpenFile
push dword [0x44de20]
mov dword [0x44dde8], eax
call esi
push str.NtReadFile
push dword [0x44de20]
mov dword [0x44ddec], eax
call esi
push str.NtSetInformationFile
push dword [0x44de20]
mov dword [0x44ddf0], eax
call esi
push str.NtQueryInformationFile
push dword [0x44de20]
mov dword [0x44ddf4], eax
call esi
push str.NtQueryDirectoryFile
push dword [0x44de20]
mov dword [0x44ddf8], eax
call esi
push str.NtClose
push dword [0x44de20]
mov dword [0x44ddfc], eax
call esi
push str.NtDeleteFile
push dword [0x44de20]
mov dword [0x44de00], eax
call esi
push str.RtlInitUnicodeString
push dword [0x44de20]
mov dword [0x44de04], eax
call esi
push str.RtlFreeUnicodeString
push dword [0x44de20]
mov dword [0x44de08], eax
call esi
mov dword [0x44de0c], eax
push str.RtlGetNtVersionNumbers
push dword [0x44de20]
call esi
push str.RtlNtStatusToDosError
push dword [0x44de20]
mov dword [0x44de10], eax
call esi
push str.RtlDosPathNameToNtPathName_U
push dword [0x44de20]
mov dword [0x44de14], eax
call esi
push str.RtlDosPathNameToNtPathName_U_WithStatus
push dword [0x44de20]
mov dword [0x44de18], eax
call esi
mov dword [0x44de1c], eax
push ecx
push 0x44ddbc
mov edx, str.kernel32.dll
lea ecx, [ebp - 0x23c]
call fcn.0041792c
pop ecx
pop ecx
test al, al
je 0x417d1a
push str.MoveFileTransactedW
push dword [0x44ddbc]
call esi
push str.Wow64DisableWow64FsRedirection
push dword [0x44ddbc]
mov dword [0x44dd8c], eax
call esi
push str.Wow64RevertWow64FsRedirection
push dword [0x44ddbc]
mov dword [0x44dd90], eax
call esi
push str.IsWow64Process
push dword [0x44ddbc]
mov dword [0x44dd94], eax
call esi
push str.GetSystemFirmwareTable
push dword [0x44ddbc]
mov dword [0x44dd98], eax
call esi
push str.GetFileInformationByHandleEx
push dword [0x44ddbc]
mov dword [0x44dd9c], eax
call esi
push str.SetFileInformationByHandle
push dword [0x44ddbc]
mov dword [0x44dda0], eax
call esi
push str.FindFirstStreamW
push dword [0x44ddbc]
mov dword [0x44dda4], eax
call esi
push str.FindNextStreamW
push dword [0x44ddbc]
mov dword [0x44dda8], eax
call esi
push str.GetQueuedCompletionStatusEx
push dword [0x44ddbc]
mov dword [0x44ddac], eax
call esi
push str.SetFileCompletionNotificationModes
push dword [0x44ddbc]
mov dword [0x44ddb0], eax
call esi
push str.SetFileIoOverlappedRange
push dword [0x44ddbc]
mov dword [0x44ddb4], eax
call esi
mov dword [0x44ddb8], eax
mov ecx, 0x417893
mov eax, dword [0x44ddb0]
test eax, eax
cmove eax, ecx
mov dword [0x44ddb0], eax
mov eax, dword [0x44ddb4]
test eax, eax
je 0x417d1a
mov dword [0x44e08c], eax
mov dword [0x44ddb4], 0x4178da
push ecx
push 0x44de4c
mov edx, str.ktmw32.dll
lea ecx, [ebp - 0x23c]
call fcn.0041792c
pop ecx
pop ecx
test al, al
je 0x417d5a
push str.CreateTransaction
push dword [0x44de4c]
call esi
push str.CommitTransaction
push dword [0x44de4c]
mov dword [0x44de44], eax
call esi
mov dword [0x44de48], eax
push ecx
push 0x44de8c
mov edx, str.user32.dll
lea ecx, [ebp - 0x23c]
call fcn.0041792c
pop ecx
pop ecx
test al, al
je 0x417de2
push str.ChangeWindowMessageFilter
push dword [0x44de8c]
call esi
push str.RegisterSuspendResumeNotification
push dword [0x44de8c]
mov dword [0x44de74], eax
call esi
push str.UnregisterSuspendResumeNotification
push dword [0x44de8c]
mov dword [0x44de78], eax
call esi
push str.ShutdownBlockReasonCreate
push dword [0x44de8c]
mov dword [0x44de7c], eax
call esi
push str.ShutdownBlockReasonDestroy
push dword [0x44de8c]
mov dword [0x44de80], eax
call esi
push str.SetWindowCompositionAttribute
push dword [0x44de8c]
mov dword [0x44de84], eax
call esi
mov dword [0x44de88], eax
push ecx
push 0x44de2c
mov edx, str.advapi32.dll
lea ecx, [ebp - 0x23c]
call fcn.0041792c
pop ecx
pop ecx
test al, al
je 0x417e22
push str.CreateProcessWithTokenW
push dword [0x44de2c]
call esi
push str.CryptVerifySignatureW
push dword [0x44de2c]
mov dword [0x44de24], eax
call esi
mov dword [0x44de28], eax
push ecx
push 0x44de38
mov edx, str.shell32.dll
lea ecx, [ebp - 0x23c]
call fcn.0041792c
pop ecx
pop ecx
test al, al
je 0x417e62
push str.SHCreateItemFromIDList
push dword [0x44de38]
call esi
push str.SHGetKnownFolderPath
push dword [0x44de38]
mov dword [0x44de30], eax
call esi
mov dword [0x44de34], eax
push ecx
push 0x44de58
mov edx, str.mpr.dll
lea ecx, [ebp - 0x23c]
call fcn.0041792c
pop ecx
pop ecx
test al, al
je 0x417ea2
push str.WNetRestoreSingleConnectionW
push dword [0x44de58]
call esi
push str.WNetGetConnectionW
push dword [0x44de58]
mov dword [0x44de50], eax
call esi
mov dword [0x44de54], eax
push ecx
push 0x44dea0
mov edx, str.secur32.dll
lea ecx, [ebp - 0x23c]
call fcn.0041792c
pop ecx
pop ecx
test al, al
je 0x417ed0
push str.InitSecurityInterfaceW
push dword [0x44dea0]
call esi
mov dword [0x44de9c], eax
push ecx
push 0x44dea8
mov edx, str.cfgmgr32.dll
lea ecx, [ebp - 0x23c]
call fcn.0041792c
pop ecx
pop ecx
test al, al
je 0x417efe
push str.CM_Get_DevNode_PropertyW
push dword [0x44dea8]
call esi
mov dword [0x44dea4], eax
push ecx
push 0x44de70
mov edx, str.wevtapi.dll
lea ecx, [ebp - 0x23c]
call fcn.0041792c
pop ecx
pop ecx
test al, al
je 0x417f74
push str.EvtQuery
push dword [0x44de70]
call esi
push str.EvtNext
push dword [0x44de70]
mov dword [0x44de5c], eax
call esi
push str.EvtCreateRenderContext
push dword [0x44de70]
mov dword [0x44de60], eax
call esi
push str.EvtRender
push dword [0x44de70]
mov dword [0x44de64], eax
call esi
push str.EvtClose
push dword [0x44de70]
mov dword [0x44de68], eax
call esi
mov dword [0x44de6c], eax
push ecx
push 0x44deb8
mov edx, str.dwmapi.dll
lea ecx, [ebp - 0x23c]
call fcn.0041792c
pop ecx
pop ecx
test al, al
je 0x417fc6
push str.DwmGetWindowAttribute
push dword [0x44deb8]
call esi
push str.DwmSetWindowAttribute
push dword [0x44deb8]
mov dword [0x44deac], eax
call esi
push str.DwmFlush
push dword [0x44deb8]
mov dword [0x44deb0], eax
call esi
mov dword [0x44deb4], eax
push ecx
push 0x44dd80
mov edx, str.rstrtmgr.dll
lea ecx, [ebp - 0x23c]
call fcn.0041792c
pop ecx
pop ecx
test al, al
je 0x41804e
push str.RmStartSession
push dword [0x44dd80]
call esi
push str.RmEndSession
push dword [0x44dd80]
mov dword [0x44dd68], eax
call esi
push str.RmRegisterResources
push dword [0x44dd80]
mov dword [0x44dd6c], eax
call esi
push str.RmGetList
push dword [0x44dd80]
mov dword [0x44dd70], eax
call esi
push str.RmShutdown
push dword [0x44dd80]
mov dword [0x44dd74], eax
call esi
push str.RmRestart
push dword [0x44dd80]
mov dword [0x44dd78], eax
call esi
mov dword [0x44dd7c], eax
push ecx
push 0x44def0
mov edx, str.uxtheme.dll
lea ecx, [ebp - 0x23c]
call fcn.0041792c
pop ecx
pop ecx
test al, al
je 0x4181c2
push str.SetWindowTheme
push dword [0x44def0]
call esi
push str.OpenThemeData
push dword [0x44def0]
mov dword [0x44debc], eax
call esi
push str.DrawThemeTextEx
push dword [0x44def0]
mov dword [0x44dec0], eax
call esi
push str.CloseThemeData
push dword [0x44def0]
mov dword [0x44dec4], eax
call esi
mov dword [0x44dec8], eax
mov eax, dword [0x44de10]
mov dword [ebp - 0x244], edi
mov dword [ebp - 0x248], edi
mov dword [ebp - 0x240], edi
test eax, eax
je 0x4181c2
lea ecx, [ebp - 0x240]
push ecx
lea ecx, [ebp - 0x248]
push ecx
lea ecx, [ebp - 0x244]
push ecx
call eax
mov eax, dword [ebp - 0x240]
and eax, 0xfffffff
cmp dword [ebp - 0x244], 0xa
mov dword [ebp - 0x240], eax
jne 0x4181c2
cmp dword [ebp - 0x248], 0
jne 0x4181c2
mov edi, 0x47ba
cmp eax, 0x4563
je 0x418139
cmp eax, edi
je 0x418139
cmp eax, 0x47bb
je 0x418139
cmp eax, 0x4a61
jb 0x4181c2
push 0x31
push dword [0x44def0]
call esi
push 0x68
push dword [0x44def0]
mov dword [0x44decc], eax
call esi
push 0x84
push dword [0x44def0]
mov dword [0x44ded0], eax
call esi
push 0x85
push dword [0x44def0]
mov dword [0x44ded8], eax
call esi
push 0x87
push dword [0x44def0]
mov dword [0x44dedc], eax
cmp dword [ebp - 0x240], edi
jae 0x418197
call esi
mov dword [0x44dee8], eax
jmp 0x41819e
call esi
mov dword [0x44deec], eax
push 0x88
push dword [0x44def0]
call esi
push 0x89
push dword [0x44def0]
mov dword [0x44dee0], eax
call esi
mov dword [0x44dee4], eax
push ecx
push 0x44dd64
mov edx, str.msimg32.dll
lea ecx, [ebp - 0x23c]
call fcn.0041792c
pop ecx
pop ecx
test al, al
je 0x4181f0
push str.AlphaBlend
push dword [0x44dd64]
call esi
mov dword [0x44dd60], eax
push ecx
push 0x44dd88
mov edx, str.wintrust.dll
lea ecx, [ebp - 0x23c]
call fcn.0041792c
pop ecx
pop ecx
test al, al
je 0x41821e
push str.WinVerifyTrust
push dword [0x44dd88]
call esi
mov dword [0x44dd84], eax
push ecx
push 0x44de40
mov edx, str.userenv.dll
lea ecx, [ebp - 0x23c]
call fcn.0041792c
pop ecx
pop ecx
test al, al
je 0x41824c
push str.DeleteProfileW
push dword [0x44de40]
call esi
mov dword [0x44de3c], eax
push ecx
push 0x44de98
mov edx, str.psapi.dll
lea ecx, [ebp - 0x23c]
call fcn.0041792c
pop ecx
pop ecx
test al, al
je 0x41828c
push str.GetProcessMemoryInfo
push dword [0x44de98]
call esi
push str.GetModuleInformation
push dword [0x44de98]
mov dword [0x44de90], eax
call esi
mov dword [0x44de94], eax
push ecx
push 0x44defc
mov edx, str.dnsapi.dll
lea ecx, [ebp - 0x23c]
call fcn.0041792c
pop ecx
pop ecx
test al, al
je 0x4182cc
push str.DnsQuery_W
push dword [0x44defc]
call esi
push str.DnsFree
push dword [0x44defc]
mov dword [0x44def4], eax
call esi
mov dword [0x44def8], eax
lea ecx, [ebp - 0x23c]
call fcn.00404129
call fcn.00436878
ret
call fcn.00428d1b
int3