Function at 0x4107c0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x599367
mov eax, dword fs:[0]
push eax
sub esp, 0x4e0
mov eax, dword [0x6102d4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov byte [ecx + 5], 1
mov eax, dword [0x61b9b8]
test eax, eax
jne 0x410832
push 0x11c
call fcn.0045ec32
add esp, 4
mov dword [ebp - 0x4e8], eax
mov dword [ebp - 4], 0
test eax, eax
je 0x410824
mov ecx, eax
call fcn.00442a30
jmp 0x410826
xor eax, eax
mov dword [ebp - 4], 0xffffffff
mov dword [0x61b9b8], eax
mov ecx, eax
call fcn.00413410
mov edx, eax
mov dword [ebp - 0x450], 0
mov ecx, edx
mov dword [ebp - 0x44c], 7
xor eax, eax
mov word [ebp - 0x460], ax
lea edi, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x410860
sub ecx, edi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x460]
call fcn.00411630
mov eax, dword [0x61b9b8]
xorps xmm0, xmm0
mov dword [ebp - 4], 1
movq qword [ebp - 0x18], xmm0
movups xmmword [ebp - 0x38], xmm0
movups xmmword [ebp - 0x28], xmm0
test eax, eax
jne 0x4108cb
push 0x11c
call fcn.0045ec32
add esp, 4
mov dword [ebp - 0x4e8], eax
mov byte [ebp - 4], 2
test eax, eax
je 0x4108c0
mov ecx, eax
call fcn.00442a30
jmp 0x4108c2
xor eax, eax
mov byte [ebp - 4], 1
mov dword [0x61b9b8], eax
lea ecx, [ebp - 0x38]
push ecx
push str.4bc9c
mov ecx, eax
call fcn.00413300
lea ecx, [ebp - 0x38]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4108e1
sub ecx, edx
sar ecx, 1
jne 0x410907
lea eax, [ebp - 0x38]
push eax
push str.4bc9c
call fcn.00410740
mov ecx, eax
call fcn.00412a30
lea eax, [ebp - 0x38]
push eax
call fcn.00573cbe
add esp, 4
cmp eax, 1
jl 0x410924
mov byte [ebp - 0x4d9], 0
jmp 0x411047
cmp dword [ebp - 0x44c], 8
lea eax, [ebp - 0x460]
cmovae eax, dword [ebp - 0x460]
push eax
call sym.Utility.exe_SHStartSelfProtectService
cmp dword [ebp - 0x44c], 8
lea eax, [ebp - 0x460]
push 1
cmovae eax, dword [ebp - 0x460]
push eax
call sym.Utility.exe_AddProtectFile
push str.cef_
lea eax, [ebp - 0x460]
push eax
lea eax, [ebp - 0x4c0]
push eax
call fcn.0040eca0
cmp dword [ebp - 0x4ac], 8
lea eax, [ebp - 0x4c0]
push 1
cmovae eax, dword [ebp - 0x4c0]
push eax
mov byte [ebp - 4], 3
call sym.Utility.exe_AddProtectFile
cmp dword [ebp - 0x44c], 8
lea eax, [ebp - 0x460]
cmovae eax, dword [ebp - 0x460]
push eax
push str._strConvertPath____s
call fcn.0040de30
push str.locales
lea eax, [ebp - 0x4c0]
push eax
lea eax, [ebp - 0x4d8]
push eax
call fcn.0040eca0
cmp dword [ebp - 0x4c4], 8
lea eax, [ebp - 0x4d8]
push 1
cmovae eax, dword [ebp - 0x4d8]
push eax
mov byte [ebp - 4], 4
call sym.Utility.exe_AddProtectFile
cmp dword [ebp - 0x44c], 8
lea eax, [ebp - 0x460]
cmovae eax, dword [ebp - 0x460]
push eax
push str._strInstallPath____s
call fcn.0040de30
add esp, 0x44
lea eax, [ebp - 0x448]
push 0x208
push 0
push eax
call fcn.0056f980
add esp, 0xc
lea eax, [ebp - 0x448]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x5a1b9c
lea eax, [ebp - 0x448]
push eax
push str._sdriversZHGameHallDrv._s
call fcn.0044c6d4
mov edx, eax
mov dword [ebp - 0x498], 0
mov ecx, edx
mov dword [ebp - 0x494], 7
add esp, 0xc
xor eax, eax
mov word [ebp - 0x4a8], ax
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x410a70
sub ecx, edi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x4a8]
call fcn.00411630
cmp dword [ebp - 0x494], 8
lea eax, [ebp - 0x4a8]
push 0
cmovae eax, dword [ebp - 0x4a8]
push eax
mov byte [ebp - 4], 5
call sym.Utility.exe_AddProtectFile
cmp dword [ebp - 0x44c], 8
lea eax, [ebp - 0x460]
push 1
cmovae eax, dword [ebp - 0x460]
push eax
call sym.Utility.exe_AddTrustProcess
cmp dword [ebp - 0x44c], 8
lea edx, [ebp - 0x460]
cmovae edx, dword [ebp - 0x460]
xor ecx, ecx
test eax, eax
setne cl
push ecx
push edx
push str.DRIVER::AddTrustProcess__s
call fcn.0040de30
push 0x208
lea eax, [ebp - 0x240]
push 0
push eax
call fcn.0056f980
add esp, 0x28
lea eax, [ebp - 0x240]
push 0
push 0x2b
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea edi, [ebp - 0x240]
add edi, 0xfffffffe
mov ax, word [edi + 2]
lea edi, [edi + 2]
test ax, ax
jne 0x410b21
mov eax, dword [0x5a1724]
lea edx, [ebp - 0x240]
mov dword [edi], eax
add edx, 0xfffffffe
nop dword [eax]
mov cx, word [edx + 2]
lea edx, [edx + 2]
test cx, cx
jne 0x410b40
mov ecx, dword [0x5a1790]
lea edi, [ebp - 0x240]
mov dword [edx], ecx
add edi, 0xfffffffe
mov ecx, dword [0x5a1794]
mov dword [edx + 4], ecx
mov ecx, dword [0x5a1798]
mov dword [edx + 8], ecx
mov ecx, dword [0x5a179c]
mov dword [edx + 0xc], ecx
mov ecx, dword [0x5a17a0]
mov dword [edx + 0x10], ecx
mov cx, word [edi + 2]
lea edi, [edi + 2]
test cx, cx
jne 0x410b81
lea ecx, [ebp - 0x240]
mov dword [edi], eax
add ecx, 0xfffffffe
nop dword [eax + eax]
mov ax, word [ecx + 2]
lea ecx, [ecx + 2]
test ax, ax
jne 0x410ba0
mov eax, dword [0x5a1790]
mov dword [ecx], eax
mov eax, dword [0x5a1794]
mov dword [ecx + 4], eax
mov eax, dword [0x5a1798]
mov dword [ecx + 8], eax
mov eax, dword [0x5a179c]
mov dword [ecx + 0xc], eax
mov eax, dword [0x5a17a0]
mov dword [ecx + 0x10], eax
lea ecx, [ebp - 0x240]
add ecx, 0xfffffffe
nop dword [eax]
mov ax, word [ecx + 2]
lea ecx, [ecx + 2]
test ax, ax
jne 0x410be0
mov eax, dword [str..ini]
mov dword [ecx], eax
mov eax, dword [0x5a17a8]
mov dword [ecx + 4], eax
mov ax, word [0x5a17ac]
mov word [ecx + 8], ax
lea eax, [ebp - 0x240]
push 0
push eax
call sym.Utility.exe_AddProtectFile
add esp, 8
mov dword [ebp - 0x4e4], 0
lea ecx, [ebp - 0x4e4]
mov dword [ebp - 0x4e0], 0
call fcn.004110d0
mov dword [ebp - 0x4e4], eax
lea eax, [ebp - 0x4ec]
mov byte [ebp - 4], 6
push eax
lea ecx, [ebp - 0x4e4]
mov dword [ebp - 0x4ec], str.RegistryMachineSYSTEMControlSet001ServicesZHGameHall
mov byte [ebp - 0x4e8], 1
call fcn.0040ed60
push eax
add eax, 0x10
lea ecx, [ebp - 0x4e4]
push eax
push 0
lea eax, [ebp - 0x4ec]
push eax
call fcn.0040f270
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x410c85
mov eax, dword [esi]
push eax
push str.REGISTRYMACHINESYSTEMControlSet001Services_s
call fcn.0044c6d4
mov edx, eax
mov dword [ebp - 0x480], 0
mov ecx, edx
mov dword [ebp - 0x47c], 7
add esp, 8
xor eax, eax
mov word [ebp - 0x490], ax
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x410cb7
sub ecx, edi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x490]
call fcn.00411630
cmp dword [ebp - 0x47c], 8
lea eax, [ebp - 0x490]
lea ecx, [ebp - 0x4e4]
mov byte [ebp - 4], 7
cmovae eax, dword [ebp - 0x490]
mov dword [ebp - 0x4ec], eax
lea eax, [ebp - 0x4ec]
push eax
mov byte [ebp - 0x4e8], 1
call fcn.0040ed60
push eax
add eax, 0x10
lea ecx, [ebp - 0x4e4]
push eax
push 0
lea eax, [ebp - 0x4ec]
push eax
call fcn.0040f270
cmp dword [esi + 0x14], 8
jb 0x410d2b
mov esi, dword [esi]
push esi
push str.REGISTRYMACHINESYSTEMCurrentControlSetServices_s
call fcn.0044c6d4
mov edx, eax
mov dword [ebp - 0x468], 0
mov ecx, edx
mov dword [ebp - 0x464], 7
add esp, 8
xor eax, eax
mov word [ebp - 0x478], ax
lea esi, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x410d60
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x478]
call fcn.00411630
cmp dword [ebp - 0x464], 8
lea eax, [ebp - 0x478]
lea ecx, [ebp - 0x4e4]
mov byte [ebp - 4], 8
cmovae eax, dword [ebp - 0x478]
mov dword [ebp - 0x4ec], eax
lea eax, [ebp - 0x4ec]
push eax
mov byte [ebp - 0x4e8], 1
call fcn.0040ed60
push eax
add eax, 0x10
lea ecx, [ebp - 0x4e4]
push eax
push 0
lea eax, [ebp - 0x4ec]
push eax
call fcn.0040f270
mov esi, dword [ebp - 0x4e4]
mov eax, dword [esi]
mov dword [ebp - 0x4e8], eax
cmp eax, esi
je 0x410e15
nop
cmp dword [eax + 0x24], 8
lea ecx, [eax + 0x10]
jb 0x410dec
mov ecx, dword [eax + 0x10]
movzx eax, byte [eax + 0x28]
push eax
push ecx
call sym.Utility.exe_AddProtectReg
add esp, 8
lea ecx, [ebp - 0x4e8]
call fcn.0040fa40
mov eax, dword [ebp - 0x4e8]
mov esi, dword [ebp - 0x4e4]
cmp eax, esi
jne 0x410de0
mov edx, dword [ebp - 0x464]
mov byte [ebp - 0x4d9], 1
mov byte [ebp - 4], 7
cmp edx, 8
jb 0x410e66
mov ecx, dword [ebp - 0x478]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x410e56
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4110a6
push edx
push ecx
call fcn.0045ec62
mov esi, dword [ebp - 0x4e4]
add esp, 8
mov edx, dword [ebp - 0x47c]
xor eax, eax
mov dword [ebp - 0x468], 0
mov dword [ebp - 0x464], 7
mov word [ebp - 0x478], ax
mov byte [ebp - 4], 6
cmp edx, 8
jb 0x410ecd
mov ecx, dword [ebp - 0x490]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x410ebd
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4110ab
push edx
push ecx
call fcn.0045ec62
mov esi, dword [ebp - 0x4e4]
add esp, 8
xor eax, eax
mov dword [ebp - 0x480], 0
mov dword [ebp - 0x47c], 7
mov word [ebp - 0x490], ax
push dword [esi + 4]
lea ecx, [ebp - 0x4e4]
mov byte [ebp - 4], 9
call fcn.004111f0
mov eax, dword [ebp - 0x4e4]
push 0x2c
mov dword [eax + 4], esi
mov eax, dword [ebp - 0x4e4]
mov dword [eax], esi
mov eax, dword [ebp - 0x4e4]
mov dword [eax + 8], esi
push dword [ebp - 0x4e4]
mov dword [ebp - 0x4e0], 0
call fcn.0045ec62
mov edx, dword [ebp - 0x494]
add esp, 8
cmp edx, 8
jb 0x410f70
mov ecx, dword [ebp - 0x4a8]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x410f66
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4110b0
push edx
push ecx
call fcn.0045ec62
add esp, 8
mov edx, dword [ebp - 0x4c4]
xor eax, eax
mov dword [ebp - 0x498], 0
mov dword [ebp - 0x494], 7
mov word [ebp - 0x4a8], ax
cmp edx, 8
jb 0x410fcd
mov ecx, dword [ebp - 0x4d8]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x410fc3
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4110b5
push edx
push ecx
call fcn.0045ec62
add esp, 8
mov edx, dword [ebp - 0x4ac]
xor eax, eax
mov dword [ebp - 0x4c8], 0
mov dword [ebp - 0x4c4], 7
mov word [ebp - 0x4d8], ax
cmp edx, 8
jb 0x41102a
mov ecx, dword [ebp - 0x4c0]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x411020
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4110ba
push edx
push ecx
call fcn.0045ec62
add esp, 8
xor eax, eax
mov dword [ebp - 0x4b0], 0
mov dword [ebp - 0x4ac], 7
mov word [ebp - 0x4c0], ax
mov edx, dword [ebp - 0x44c]
cmp edx, 8
jb 0x411083
mov ecx, dword [ebp - 0x460]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x411079
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4110bf
push edx
push ecx
call fcn.0045ec62
add esp, 8
mov al, byte [ebp - 0x4d9]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045ef18
mov esp, ebp
pop ebp
ret 4
call fcn.00572b79
call fcn.00572b79
call fcn.00572b79
call fcn.00572b79
call fcn.00572b79
call fcn.00572b79
int3