Function at 0x40f304
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb4
mov eax, 0x48fa08
call fcn.004696b8
mov word [ebp - 0x3c], 0x14
mov edx, 0x49b11c
lea eax, [ebp - 4]
call fcn.00474b80
inc dword [ebp - 0x30]
xor edx, edx
mov word [ebp - 0x3c], 8
mov word [ebp - 0x3c], 0x20
mov dword [ebp - 8], edx
inc dword [ebp - 0x30]
mov word [ebp - 0x3c], 8
push str._SYSTEM_
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x40f358
mov eax, dword [ebp - 4]
jmp 0x40f35d
mov eax, 0x48c4dc
push eax
call fcn.00469461
add esp, 8
test eax, eax
je 0x40f3e3
push 0x100
lea edx, [ebp - 0x14c]
push edx
call sub.KERNEL32.DLL_GetSystemDirectoryA
mov word [ebp - 0x3c], 0x2c
xor ecx, ecx
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], ecx
push eax
inc dword [ebp - 0x30]
lea eax, [ebp - 4]
call fcn.00474e58
mov ecx, eax
add ecx, 0xfffffff8
lea eax, [ebp - 4]
mov edx, 9
call fcn.00474f88
lea edx, [ebp - 0xc]
lea eax, [ebp - 8]
call fcn.00474d74
dec dword [ebp - 0x30]
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00474d44
mov ecx, dword [ebp - 8]
test ecx, ecx
je 0x40f3ce
mov edx, dword [ebp - 8]
jmp 0x40f3d3
mov edx, 0x48c4dd
lea eax, [ebp - 0x14c]
call fcn.0045fd60
jmp 0x40f553
push str._WINDOWS_
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x40f3f4
mov eax, dword [ebp - 4]
jmp 0x40f3f9
mov eax, 0x48c4e8
push eax
call fcn.00469461
add esp, 8
test eax, eax
je 0x40f47f
push 0x100
lea edx, [ebp - 0x14c]
push edx
call sub.KERNEL32.DLL_GetWindowsDirectoryA
mov word [ebp - 0x3c], 0x38
xor ecx, ecx
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], ecx
push eax
inc dword [ebp - 0x30]
lea eax, [ebp - 4]
call fcn.00474e58
mov ecx, eax
add ecx, 0xfffffff7
lea eax, [ebp - 4]
mov edx, 0xa
call fcn.00474f88
lea edx, [ebp - 0x10]
lea eax, [ebp - 8]
call fcn.00474d74
dec dword [ebp - 0x30]
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00474d44
mov ecx, dword [ebp - 8]
test ecx, ecx
je 0x40f46a
mov edx, dword [ebp - 8]
jmp 0x40f46f
mov edx, 0x48c4e9
lea eax, [ebp - 0x14c]
call fcn.0045fd60
jmp 0x40f553
push str._TEMP_
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x40f490
mov eax, dword [ebp - 4]
jmp 0x40f495
mov eax, 0x48c4f1
push eax
call fcn.00469461
add esp, 8
test eax, eax
je 0x40f518
lea edx, [ebp - 0x14c]
push edx
push 0x100
call sub.KERNEL32.DLL_GetTempPathA
mov word [ebp - 0x3c], 0x44
xor ecx, ecx
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], ecx
push eax
inc dword [ebp - 0x30]
lea eax, [ebp - 4]
call fcn.00474e58
mov ecx, eax
add ecx, 0xfffffff9
lea eax, [ebp - 4]
mov edx, 8
call fcn.00474f88
lea edx, [ebp - 0x14]
lea eax, [ebp - 8]
call fcn.00474d74
dec dword [ebp - 0x30]
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00474d44
mov ecx, dword [ebp - 8]
test ecx, ecx
je 0x40f506
mov edx, dword [ebp - 8]
jmp 0x40f50b
mov edx, 0x48c4f2
lea eax, [ebp - 0x14c]
call fcn.0045fd60
jmp 0x40f553
lea eax, [ebp - 4]
call fcn.00474e58
test eax, eax
je 0x40f542
mov edx, dword [ebp - 4]
test edx, edx
je 0x40f530
mov edx, dword [ebp - 4]
jmp 0x40f535
mov edx, 0x48c4f3
lea eax, [ebp - 0x14c]
call fcn.0045fc94
jmp 0x40f553
push 0x100
lea ecx, [ebp - 0x14c]
push ecx
call sub.KERNEL32.DLL_GetSystemDirectoryA
mov word [ebp - 0x3c], 0x50
lea edx, [ebp - 0x14c]
lea eax, [ebp - 0x18]
call fcn.00474b48
inc dword [ebp - 0x30]
lea edx, [ebp - 0x18]
lea eax, [ebp - 4]
call fcn.00474d74
dec dword [ebp - 0x30]
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.00474d44
mov word [ebp - 0x3c], 0x5c
xor ecx, ecx
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], ecx
push eax
inc dword [ebp - 0x30]
lea eax, [ebp - 4]
call fcn.00474e58
mov edx, eax
lea eax, [ebp - 4]
mov ecx, 1
call fcn.00474f88
lea edx, [ebp - 0x1c]
push edx
lea eax, [ebp - 0x20]
mov dl, 0x5c
call fcn.00474bbc
inc dword [ebp - 0x30]
lea edx, [ebp - 0x20]
pop eax
call fcn.00474e40
push eax
dec dword [ebp - 0x30]
lea eax, [ebp - 0x20]
mov edx, 2
call fcn.00474d44
dec dword [ebp - 0x30]
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.00474d44
pop ecx
test cl, cl
je 0x40f645
mov word [ebp - 0x3c], 0x68
mov edx, 0x48c4f4
lea eax, [ebp - 0x24]
call fcn.00474b48
inc dword [ebp - 0x30]
xor eax, eax
mov dword [ebp - 0x28], eax
lea eax, [ebp - 4]
inc dword [ebp - 0x30]
lea edx, [ebp - 0x24]
lea ecx, [ebp - 0x28]
call fcn.00474d9c
lea edx, [ebp - 0x28]
lea eax, [ebp - 4]
call fcn.00474d74
dec dword [ebp - 0x30]
lea eax, [ebp - 0x28]
mov edx, 2
call fcn.00474d44
dec dword [ebp - 0x30]
lea eax, [ebp - 0x24]
mov edx, 2
call fcn.00474d44
mov word [ebp - 0x3c], 0x74
lea edx, [ebp - 4]
mov eax, dword [ebp + 8]
call fcn.00474d74
mov eax, dword [ebp + 8]
mov edx, 2
mov word [ebp - 0x3c], 0x80
push eax
lea eax, [ebp - 8]
dec dword [ebp - 0x30]
call fcn.00474d44
dec dword [ebp - 0x30]
lea eax, [ebp - 4]
mov edx, 2
call fcn.00474d44
pop eax
mov word [ebp - 0x3c], 0x74
inc dword [ebp - 0x30]
mov edx, dword [ebp - 0x4c]
mov dword fs:[0], edx
mov esp, ebp
pop ebp
ret