Function at 0x41009c40
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x411bade8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov ebx, ecx
xor esi, esi
cmp dword [ebx + 4], esi
je 0x41009c70
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.4112e1a6
mov esp, ebp
pop ebp
ret
push 0x103
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x41009c9b
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.4112e1a6
mov esp, ebp
pop ebp
ret
push edi
mov ecx, ebx
call fcn.41009b70
lea edi, [ebp - 0x20c]
add edi, 0xfffffffe
cmp eax, 2
jne 0x41009e34
mov ax, word [edi + 2]
add edi, 2
cmp ax, si
jne 0x41009cb5
mov ecx, dword [0x41158aa4]
lea eax, [ebp - 0x20c]
mov dword [edi], ecx
add eax, 0xfffffffe
mov cx, word [eax + 2]
add eax, 2
cmp cx, si
jne 0x41009cd2
mov edx, dword [str.thinmon.dll]
mov ecx, dword [0x4115a5f8]
mov dword [eax], edx
mov edx, dword [0x4115a5fc]
mov dword [eax + 4], ecx
mov ecx, dword [0x4115a600]
mov dword [eax + 8], edx
mov edx, dword [0x4115a604]
mov dword [eax + 0xc], ecx
mov ecx, dword [0x4115a608]
mov dword [eax + 0x10], edx
lea edx, [ebp - 0x20c]
push edx
mov dword [eax + 0x14], ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebx + 4], eax
cmp eax, esi
je 0x41009e7f
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4115a7c0
push eax
call edi
mov dword [ebx + 8], eax
cmp eax, esi
jne 0x41009d84
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [ebx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push str.GetProcAddress_hSpooler___XcvDataW___fehlgeschlagen
push 0x2000001
push 0xac
push str.DLL_TMComm.cpp
mov dword [ebx + 4], esi
call fcn.41002c10
add esp, 0x10
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.4112e1a6
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebx + 4]
push 0x4115a728
push ecx
call edi
mov dword [ebx + 0xc], eax
cmp eax, esi
jne 0x41009dda
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [ebx + 4]
push edx
mov edi, eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 0x4115a6b8
push 0x2000001
push 0xb7
push str.DLL_TMComm.cpp
mov dword [ebx + 4], esi
call fcn.41002c10
add esp, 0x10
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.4112e1a6
mov esp, ebp
pop ebp
ret
mov eax, dword [ebx + 4]
push 0x4115a6a4
push eax
call edi
mov dword [ebx + 0x10], eax
cmp eax, esi
jne 0x41009ef1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebx + 4]
push ecx
mov edi, eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push str.GetProcAddress_hSpooler___ClosePrinterW___f
push 0x2000001
push 0xc2
push str.DLL_TMComm.cpp
mov dword [ebx + 4], esi
call fcn.41002c10
add esp, 0x10
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.4112e1a6
mov esp, ebp
pop ebp
ret
mov ax, word [edi + 2]
add edi, 2
cmp ax, si
jne 0x41009e34
mov edx, dword [0x41158aa4]
mov dword [edi], edx
lea edi, [ebp - 0x20c]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
cmp ax, si
jne 0x41009e51
mov ecx, 6
mov esi, str.winspool.drv
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x20c]
push eax
movsw word es:[edi], word [esi]
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebx + 4], eax
test eax, eax
jne 0x41009e96
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.4112e1a6
mov esp, ebp
pop ebp
ret
push 0x4115a7c0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebx + 8], eax
test eax, eax
jne 0x41009ef1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebx + 4]
push ecx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push str.GetProcAddress_hSpooler___XcvDataW___fehlgeschlagen
push 0x2000001
push 0xdb
push str.DLL_TMComm.cpp
mov dword [ebx + 4], 0
call fcn.41002c10
add esp, 0x10
pop edi
mov eax, esi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.4112e1a6
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.4112e1a6
mov esp, ebp
pop ebp
ret