Function at 0x43bad1
Capabilities:
Get common file path

Disassembly:
push 0x54c
mov eax, 0x4bdd9c
call fcn.0048f706
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x53c]
call fcn.004026b1
xor eax, eax
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x538]
call fcn.004026b1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x554]
call fcn.004026b1
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x544]
call fcn.004026b1
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x540]
call fcn.004026b1
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x550]
call fcn.004026b1
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x54c]
call fcn.004026b1
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x548]
call fcn.004026b1
mov byte [ebp - 4], 7
xor eax, eax
push 0x100
push eax
mov dword [ebp - 0x530], eax
mov dword [ebp - 0x52c], eax
mov dword [ebp - 0x528], eax
mov dword [ebp - 0x524], eax
lea eax, [ebp - 0x520]
push eax
mov dword [ebp - 0x534], 0x11c
call fcn.00490cd0
xor eax, eax
mov word [ebp - 0x420], ax
mov dword [ebp - 0x41e], eax
mov word [ebp - 0x41a], ax
lea eax, [ebp - 0x534]
push eax
call fcn.0043c565
mov eax, dword [ebp - 0x524]
add esp, 0x10
sub eax, 1
je 0x43c38f
sub eax, 1
jne 0x43c48e
mov ecx, dword [ebp - 0x530]
mov edi, dword [sym.imp.USER32.dll_GetSystemMetrics]
cmp ecx, 3
jne 0x43bbff
push dword [ebp - 0x52c]
lea eax, [ebp - 0x53c]
push str.Windows_NT3._d
push eax
call fcn.00402a35
add esp, 0xc
jmp 0x43bd91
mov eax, dword [ebp - 0x52c]
cmp ecx, 4
jne 0x43bc1c
test eax, eax
jne 0x43bd7b
mov esi, str.Windows_NT4
jmp 0x43bd65
cmp ecx, 5
jne 0x43bc96
test eax, eax
jne 0x43bc2f
mov esi, str.Windows_2000
jmp 0x43bd65
cmp eax, 1
jne 0x43bc3e
mov esi, str.Windows_XP
jmp 0x43bd65
cmp eax, 2
jne 0x43bd7b
push 0x59
call edi
test eax, eax
je 0x43bc59
mov esi, str.Windows_Server_2003_R2
jmp 0x43bd65
mov eax, 0x2000
cmp word [ebp - 0x41c], ax
jne 0x43bc71
mov esi, str.Windows_Storage_Server_2003
jmp 0x43bd65
cmp byte [ebp - 0x41a], 1
jne 0x43bc8c
call fcn.0043cbd6
mov esi, str.Windows_XP
test eax, eax
jne 0x43bd65
mov esi, str.Windows_Server_2003
jmp 0x43bd65
cmp ecx, 6
jne 0x43bd14
test eax, eax
jne 0x43bcbb
cmp byte [ebp - 0x41a], 1
mov esi, str.Windows_Server_2008
jne 0x43bd65
mov esi, str.Windows_Vista
jmp 0x43bd65
cmp eax, 1
jne 0x43bcdb
mov esi, str.Windows_Server_2008_R2
cmp byte [ebp - 0x41a], al
jne 0x43bd65
mov esi, str.Windows_7
jmp 0x43bd65
cmp eax, 2
jne 0x43bcf5
cmp byte [ebp - 0x41a], 1
mov esi, str.Windows_Server_2012
jne 0x43bd65
mov esi, str.Windows_8
jmp 0x43bd65
cmp eax, 3
jne 0x43bd0f
cmp byte [ebp - 0x41a], 1
mov esi, str.Windows_Server_2012_R2
jne 0x43bd65
mov esi, str.Windows_8.1
jmp 0x43bd65
cmp eax, 4
je 0x43bd19
cmp ecx, 0xa
jb 0x43bd7b
cmp byte [ebp - 0x41a], 1
je 0x43bd4f
cmp dword [ebp - 0x528], 0x4f78
jb 0x43bd35
mov esi, str.Windows_Server_2022
jmp 0x43bd65
cmp dword [ebp - 0x528], 0x4563
jb 0x43bd48
mov esi, str.Windows_Server_2019
jmp 0x43bd65
mov esi, str.Windows_Server_2016
jmp 0x43bd65
cmp dword [ebp - 0x528], 0x55ec
mov esi, str.Windows_11
jae 0x43bd65
mov esi, str.Windows_10
push esi
call fcn.00494153
pop ecx
push eax
push esi
lea ecx, [ebp - 0x53c]
call fcn.00402053
jmp 0x43bd91
push eax
push ecx
lea eax, [ebp - 0x53c]
push str.Windows_NT__d._d
push eax
call fcn.00402a35
add esp, 0x10
cmp dword [ebp - 0x530], 6
jb 0x43c031
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je case.default.0x43be16
push str.GetProductInfo
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je case.default.0x43be16
xor edx, edx
lea ecx, [ebp - 0x558]
push ecx
push edx
push edx
push dword [ebp - 0x52c]
mov dword [ebp - 0x558], edx
push dword [ebp - 0x530]
call eax
mov eax, dword [ebp - 0x558]
mov ecx, 0xa1
cmp eax, ecx
ja 0x43bfe9
je 0x43bfdf
cmp eax, 0x11
ja 0x43bec7
je 0x43bebd
dec eax
cmp eax, 0xf
ja case.default.0x43be16
jmp dword [eax*4 + 0x43c525]
mov esi, str.Business
jmp 0x43c244
mov esi, str.Business_N
jmp 0x43c244
mov esi, str.Datacenter__Full_installation_
jmp 0x43c244
mov esi, str.Datacenter__Server_Core_installation_
jmp 0x43c244
mov esi, str.Enterprise
jmp 0x43c244
mov esi, str.Enterprise__Full_installation_
jmp 0x43c244
mov esi, str.Enterprise__Server_Core_installation_
jmp 0x43c244
mov esi, str.Datacenter_Enterprise_for_Itanium_based_Systems
jmp 0x43c244
mov esi, str.Home_Basic
jmp 0x43c244
mov esi, str.Home_Basic_N
jmp 0x43c244
mov esi, str.Home_Premium
jmp 0x43c244
mov esi, str.Small_Business_Server
jmp 0x43c244
mov esi, str.Server_Standard__full_installation_
jmp 0x43c244
mov esi, str.Server_Standard__core_installation_
jmp 0x43c244
mov esi, str.Starter
jmp 0x43c244
mov esi, str.Ultimate
jmp 0x43c244
mov esi, str.Web_Server
jmp 0x43c244
cmp eax, 0x3c
ja 0x43bfc7
je 0x43bfd5
cmp eax, 0x18
ja 0x43bf45
je 0x43bf3b
sub eax, 0x12
je 0x43bf31
sub eax, 1
je 0x43bf27
sub eax, 1
je 0x43bf1d
sub eax, 1
je 0x43bf13
sub eax, 1
je 0x43bf09
sub eax, 1
jne case.default.0x43be16
mov esi, str.Storage_Server_Enterprise
jmp 0x43c244
mov esi, str.Storage_Server_Workgroup
jmp 0x43c244
mov esi, str.Storage_Server_Standard
jmp 0x43c244
mov esi, str.Storage_Server_Express
jmp 0x43c244
mov esi, str.Home_Server
jmp 0x43c244
mov esi, str.Cluster_Server
jmp 0x43c244
mov esi, str.Server_for_Small_Business
jmp 0x43c244
sub eax, 0x19
je 0x43bfbd
sub eax, 1
je 0x43bfb3
sub eax, 1
je 0x43bfa9
sub eax, 1
je 0x43bf9f
sub eax, 0x14
je 0x43bf83
sub eax, 1
jne case.default.0x43be16
cmp dword [ebp - 0x52c], 2
mov esi, str.Pro_N
jae 0x43c244
mov esi, str.Professional_N
jmp 0x43c244
cmp dword [ebp - 0x52c], 2
mov esi, 0x4d511c
jae 0x43c244
mov esi, str.Professional
jmp 0x43c244
mov esi, str.Ultimate_N
jmp 0x43c244
mov esi, str.Enterprise_N
jmp 0x43c244
mov esi, str.Home_Premium_N
jmp 0x43c244
mov esi, str.Small_Business_Server_Premium
jmp 0x43c244
sub eax, 0x3d
je 0x43bfd5
sub eax, 1
jne case.default.0x43be16
mov esi, str.Essentials_Server
jmp 0x43c244
mov esi, str.Pro_for_Workstation
jmp 0x43c244
cmp eax, 0xa2
je 0x43c027
cmp eax, 0xa4
je 0x43c01d
cmp eax, 0xa5
je 0x43c013
cmp eax, 0xabcdabcd
jne case.default.0x43be16
mov esi, str.Unlicensed
jmp 0x43c244
mov esi, str.Pro_for_Education_N
jmp 0x43c244
mov esi, str.Pro_for_Education
jmp 0x43c244
mov esi, str.Pro_for_Workstation_N
jmp 0x43c244
cmp dword [ebp - 0x530], 5
jne case.default.0x43be16
cmp dword [ebp - 0x52c], 0
jne 0x43c089
mov al, byte [ebp - 0x41a]
cmp al, 1
je 0x43bf95
cmp al, 3
jne case.default.0x43be16
mov al, byte [ebp - 0x41c]
test al, al
jns 0x43c071
mov esi, str.DataCenter_Server
jmp 0x43c244
test al, 2
je 0x43c07f
mov esi, str.Advanced_Server
jmp 0x43c244
mov esi, str.Server
jmp 0x43c244
cmp dword [ebp - 0x52c], 1
jb case.default.0x43be16
test dword [ebp - 0x41c], 0x200
je 0x43c0a9
mov esi, str.Home_Edition
jmp 0x43c0e6
mov al, byte [ebp - 0x41c]
test al, al
jns 0x43c0ba
mov esi, str.Datacenter_Edition
jmp 0x43c0e6
test al, 2
je 0x43c0c5
mov esi, str.Enterprise_Edition
jmp 0x43c0e6
test dword [ebp - 0x41c], 0x400
je 0x43c0d8
mov esi, str.Web_Edition
jmp 0x43c0e6
cmp byte [ebp - 0x41a], 1
jne 0x43c0fa
mov esi, str.Professional
push esi
call fcn.00494153
pop ecx
push eax
push esi
lea ecx, [ebp - 0x538]
call fcn.00402053
push 0x57
call edi
test eax, eax
je 0x43c237
push 0x208
lea eax, [ebp - 0x418]
push 0
push eax
call fcn.00490cd0
push 0x200
lea eax, [ebp - 0x210]
push 0
push eax
call fcn.00490cd0
add esp, 0x18
lea eax, [ebp - 0x418]
mov edi, 0x104
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push str.ehomeehshell.exe
mov esi, eax
lea eax, [ebp - 0x418]
push edi
push eax
call fcn.0049c79c
add esp, 0xc
test esi, esi
je case.default.0x43be16
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x418]
push eax
call fcn.0043eeb6
pop ecx
pop ecx
test eax, eax
je case.default.0x43be16
lea eax, [ebp - 0x210]
push eax
call fcn.00494153
pop ecx
push eax
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0x548]
call fcn.00402053
push 0
push 0x4d5330
lea ecx, [ebp - 0x548]
call fcn.00407548
test eax, eax
jne case.default.0x43be16
mov esi, str.Media_Center
push esi
call fcn.00494153
pop ecx
push eax
push esi
lea ecx, [ebp - 0x538]
call fcn.00402053
push 0x4c5940
push str.5.1.
lea ecx, [ebp - 0x548]
call fcn.00408d85
push dword [ebp - 0x548]
call fcn.004a0242
fld qword [str._npP]
fcomp st(1)
fnstsw ax
pop ecx
test ah, 1
jne 0x43c20a
fstp st(0)
mov esi, str.2002
jmp 0x43c221
fcomp qword [0x4d5460]
fnstsw ax
mov esi, str.2004
test ah, 0x41
jnp 0x43c221
mov esi, str.2005
push esi
call fcn.00494153
pop ecx
push eax
push esi
lea ecx, [ebp - 0x538]
call fcn.004029a9
jmp case.default.0x43be16
push 0x56
call edi
test eax, eax
je case.default.0x43be16
mov esi, str.Tablet_PC
push esi
call fcn.00494153
pop ecx
push eax
push esi
lea ecx, [ebp - 0x538]
call fcn.00402053
lea eax, [ebp - 0x520]
push eax
call fcn.00494153
pop ecx
push eax
lea eax, [ebp - 0x520]
push eax
lea ecx, [ebp - 0x554]
call fcn.00402053
push 0x4d5398
push str.Service_Pack
lea ecx, [ebp - 0x554]
call fcn.00408d85
push dword [ebp - 0x52c]
lea eax, [ebp - 0x544]
push dword [ebp - 0x530]
push str._d._d
push eax
call fcn.00402a35
push dword [ebp - 0x528]
lea eax, [ebp - 0x540]
push 0x4c6748
push eax
call fcn.00402a35
add esp, 0x1c
call fcn.0043cbd6
test eax, eax
je 0x43c2d4
mov esi, 0x4d53bc
jmp 0x43c307
call fcn.0043c5ae
test eax, eax
je 0x43c2e4
mov esi, str.ARM32
jmp 0x43c307
call fcn.0043c610
test eax, eax
je 0x43c2f4
mov esi, str.ARM64
jmp 0x43c307
call fcn.0043c8cb
mov esi, str.IA64
test eax, eax
jne 0x43c307
mov esi, 0x4c634c
push esi
call fcn.00494153
pop ecx
push eax
push esi
lea ecx, [ebp - 0x54c]
call fcn.00402053
push dword [ebp - 0x54c]
mov eax, dword [ebp - 0x554]
push dword [ebp - 0x540]
push dword [ebp - 0x544]
cmp dword [eax - 0xc], 0
je 0x43c35c
push eax
push dword [ebp - 0x538]
lea eax, [ebp - 0x550]
push dword [ebp - 0x53c]
push str._s__s__s___s_Build__s____s_
push eax
call fcn.00402a35
add esp, 0x20
jmp 0x43c37c
push dword [ebp - 0x538]
lea eax, [ebp - 0x550]
push dword [ebp - 0x53c]
push str._s__s___s_Build__s____s_
push eax
call fcn.00402a35
add esp, 0x1c
lea eax, [ebp - 0x550]
mov ecx, ebx
push eax
call fcn.00401717
jmp 0x43c48e
mov eax, dword [ebp - 0x52c]
test eax, eax
je 0x43c3e2
cmp eax, 0xa
je 0x43c3b1
cmp eax, 0x5a
je 0x43c3aa
mov esi, str.Windows_9x
jmp 0x43c424
mov esi, str.Windows_Me
jmp 0x43c424
mov eax, 0x8ae
cmp word [ebp - 0x528], ax
jb 0x43c3c6
mov esi, str.Windows_98_SE
jmp 0x43c424
mov eax, 0x7d0
cmp word [ebp - 0x528], ax
jb 0x43c3db
mov esi, str.Windows_98_SP1
jmp 0x43c424
mov esi, str.Windows_98
jmp 0x43c424
mov eax, 0x4be
cmp word [ebp - 0x528], ax
jb 0x43c3f7
mov esi, str.Windows_95_OSR2.5
jmp 0x43c424
mov eax, 0x4bc
cmp word [ebp - 0x528], ax
jb 0x43c40c
mov esi, str.Windows_95_OSR2.1
jmp 0x43c424
mov eax, 0x457
mov esi, str.Windows_95_OSR2
cmp word [ebp - 0x528], ax
je 0x43c424
mov esi, str.Windows_95
push esi
call fcn.00494153
pop ecx
push eax
push esi
lea ecx, [ebp - 0x53c]
call fcn.00402053
push dword [ebp - 0x52c]
lea eax, [ebp - 0x544]
push dword [ebp - 0x530]
push str._d._d
push eax
call fcn.00402a35
movzx eax, word [ebp - 0x528]
push eax
lea eax, [ebp - 0x540]
push 0x4c6748
push eax
call fcn.00402a35
push dword [ebp - 0x540]
push dword [ebp - 0x544]
push dword [ebp - 0x53c]
push str._s___s_Build__s_
push ebx
call fcn.00402a35
add esp, 0x30
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x548]
lea ecx, [ecx - 0x10]
call fcn.00401fe9
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x54c]
lea ecx, [ecx - 0x10]
call fcn.00401fe9
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x550]
lea ecx, [ecx - 0x10]
call fcn.00401fe9
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x540]
lea ecx, [ecx - 0x10]
call fcn.00401fe9
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x544]
lea ecx, [ecx - 0x10]
call fcn.00401fe9
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x554]
lea ecx, [ecx - 0x10]
call fcn.00401fe9
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x538]
lea ecx, [ecx - 0x10]
call fcn.00401fe9
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x53c]
lea ecx, [ecx - 0x10]
call fcn.00401fe9
call fcn.0048f6b5
ret