Function at 0x413c90
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98
mov dword [ebp - 0x94], 0x11098
mov dword [ebp - 8], 0xadf5
mov dword [ebp - 0x50], 0x317a
mov dword [ebp - 0x80], 0x2e0f
mov dword [ebp - 4], 0xa45e
mov dword [ebp - 0x5c], 0xf980
mov dword [ebp - 0x3c], 0x15d6
mov dword [ebp - 0x14], 0x11bd
mov dword [ebp - 0x40], 0x15949
mov dword [ebp - 0x24], 0x16c5c
mov dword [ebp - 0x88], 0xc58a
mov dword [ebp - 0x74], 0x762d
mov dword [ebp - 0x84], 0xfe33
mov dword [ebp - 0x7c], 0x3da1
mov dword [ebp - 0x44], 0x7dc9
mov dword [ebp - 0xc], 0x63af
mov dword [ebp - 0x78], 0xc1a0
mov dword [ebp - 0x10], 0x55db
mov dword [ebp - 0x38], 0xd5b8
mov dword [ebp - 0x28], 0x56bf
mov dword [ebp - 0x54], 0x11da4
mov dword [ebp - 0x2c], 0x11976
mov dword [ebp - 0x70], 0x17374
mov dword [ebp - 0x58], 0x157b
mov dword [ebp - 0x98], 0xc664
mov eax, dword [ebp - 0x40]
cmp eax, dword [ebp + 0xc]
jge 0x413d65
mov dword [ebp - 0x30], 1
jmp 0x413d6c
mov dword [ebp - 0x30], 0
mov ecx, dword [ebp - 0x78]
cmp ecx, dword [ebp + 0x20]
jge 0x413d7d
mov dword [ebp - 0x34], 1
jmp 0x413d84
mov dword [ebp - 0x34], 0
mov edx, dword [ebp - 0x38]
and edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x30]
and eax, dword [ebp - 0x34]
or edx, eax
je 0x413dc5
mov ecx, dword [ebp - 0x7c]
cmp ecx, dword [ebp - 0x24]
jne 0x413dc5
mov edx, dword [ebp - 0xc]
cmp edx, dword [ebp - 0x14]
jne 0x413dc5
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
push 0x7b76
push 0x185
push 0x4d45
call dword [sym.imp.KERNEL32.dll_FindNextFileNameW]
add esp, 0xc
mov dword [ebp - 0x18], 0
jmp 0x413dd7
mov ecx, dword [ebp - 0x18]
add ecx, 1
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x38]
sub edx, 0xd5b7
cmp dword [ebp - 0x18], edx
jge 0x413df0
mov eax, dword [ebp + 0x1c]
sub eax, 1
mov dword [ebp + 0x1c], eax
jmp 0x413dce
mov ecx, dword [ebp - 0x5c]
imul ecx, dword [ebp - 0x80]
test ecx, ecx
je 0x413e04
mov edx, dword [ebp - 8]
sub edx, 1
mov dword [ebp - 8], edx
mov dword [ebp - 0x1c], 0
jmp 0x413e16
mov eax, dword [ebp - 0x1c]
add eax, 1
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x70]
sub ecx, 0x17373
cmp dword [ebp - 0x1c], ecx
jge 0x413eaf
mov edx, dword [ebp - 0x44]
cmp edx, dword [ebp - 0x84]
jge 0x413eaa
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x74]
jne 0x413eaa
mov ecx, dword [ebp - 0x3c]
cmp ecx, dword [ebp - 8]
jne 0x413eaa
mov edx, dword [ebp + 0xc]
cmp edx, dword [ebp - 0x50]
jne 0x413eaa
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x10]
jne 0x413eaa
mov ecx, dword [ebp - 0x14]
cmp ecx, dword [ebp - 4]
jne 0x413eaa
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
mov edx, dword [ebp - 0x58]
cmp edx, dword [ebp - 0x54]
jge 0x413e8d
mov eax, dword [ebp + 0x20]
cmp eax, dword [ebp - 0x40]
jne 0x413e8d
mov ecx, dword [ebp - 0x2c]
cmp ecx, dword [ebp - 0x10]
jne 0x413e8d
mov edx, dword [ebp - 0x88]
cmp edx, dword [ebp - 0x28]
jne 0x413e8d
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [ebp - 0x10], eax
push 0x3aa2
push 0x16e88
push 0x9d56
push 0xaed6
call dword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryW]
add esp, 0x10
jmp 0x413e0d
mov dword [ebp - 0x20], 0
jmp 0x413ec1
mov ecx, dword [ebp - 0x20]
add ecx, 1
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x44]
sub edx, 0x7dc8
cmp dword [ebp - 0x20], edx
jge 0x41402e
mov eax, dword [ebp + 8]
cmp eax, dword [ebp - 0x24]
jge 0x413ee4
mov dword [ebp - 0x48], 1
jmp 0x413eeb
mov dword [ebp - 0x48], 0
mov ecx, dword [ebp - 0x28]
add ecx, dword [ebp + 0x14]
cmp ecx, dword [ebp + 0xc]
jge 0x413eff
mov dword [ebp - 0x4c], 1
jmp 0x413f06
mov dword [ebp - 0x4c], 0
mov edx, dword [ebp - 0x48]
and edx, dword [ebp - 0x4c]
je 0x414029
mov eax, dword [ebp - 0x50]
cmp eax, dword [ebp - 4]
jne 0x414029
mov ecx, dword [ebp - 0x54]
cmp ecx, dword [ebp + 0x20]
jne 0x414029
mov edx, dword [ebp + 0xc]
cmp edx, dword [ebp - 0x58]
jge 0x413f3b
mov dword [ebp - 0x60], 1
jmp 0x413f42
mov dword [ebp - 0x60], 0
mov eax, dword [ebp - 0x5c]
cmp eax, dword [ebp - 0xc]
jge 0x413f53
mov dword [ebp - 0x64], 1
jmp 0x413f5a
mov dword [ebp - 0x64], 0
mov ecx, dword [ebp - 0x60]
and ecx, dword [ebp - 0x64]
je 0x414029
mov edx, dword [ebp - 0xc]
cmp edx, dword [ebp - 0x28]
jge 0x413f77
mov dword [ebp - 0x68], 1
jmp 0x413f7e
mov dword [ebp - 0x68], 0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x8c], eax
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x90], ecx
mov edx, dword [ebp - 4]
sub edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x8c]
cmp eax, dword [ebp - 0x90]
jge 0x413fb0
mov dword [ebp - 0x6c], 1
jmp 0x413fb7
mov dword [ebp - 0x6c], 0
mov ecx, dword [ebp - 0x68]
and ecx, dword [ebp - 0x6c]
je 0x414029
push 0x6622
push 0x626
push 0x11973
call dword [sym.imp.KERNEL32.dll_WaitForThreadpoolWorkCallbacks]
add esp, 0xc
mov edx, dword [ebp - 0x14]
cmp edx, dword [ebp - 0xc]
jge 0x414029
mov eax, dword [ebp - 0x70]
cmp eax, dword [ebp - 0x74]
jne 0x414029
mov ecx, dword [ebp + 0x1c]
cmp ecx, dword [ebp - 4]
jne 0x414029
mov edx, dword [ebp - 0x2c]
add edx, 1
mov dword [ebp - 0x2c], edx
push 0x4eea
push 0x9a84
push 0xa277
push 0xbdd1
push 0x158ba
push 0xa594
push 0x16d41
push 0x63a1
call dword [sym.imp.KERNEL32.dll_FindNextVolumeA]
add esp, 0x20
jmp 0x413eb8
mov esp, ebp
pop ebp
ret