Function at 0x4168a3
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x34
push ebx
xor ebx, ebx
push esi
push edi
mov dword [esp + 0x14], ebx
mov byte [esp + 0x13], bl
mov byte [esp + 0x12], bl
call fcn.00416290
mov esi, 0x42d918
mov dword [0x42da58], 0x4013a0
mov dword [0x42da5c], 0x4011e8
mov dword [0x42da60], 0x401238
mov dword [0x42da64], 0x401128
mov dword [0x42da68], 0x4010c0
mov dword [0x42da6c], 0x401400
mov dword [0x42da70], 0x4011f8
mov dword [0x42da74], 0x401138
mov dword [0x42d05c], esi
mov edi, 0x42da58
mov ecx, dword [edi]
xor edx, edx
lea eax, [esi + 8]
push eax
push edx
push edx
lea eax, [esp + 0x24]
push eax
push 1
push ecx
push esi
mov dword [esp + 0x34], ecx
mov dword [esp + 0x38], edx
push 0x416394
add edi, 4
mov dword [esi + 0x20], ecx
call dword [sym.imp.ADVAPI32.dll_RegisterTraceGuidsW]
mov esi, dword [esi]
test esi, esi
jne 0x416924
call fcn.00417374
mov eax, dword [0x42d05c]
cmp eax, 0x42d05c
je 0x416994
test dword [eax + 0xbc], reloc.ADVAPI32.dll_EventActivityIdControl
je 0x416994
cmp byte [eax + 0xb9], 4
jb 0x416994
push 0x401918
push 0x11
push dword [eax + 0xb4]
push dword [eax + 0xb0]
call fcn.00415ddb
push dword [ebp + 0xc]
lea esi, [esp + 0x24]
push dword [ebp + 8]
call fcn.00416422
mov ecx, dword [esp + 0x30]
call fcn.0041674d
xor edi, edi
push edi
push edi
push 1
push edi
call dword [sym.imp.KERNEL32.dll_HeapSetInformation]
call fcn.00415c6b
mov esi, eax
test esi, esi
js 0x416b11
push 0x42da78
push dword [esp + 0x3c]
call dword [sym.imp.RPCRT4.dll_UuidFromStringW]
mov ecx, eax
test ecx, ecx
je 0x416a2b
mov esi, ecx
jle 0x4169ed
and esi, 0xffff
or esi, 0x80070000
mov eax, dword [0x42d05c]
cmp eax, 0x42d05c
je 0x416a2b
test dword [eax + 0xbc], reloc.ADVAPI32.dll_EventActivityIdControl
je 0x416a2b
cmp byte [eax + 0xb9], 1
jb 0x416a2b
push ecx
mov ecx, dword [esp + 0x3c]
push 0x401918
push 0x12
push dword [eax + 0xb4]
push dword [eax + 0xb0]
call fcn.0041614d
test esi, esi
js 0x416b11
push 0x104
push 0x42d6f0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov dword [0x42d6ec], eax
test eax, eax
jne 0x416aa0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
mov esi, ecx
test ecx, ecx
jle 0x416a66
and esi, 0xffff
or esi, 0x80070000
mov eax, dword [0x42d05c]
cmp eax, 0x42d05c
je 0x416aa0
test dword [eax + 0xbc], reloc.ADVAPI32.dll_EventActivityIdControl
je 0x416aa0
cmp byte [eax + 0xb9], 1
jb 0x416aa0
push ecx
push 0x401918
push 0x13
push dword [eax + 0xb4]
push dword [eax + 0xb0]
call fcn.0041722a
test esi, esi
js 0x416b11
push 0x42d6f0
push 0x104
mov esi, 0x42d4e0
push esi
call dword [sym.imp.msvcrt.dll_wcscpy_s]
add esp, 0xc
push 0x4017c8
push esi
mov edx, 0x104
call fcn.004171bf
mov esi, eax
test esi, esi
jns 0x416c6b
mov eax, dword [0x42d05c]
cmp eax, 0x42d05c
je 0x416b11
test dword [eax + 0xbc], reloc.ADVAPI32.dll_EventActivityIdControl
je 0x416b11
cmp byte [eax + 0xb9], 1
jb 0x416b11
push esi
push 0x401918
push 0x14
push dword [eax + 0xb4]
push dword [eax + 0xb0]
call fcn.0041722a
test byte [0x42dac0], 4
je 0x416b25
push esi
push 0x401350
call fcn.0041704a
test esi, esi
js 0x416b30
mov eax, ebx
call fcn.00419300
test ebx, ebx
je 0x416b42
mov esi, ebx
call fcn.00415ac5
push ebx
call fcn.0042b5de
pop ecx
mov esi, dword [0x42d910]
xor ebx, ebx
test esi, esi
je 0x416b9e
cmp dword [esi], ebx
je 0x416b95
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x42d910]
mov eax, dword [eax + 0x10]
add eax, 0x1c
cmp dword [eax], eax
mov ecx, 0x401860
sete al
movzx eax, al
push eax
push 0x401844
push ebx
push ebx
push ebx
call fcn.0042ba80
mov eax, dword [0x42d910]
push dword [eax + 0x10]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, dword [0x42d910]
test esi, esi
je 0x416b9e
call fcn.00417423
push dword [0x42d6e8]
call fcn.0042b5de
cmp byte [esp + 0x16], 0
pop ecx
je 0x416bc8
call dword [sym.imp.WUDFPlatform.dll_ShutdownPlatformLibrary]
mov eax, dword [0x42da90]
mov ecx, dword [eax]
push eax
call dword [ecx + UnregisterTraceGuids]
mov dword [0x42da90], ebx
test byte [0x42dac0], 1
je 0x416bdb
push 0x401410
call fcn.0041711a
mov ecx, dword [0x42d900]
test ecx, ecx
je 0x416bf0
mov eax, dword [ecx]
call dword [eax + reloc.ADVAPI32.dll_GetTraceEnableFlags]
mov dword [0x42d900], ebx
mov ecx, dword [0x42da88]
test ecx, ecx
je 0x416c06
mov eax, dword [ecx]
push ecx
call dword [eax + UnregisterTraceGuids]
mov dword [0x42da88], ebx
mov eax, dword [0x42d05c]
mov edi, 0x42d05c
cmp eax, edi
je 0x416c41
test dword [eax + 0xbc], reloc.ADVAPI32.dll_EventActivityIdControl
je 0x416c41
cmp byte [eax + 0xb9], 4
jb 0x416c41
push 0x401918
push 0x18
push dword [eax + 0xb4]
push dword [eax + 0xb0]
call fcn.00415ddb
cmp byte [esp + 0x13], 0
je 0x416c4e
call dword [sym.imp.ole32.dll_CoUninitialize]
call fcn.00415c43
call fcn.0041701b
mov esi, dword [0x42d05c]
cmp esi, edi
je 0x416ebd
jmp 0x416eb3
push 0x42da88
push 0x42da78
push 0x4017e8
push 0x4017fc
push 1
push 0x42d4e0
push 4
call dword [sym.imp.WUDFPlatform.dll_GetAndInitializePlatformObject]
mov esi, eax
test esi, esi
js 0x416b11
mov esi, dword [0x42da88]
mov eax, dword [esi]
push esi
call dword [eax + reloc.ADVAPI32.dll_GetTraceEnableFlags]
push dword [0x42da88]
mov dword [0x42da90], esi
call dword [sym.imp.WUDFPlatform.dll_InitializePlatformLibrary]
mov esi, eax
test esi, esi
js 0x416b11
push 0x42d900
call dword [sym.imp.WUDFPlatform.dll_WdfGetLpcInterface]
test eax, eax
jns 0x416d11
mov esi, eax
or esi, 0x10000000
mov eax, dword [0x42d05c]
cmp eax, 0x42d05c
je 0x416d11
test dword [eax + 0xbc], reloc.ADVAPI32.dll_EventActivityIdControl
je 0x416d11
cmp byte [eax + 0xb9], 1
jb 0x416d11
push esi
push 0x401918
push 0x15
push dword [eax + 0xb4]
push dword [eax + 0xb0]
call fcn.0041722a
test esi, esi
js 0x416b11
mov ecx, dword [esp + 0x30]
mov byte [esp + 0x12], 1
call fcn.004167f4
test byte [0x42dac0], 1
je 0x416d3a
push 0x4010b0
call fcn.0041711a
mov eax, dword [0x42d6ec]
push 2
add eax, 0xf
xor ecx, ecx
pop edx
mov dword [0x42d4dc], eax
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0042b9fe
mov dword [0x42d6e8], eax
test eax, eax
jne 0x416da6
mov eax, dword [0x42d05c]
cmp eax, 0x42d05c
je 0x416d9c
test byte [eax + 0xbc], 4
je 0x416d9c
cmp byte [eax + 0xb9], 1
jb 0x416d9c
push EventUnregister
push 0x401918
push 0x16
push dword [eax + 0xb4]
push dword [eax + 0xb0]
call fcn.0041722a
mov esi, 0x8007000e
jmp 0x416b11
mov eax, dword [0x42d4dc]
push 0x401818
push 0x42d6f0
push 0x401838
push dword [0x42d6e8]
call fcn.004170b4
mov esi, eax
add esp, 0x10
test esi, esi
js 0x416b11
push edi
push edi
call dword [sym.imp.ole32.dll_CoInitializeEx]
mov esi, eax
test esi, esi
jns 0x416e19
mov eax, dword [0x42d05c]
cmp eax, 0x42d05c
je 0x416e1e
test byte [eax + 0xbc], 4
je 0x416e1e
cmp byte [eax + 0xb9], 1
jb 0x416e1e
push esi
push 0x401918
push 0x17
push dword [eax + 0xb4]
push dword [eax + 0xb0]
call fcn.0041722a
jmp 0x416e1e
mov byte [esp + 0x13], 1
test esi, esi
js 0x416b11
call fcn.00425c8d
mov esi, eax
test esi, esi
js 0x416b11
call fcn.0041fe09
mov esi, eax
test esi, esi
js 0x416b11
call fcn.00423882
mov esi, eax
test esi, esi
js 0x416b11
lea edi, [esp + 0x14]
call fcn.004178b9
mov ebx, dword [esp + 0x14]
mov esi, eax
test esi, esi
js 0x416b11
lea eax, [esp + 0x20]
push eax
push ebx
call fcn.00417923
mov esi, eax
test esi, esi
js 0x416b11
test byte [0x42dac0], 1
je 0x416b25
push esi
push 0x401168
jmp 0x416b20
mov eax, dword [esi + 8]
or eax, dword [esi + 0xc]
je 0x416eb1
push dword [esi + 0xc]
push dword [esi + 8]
call dword [sym.imp.ADVAPI32.dll_UnregisterTraceGuids]
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov esi, dword [esi]
test esi, esi
jne 0x416e97
mov dword [0x42d05c], edi
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret