Function at 0x4490a8
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x430
mov eax, dword [0x46700c]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov esi, ecx
push 0x88
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], eax
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], esi
call dword [sym.imp.msvcrt.dll_void____cdecl_operator_new_unsigned_int_]
pop ecx
xor ecx, ecx
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], ecx
test eax, eax
je 0x4490fa
call fcn.0044744a
mov ebx, eax
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], ebx
xor ecx, ecx
jmp 0x449102
mov ebx, ecx
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], ecx
test ebx, ebx
jne 0x449110
mov eax, 0x8007000e
jmp 0x4492fc
push ecx
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push esi
mov eax, 0x404174
call fcn.00445e81
mov edi, eax
test edi, edi
jns 0x449142
push 0x404174
push 0x41f4c8
push 2
pop esi
call fcn.00440126
pop ecx
pop ecx
jmp 0x4492d3
push ebx
lea edi, reloc.ADVAPI32.dll_TraceMessage
call fcn.004478ef
cmp dword [ebx + 0x2c], 1
jne 0x449181
xor eax, eax
push eax
mov eax, edi
push eax
push esi
mov eax, 0x404458
call fcn.00445e81
test eax, eax
js 0x449181
mov eax, edi
push 0x404678
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
neg eax
sbb eax, eax
pop ecx
inc eax
pop ecx
mov dword [ebx + 0x5c], eax
xor eax, eax
push eax
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push esi
mov eax, 0x404328
call fcn.00445e81
mov edi, eax
test edi, edi
jns 0x4491a3
push 0x404328
jmp 0x44912e
cmp dword [ebx + 0x2c], 1
je 0x449239
mov edi, 0x104
push edi
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x449205
lea ecx, reloc.ADVAPI32.dll_TraceMessage
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x428]
jne 0x4491cd
sub ecx, edx
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
sar ecx, 1
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
sub edi, ecx
push 0x41f508
mov eax, edi
lea ecx, reloc.ADVAPI32.dll_TraceMessage
call fcn.0042c95b
add esp, 0xc
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
call fcn.00440bc3
test eax, eax
jne 0x449231
push 0x404328
push 0x41f51c
xor edi, edi
push 2
pop esi
inc edi
call fcn.00440126
pop ecx
pop ecx
jmp 0x4492d7
lea edi, reloc.ADVAPI32.dll_TraceMessage
jmp 0x44923f
lea edi, reloc.ADVAPI32.dll_TraceMessage
mov eax, ebx
call fcn.004479f3
xor eax, eax
push eax
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push esi
mov esi, 0x404288
mov eax, esi
call fcn.00445e81
mov edi, eax
test edi, edi
jns 0x449269
push esi
jmp 0x44912e
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
mov esi, ebx
call fcn.00448fae
xor esi, esi
push esi
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push dword [ebp - 0x424]
mov eax, 0x404430
call fcn.00445e81
test eax, eax
js 0x4492a3
lea edi, [ebx + 0x14]
lea eax, reloc.ADVAPI32.dll_TraceMessage
call fcn.0044056c
cmp dword [ebx + 4], esi
jne 0x4492ad
cmp dword [ebx + 0xc], esi
je 0x4492d0
cmp dword [ebx + 0x58], 2
je 0x4492d0
mov edi, dword [ebp - reloc.ADVAPI32.dll_TraceMessage]
mov esi, dword [ebp - reloc.ADVAPI32.dll_TraceMessage]
xor ebx, ebx
call fcn.00449058
mov ebx, dword [ebp - reloc.ADVAPI32.dll_TraceMessage]
mov edi, eax
jmp 0x4492d3
xor edi, edi
inc edi
test edi, edi
je 0x4492fa
mov eax, ebx
call fcn.004474c6
push ebx
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void__]
pop ecx
test edi, edi
jns 0x4492fa
push edi
push 0x41f550
push 2
pop esi
call fcn.00440126
pop ecx
pop ecx
mov eax, edi
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004655f1
leave
ret 4