Function at 0x4175de
Capabilities:
Get common file path

Disassembly:
push 0x40
mov eax, 0x429088
call fcn.00423ccf
mov ebx, ecx
cmp dword [ebx + 0x14], 0
jne 0x4175f9
mov dword [ebx + 0x14], 1
mov esi, 0x4090d8
lea edi, [ebp - 0x34]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 6
xor eax, eax
pop ecx
lea edi, [ebp - 0x2e]
rep stosd dword es:[edi], eax
mov eax, dword [section..data]
mov ecx, section..data
xor edi, edi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x3c], eax
and dword [ebp - 4], edi
mov esi, dword [sym.imp.msvcrt.dll__wcsicmp]
push 0x405f4c
push dword [ebx + 0x190]
call esi
neg eax
sbb al, al
inc al
push 0x4090e0
push dword [ebx + 0x190]
mov dword [ebp - 0x44], eax
call esi
mov cl, byte [ebx + 0x1a4]
add esp, 0x10
neg eax
sbb al, al
inc al
test cl, cl
jne 0x417682
cmp dword [ebx + 0x190], 0
jne 0x417682
push 0x409120
mov esi, 0x80070057
push esi
call fcn.0040f43e
pop ecx
pop ecx
jmp 0x417aaf
mov byte [ebp - 0x35], 0
test cl, cl
je 0x417775
mov esi, 0x105
xor ecx, ecx
push 2
pop edx
mov eax, esi
mul edx
seto cl
mov byte [ebp - 4], 1
neg ecx
or ecx, eax
push ecx
call fcn.00422883
and dword [ebp - 4], 0
mov edi, eax
mov eax, dword [ebx + 0x194]
pop ecx
test eax, eax
jne 0x417701
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
jne 0x4176d5
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x417ad3
add eax, 0x20
cmp eax, esi
jb 0x4176e8
lea esi, [eax + 1]
push edi
call fcn.00422898
pop ecx
jmp 0x417693
push 0x409160
push edi
mov eax, esi
call fcn.00415753
test eax, eax
jns 0x417718
movzx esi, ax
jmp 0x417ad5
push 0
push edi
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
test eax, eax
je 0x4176ca
cmp eax, esi
jbe 0x417718
mov esi, eax
jmp 0x4176df
push 0x5e0
mov byte [ebp - 4], 3
call fcn.004227f4
mov esi, eax
pop ecx
mov dword [ebp - 0x40], esi
mov byte [ebp - 4], 4
test esi, esi
je 0x417752
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push ebx
push edi
mov eax, 0x405f4c
push eax
mov ecx, esi
call dword [sym.imp.perfctrl.dll_public:_void___thiscall_KernelLoggingSession::constructor_unsigned_short_int_const___unsigned_short_int_const___struct_SESSION_PROPERTIES_const___bool__unsigned_long_long_unsigned___int64__]
mov dword [esi], 0x40c900
jmp 0x417754
xor esi, esi
mov dword [ebx + 0x1a0], esi
jmp 0x4179de
cmp byte [ebp - 0x44], 0
jne 0x4178b6
test al, al
jne 0x4178b6
cmp byte [ebx + 0x1a8], al
je 0x4177ee
push 0x5c0
mov byte [ebp - 4], 9
call fcn.004227f4
mov esi, eax
pop ecx
mov dword [ebp - 0x40], esi
mov byte [ebp - 4], 0xa
test esi, esi
je 0x4177ca
push 0xffffffffffffffff
push 0xffffffffffffffff
xor eax, eax
push eax
push eax
push eax
push dword [ebx + 0x190]
mov ecx, esi
call dword [sym.imp.perfctrl.dll_public:_void___thiscall_LoggingSession::constructor_unsigned_short_int_const___unsigned_short_int_const___struct_SESSION_PROPERTIES_const___bool__unsigned_long_long_unsigned___int64__]
mov dword [esi], 0x40c970
jmp 0x4177cc
xor esi, esi
and dword [ebp - 4], 0
push dword [ebx + 0x198]
mov dword [ebx + 0x1a0], esi
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x4c]
jmp 0x417ad3
push dword [ebx + 0x190]
call fcn.0041c71e
test al, al
jne 0x4178a1
push dword [ebx + 0x198]
call fcn.0041c71e
test al, al
jne 0x4178a1
mov eax, dword [ebx + 0x194]
mov dword [ebp - 0x44], eax
test eax, eax
jne 0x417858
cmp byte [ebx + 0x1a6], al
jne 0x417858
test byte [ebx + 0x14], 0xf
je 0x417852
mov ax, word [ebp + 8]
mov word [ebp - 0x34], ax
push 0x4091b8
lea eax, [ebp - 0x34]
push eax
push 0xf
pop eax
call fcn.00415753
mov esi, eax
test esi, esi
js 0x417aaf
lea eax, [ebp - 0x34]
mov dword [ebp - 0x44], eax
push 0x5c0
mov byte [ebp - 4], 0xc
call fcn.004227f4
mov esi, eax
pop ecx
mov dword [ebp - 0x40], esi
mov byte [ebp - 4], 0xd
test esi, esi
je 0x417752
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push ebx
push dword [ebp - 0x44]
mov ecx, esi
push dword [ebx + 0x190]
call dword [sym.imp.perfctrl.dll_public:_void___thiscall_LoggingSession::constructor_unsigned_short_int_const___unsigned_short_int_const___struct_SESSION_PROPERTIES_const___bool__unsigned_long_long_unsigned___int64__]
mov dword [esi], 0x40c970
jmp 0x417754
cmp byte [ebx + 0x1a7], 0
jne 0x4178ce
cmp byte [ebx + 0x1a6], 0
push ebx
je 0x417901
jmp 0x4178f0
push dword [ebx + 0x198]
call fcn.0041c71e
test al, al
je 0x417908
cmp byte [ebx + 0x1a7], 0
je 0x4178e6
mov edi, dword [ebx + 0x194]
mov ebx, dword [ebx + 0x190]
call fcn.004196d8
mov esi, eax
jmp 0x417aaf
cmp byte [ebx + 0x1a6], 0
je 0x4178f7
push ebx
call fcn.00419578
jmp 0x4178df
cmp byte [ebx + 0x1b2], 0
jne 0x417908
push ebx
call fcn.004194fe
jmp 0x4178df
mov eax, dword [ebx + 0x194]
mov dword [ebp - 0x40], eax
test eax, eax
jne 0x417960
cmp byte [ebx + 0x1a6], al
jne 0x417960
cmp byte [ebx + 0x1b2], al
jne 0x417960
test byte [ebx + 0x14], 0xf
je 0x41795a
cmp byte [ebp - 0x44], 0
mov ax, word [ebp + 8]
mov word [ebp - 0x34], ax
mov eax, 0x405f34
jne 0x417943
mov eax, 0x4091a4
push eax
lea eax, [ebp - 0x34]
push eax
push 0xf
pop eax
call fcn.00415753
mov esi, eax
test esi, esi
js 0x417aaf
lea eax, [ebp - 0x34]
mov dword [ebp - 0x40], eax
push 0x5e0
mov byte [ebp - 4], 6
call fcn.004227f4
mov esi, eax
pop ecx
mov dword [ebp - 0x4c], esi
mov byte [ebp - 4], 7
test esi, esi
je 0x4179a7
cmp byte [ebp - 0x44], 0
mov eax, 0x405f4c
jne 0x41798c
mov eax, 0x4090e0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push ebx
push dword [ebp - 0x40]
mov ecx, esi
push eax
call dword [sym.imp.perfctrl.dll_public:_void___thiscall_KernelLoggingSession::constructor_unsigned_short_int_const___unsigned_short_int_const___struct_SESSION_PROPERTIES_const___bool__unsigned_long_long_unsigned___int64__]
mov dword [esi], 0x40c900
jmp 0x4179a9
xor esi, esi
and dword [ebp - 4], 0
cmp byte [ebx + 0x1b2], 0
mov dword [ebx + 0x1a0], esi
jne 0x417abe
mov ecx, dword [ebx + 0x19c]
mov byte [ebp - 0x35], 1
test ecx, ecx
je 0x4179de
mov eax, dword [esi]
push ecx
mov ecx, esi
call dword [eax + 0x54]
test eax, eax
js 0x4176f9
and dword [ebp - 4], 0
lea eax, [ebp - 0x3c]
mov byte [ebp - 4], 0xf
mov ecx, dword [ebx + 0x198]
push eax
call fcn.00412df1
cmp byte [ebp - 0x35], 0
je 0x417a20
mov eax, dword [ebp - 0x3c]
cmp dword [eax - 0xc], 0
je 0x417a12
lea eax, [ebp - 0x3c]
push eax
mov edx, 0x4091cc
call fcn.00412e2d
lea eax, [ebp - 0x3c]
push eax
mov edx, 0x4091d0
call fcn.00412e2d
and dword [ebp - 4], 0
cmp byte [ebx + 0x1a7], 0
jne 0x417a49
mov ecx, dword [ebx + 0x1a0]
push dword [ebp - 0x3c]
mov eax, dword [ecx]
call dword [eax + 0x30]
test eax, eax
jne 0x417a49
mov esi, 0x3ec
jmp 0x417ad9
cmp byte [ebx + 0x1a4], 0
mov ecx, dword [ebx + 0x1a0]
je 0x417a60
call dword [sym.imp.perfctrl.dll_public:_unsigned_long_int___thiscall_KernelLoggingSession::EnableBootTracing_void_const]
jmp 0x417ad3
cmp byte [ebx + 0x1a7], 0
mov eax, dword [ecx]
je 0x417a8b
call dword [eax + 0x28]
mov esi, eax
test esi, esi
jne 0x417ad9
mov eax, dword [ebx + 0x1a0]
add eax, 8
push eax
push 0x408348
call dword [sym.imp.msvcrt.dll_printf]
jmp 0x417ae5
cmp byte [ebx + 0x1a6], 0
je 0x417a99
call dword [eax + 0x24]
jmp 0x417ad3
call dword [eax + 0x20]
jmp 0x417ad3
mov edx, dword [ebp - 0x3c]
lea edx, [edx - 0x10]
call fcn.00410ac9
mov eax, esi
jmp 0x417b16
movzx eax, byte [ebx + 0x1b3]
mov edx, dword [esi]
push eax
push dword [ebx + 0x198]
mov ecx, esi
call dword [edx + 0x58]
mov esi, eax
test esi, esi
je 0x417ae7
push dword [ebx + 0x190]
push esi
call fcn.0040f43e
pop ecx
pop ecx
push edi
call fcn.00422898
pop ecx
test esi, esi
jle 0x417aaf
and esi, 0xffff
or esi, 0x80070000
jmp 0x417aaf
call fcn.00423d3a
ret 4