Function at 0x40ce40
Capabilities:
Get common file path

Disassembly:
sub esp, 0x7b0
mov ecx, dword [0x48b700]
mov eax, dword [str.LowerFilters]
mov dword [esp + 0x10], ecx
xor ecx, ecx
mov edx, dword [0x48b704]
mov dword [esp + 0x19], ecx
mov dword [esp + 0x1d], ecx
push ebx
mov ebx, dword [esp + 0x7b8]
mov dword [esp + 0x25], ecx
mov dword [esp + 0x29], ecx
push ebp
mov dword [esp + 0x14], eax
mov al, byte [0x48b708]
mov word [esp + 0x31], cx
xor ebp, ebp
push esi
push edi
mov dword [esp + 0x24], edx
mov byte [esp + 0x28], al
mov byte [esp + 0x3b], cl
mov dword [ebx + 0x41008], ebp
mov dword [ebx + 0x3e804], ebp
mov dword [esp + 0x14], ebp
cmp ebp, 1
jne 0x40cecf
mov edi, str.UpperFilters
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x1c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.SYSTEMCurrentControlSetControlClass4D36E965_E325_11CE_BFC1_08002BE10318
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x3c0]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x3c0]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x10]
push ecx
push 1
push 0
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [0x4a493c]
test eax, eax
jne 0x40d1ce
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x1bc]
push eax
lea edx, [esp + 0x20]
push ecx
push edx
call fcn.00404b50
add esp, 0xc
mov esi, eax
mov eax, dword [esp + 0x10]
push eax
call dword [0x4a4940]
cmp esi, 0xffff
je 0x40d1c3
lea esi, [esp + esi + 0x1bc]
lea ebp, [esp + 0x1bc]
mov dword [esp + 0x18], esi
add ebx, 0x4118c
push ebp
lea ecx, [esp + 0x3c4]
push str.SYSTEMCurrentControlSetServices_s
push ecx
call fcn.0044537b
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x3c0]
push edx
push 1
push 0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [0x4a493c]
test eax, eax
jne 0x40d182
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x3c0]
push ecx
push edx
push str.ImagePath
call fcn.00404b50
add esp, 0xc
cmp eax, 0xffff
jne 0x40cff3
lea eax, [esp + 0x2bc]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [esp + 0x2bc]
push ebp
push ecx
lea edx, [esp + 0x3c8]
push str._sdrivers_s.sys
push edx
call fcn.0044537b
add esp, 0x10
lea eax, [esp + 0x3c]
lea ecx, [esp + 0xbc]
push eax
lea edx, [esp + 0x140]
push ecx
lea eax, [esp + 0x3c8]
push edx
push eax
call fcn.004033a0
mov al, byte [esp + 0x24]
add esp, 0x10
test al, 1
je 0x40d0cb
or ecx, 0xffffffff
mov edi, ebp
xor eax, eax
lea edx, [ebx - 0x180]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
shr ecx, 2
mov edi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x3c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [ebx - 0x100]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0xbc]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [ebx - 0x80]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x13c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [esp + 0x7c4]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
inc dword [eax + 0x41008]
jmp 0x40d178
or ecx, 0xffffffff
mov edi, ebp
xor eax, eax
lea edx, [ebx - 0x2984]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
shr ecx, 2
mov edi, edx
lea edx, [ebx - 0x2804]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x3c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [ebx - 0x2904]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0xbc]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [ebx - 0x2884]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x13c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [esp + 0x7c4]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
inc dword [eax + 0x3e804]
mov esi, dword [esp + 0x18]
add ebx, 0x200
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
add ebp, ecx
cmp byte [ebp], 0
jne 0x40d1a2
cmp ebp, esi
jae 0x40d1b8
mov al, byte [ebp + 1]
inc ebp
test al, al
je 0x40d196
cmp ebp, esi
jae 0x40d1b8
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
jne 0x40cf67
mov ebx, dword [esp + 0x7c4]
mov ebp, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
push ecx
call dword [0x4a4940]
inc ebp
cmp ebp, 2
mov dword [esp + 0x14], ebp
jl 0x40cea4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x7b0
ret