Function at 0x402d00
Capabilities:
Get common file path

Disassembly:
sub esp, 0x410
push ebx
push ebp
push edi
xor ebx, ebx
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x111]
mov byte [esp + 0x110], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x215]
mov byte [esp + 0x214], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0xd]
mov byte [esp + 0xc], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x319]
mov byte [esp + 0x318], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x110]
mov ebp, dword [esp + 0x420]
rep stosd dword es:[edi], eax
mov ecx, 0x41
lea edi, [esp + 0x214]
rep stosd dword es:[edi], eax
mov ecx, 0x41
lea edi, [esp + 0xc]
rep stosd dword es:[edi], eax
mov ecx, 0x41
lea edi, [esp + 0x318]
rep stosd dword es:[edi], eax
mov edi, ebp
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x403026
mov al, byte [ebp]
xor edx, edx
cmp al, 0x5c
push esi
je 0x402ded
lea esi, [esp + 0x10]
mov eax, ebp
sub esi, ebp
mov cl, byte [eax]
cmp cl, 0x41
jl 0x402dde
cmp cl, 0x5a
jg 0x402dde
add cl, 0x20
mov byte [eax], cl
mov cl, byte [eax]
inc edx
mov byte [esi + eax], cl
mov cl, byte [eax + 1]
inc eax
cmp cl, 0x5c
jne 0x402dcd
mov al, byte [edx + ebp]
add edx, ebp
cmp al, bl
je 0x402e08
lea ecx, [esp + 0x218]
mov byte [ecx], al
mov al, byte [edx + 1]
inc ecx
inc edx
cmp al, bl
jne 0x402dfd
mov esi, str.system32
lea eax, [esp + 0x10]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x402e35
cmp cl, bl
je 0x402e31
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x402e35
add eax, 2
add esi, 2
cmp cl, bl
jne 0x402e11
xor eax, eax
jmp 0x402e3a
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x402e78
lea eax, [esp + 0x114]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [esp + 0x218]
lea edx, [esp + 0x114]
push ecx
push edx
push str._s_s
push 0x415638
call fcn.004080d0
add esp, 0x10
jmp 0x402ffd
mov esi, str.windows
lea eax, [esp + 0x10]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x402ea5
cmp cl, bl
je 0x402ea1
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x402ea5
add eax, 2
add esi, 2
cmp cl, bl
jne 0x402e81
xor eax, eax
jmp 0x402eaa
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x402ec3
lea eax, [esp + 0x114]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
jmp 0x402e51
mov esi, str.program
lea eax, [esp + 0x10]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x402ef0
cmp cl, bl
je 0x402eec
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x402ef0
add eax, 2
add esi, 2
cmp cl, bl
jne 0x402ecc
xor eax, eax
jmp 0x402ef5
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x402f5a
lea eax, [esp + 0x114]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov cl, byte [esp + 0x114]
cmp cl, 0x3a
je 0x402f2e
xor eax, eax
mov byte [esp + eax + 0x31c], cl
mov cl, byte [esp + eax + 0x115]
inc eax
cmp cl, 0x3a
jne 0x402f1a
lea ecx, [esp + 0x218]
lea edx, [esp + 0x31c]
push ecx
push str.:Program_Files
push edx
push str._s_s_s
push 0x415638
call fcn.004080d0
add esp, 0x14
jmp 0x402ffd
mov esi, 0x4122c8
lea eax, [esp + 0x10]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x402f87
cmp cl, bl
je 0x402f83
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x402f87
add eax, 2
add esi, 2
cmp cl, bl
jne 0x402f63
xor eax, eax
jmp 0x402f8c
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x402fea
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x10]
push 0x104
rep stosd dword es:[edi], eax
lea eax, [esp + 0x14]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 0x10]
push 0x5c
push ecx
call fcn.00408130
add esp, 8
cmp eax, ebx
je 0x402fc3
mov byte [eax], bl
lea edx, [esp + 0x10]
push 0x5c
push edx
call fcn.00408130
add esp, 8
cmp eax, ebx
je 0x402fd8
mov byte [eax], bl
lea eax, [esp + 0x218]
lea ecx, [esp + 0x10]
push eax
push ecx
jmp 0x402e61
push ebp
push 0x41220c
push 0x415638
call fcn.004080d0
add esp, 0xc
push ebx
push 0x415638
call fcn.00408287
add esp, 8
cmp eax, 0xffffffff
pop esi
jne 0x403058
push 0x415638
call dword [sym.imp.IMAGEHLP.dll_MakeSureDirectoryPathExists]
pop edi
pop ebp
pop ebx
add esp, 0x410
ret
lea edx, [esp + 0x110]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea eax, [esp + 0x110]
push 0x4122c4
push eax
push str._s_s
push 0x415638
call fcn.004080d0
add esp, 0x10
pop edi
pop ebp
pop ebx
add esp, 0x410
ret