Function at 0x4aec10
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53e706
mov eax, dword fs:[0]
push eax
sub esp, 0x504
mov eax, dword [0x58cfe0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [ebp + 8]
mov ecx, eax
push 0xffffffffffffffff
push 0
mov dword [ebp - 0x50c], eax
call fcn.004e8c08
mov ecx, edi
call fcn.004ae980
xorps xmm0, xmm0
mov dword [ebp - 0x508], eax
lea ecx, [ebp - 0x478]
mov dword [ebp - 0x468], 0
movups xmmword [ebp - 0x478], xmm0
call fcn.004f18f5
mov dword [ebp - 4], 0
xor esi, esi
mov eax, dword [edi + 0x570]
mov dword [ebp - 0x504], eax
test eax, eax
jle 0x4aed3f
nop dword [eax]
test esi, esi
js 0x4aeeb3
cmp esi, dword [edi + 0x570]
jge 0x4aeeb3
mov eax, dword [edi + 0x56c]
mov eax, dword [eax + esi*4]
cmp dword [eax - 0xc], 0
je 0x4aed32
mov ecx, dword [ebp - 0x508]
push eax
call fcn.00465ee0
mov dword [ebp - 0x500], eax
test eax, eax
je 0x4aed32
xorps xmm0, xmm0
mov dword [ebp - 0x47c], 0
lea ecx, [ebp - 0x48c]
movups xmmword [ebp - 0x48c], xmm0
call fcn.004f18f5
mov byte [ebp - 4], 1
lea eax, [ebp - 0x48c]
push eax
push dword [ebp - 0x500]
call fcn.00466090
add esp, 8
lea eax, [ebp - 0x48c]
lea ecx, [ebp - 0x478]
push eax
call fcn.004f1a87
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x48c]
call fcn.004f190c
inc esi
cmp esi, dword [ebp - 0x504]
jl 0x4aeca0
push 0x38
lea eax, [ebp - 0x4fc]
push 0
push eax
call fcn.00509680
add esp, 0xc
lea ecx, [ebp - 0x4fc]
call fcn.00467c80
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x4fc]
push str.SYSTEMCurrentControlSetControlPrintMonitors
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00468ed0
test eax, eax
je 0x4aee96
push 0x104
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov eax, dword [edi + 0x598]
xor esi, esi
mov dword [ebp - 0x500], eax
test eax, eax
jle 0x4aee8b
test esi, esi
js 0x4aeeb3
cmp esi, dword [edi + 0x598]
jge 0x4aeeb3
mov eax, dword [edi + 0x594]
lea eax, [eax + esi*4]
mov dword [ebp - 0x508], eax
mov eax, dword [eax]
cmp dword [eax - 0xc], 0
je 0x4aee7e
push 0x38
lea eax, [ebp - 0x4c4]
push 0
push eax
call fcn.00509680
add esp, 0xc
lea ecx, [ebp - 0x4c4]
call fcn.00467c80
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x4c4]
mov eax, dword [ebp - 0x508]
push dword [eax]
push dword [ebp - 0x4f0]
call fcn.00468ed0
test eax, eax
je 0x4aee6f
push str.Driver
lea ecx, [ebp - 0x4c4]
call fcn.00468b80
test eax, eax
je 0x4aee6f
cmp word [eax], 0
je 0x4aee6f
push 0x104
lea ecx, [ebp - 0x218]
push ecx
push eax
lea eax, [ebp - 0x420]
push eax
call fcn.0048f340
add esp, 0x10
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.USER32.dll_CharLowerW]
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x470]
lea ecx, [ebp - 0x478]
call fcn.004f1c56
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x4c4]
call fcn.00467ce0
inc esi
cmp esi, dword [ebp - 0x500]
jl 0x4aeda6
lea ecx, [ebp - 0x4fc]
call fcn.00467da0
push 1
mov ecx, edi
call fcn.004ae8c0
mov esi, eax
mov dword [ebp - 0x510], esi
test esi, esi
jne 0x4aeeb8
lea esi, [eax + 1]
jmp 0x4af1c6
call fcn.004e6c7b
xorps xmm0, xmm0
mov dword [ebp - 0x43c], 0
lea ecx, [ebp - 0x44c]
movups xmmword [ebp - 0x44c], xmm0
call fcn.004e8966
mov byte [ebp - 4], 4
xorps xmm0, xmm0
lea ecx, [ebp - 0x464]
mov dword [ebp - 0x454], 0
movups xmmword [ebp - 0x464], xmm0
call fcn.004f18f5
mov byte [ebp - 4], 5
lea eax, [ebp - 0x464]
push eax
lea eax, [ebp - 0x44c]
mov ecx, esi
push eax
lea eax, [ebp - 0x478]
push eax
call fcn.0041b0d0
mov eax, dword [ebp - 0x444]
mov dword [ebp - 0x508], eax
test eax, eax
jne 0x4aef32
lea esi, [eax + 1]
jmp 0x4af1a8
xorps xmm0, xmm0
mov dword [ebp - 0x504], 0
lea ecx, [ebp - 0x438]
mov dword [ebp - 0x428], 0
movups xmmword [ebp - 0x438], xmm0
call fcn.004e8966
mov byte [ebp - 4], 6
xor esi, esi
cmp dword [ebp - 0x508], esi
jle 0x4af02e
nop dword [eax]
test esi, esi
js 0x4aeeb3
cmp esi, dword [ebp - 0x45c]
jge 0x4aeeb3
mov eax, dword [ebp - 0x460]
lea edx, [eax + esi*4]
cmp esi, dword [ebp - 0x444]
jge 0x4aeeb3
mov eax, dword [ebp - 0x448]
mov ecx, dword [eax + esi*4]
mov eax, dword [edi]
mov dword [ebp - 0x500], ecx
lea ecx, [ebp - 0x450]
push ecx
lea ecx, [ebp - 0x424]
push ecx
mov ecx, dword [ebp - 0x500]
push ecx
push dword [edx]
mov ecx, edi
push dword [ebp - 0x510]
call dword [eax + 0x44]
mov ecx, dword [ebp - 0x504]
or ecx, dword [ebp - 0x450]
mov eax, dword [ebp - 0x424]
mov dword [ebp - 0x504], ecx
sub eax, 1
je 0x4af021
sub eax, 1
je 0x4af007
push dword [ebp - 0x500]
lea ecx, [ebp - 0x438]
push dword [ebp - 0x430]
call fcn.004e8bd5
jmp 0x4af021
push 0
push dword [ebp - 0x500]
call fcn.0047eea0
add esp, 8
mov dword [ebp - 0x504], 1
inc esi
cmp esi, dword [ebp - 0x508]
jl 0x4aef70
cmp dword [ebp - 0x430], 0
jne 0x4af17e
cmp dword [ebp - 0x504], 0
je 0x4af194
mov esi, dword [edi + 0x66c]
mov dword [ebp - 0x424], esi
test esi, esi
je 0x4af0b9
mov byte [ebp - 4], 0xc
lea ecx, [esi + 0x78]
call fcn.004e897d
mov byte [ebp - 4], 0xb
lea ecx, [esi + 0x64]
call fcn.004e897d
mov byte [ebp - 4], 0xa
lea ecx, [esi + 0x50]
call fcn.004f190c
mov byte [ebp - 4], 9
lea ecx, [esi + 0x3c]
call fcn.004e897d
mov byte [ebp - 4], 8
lea ecx, [esi + 0x28]
call fcn.004e897d
mov byte [ebp - 4], 7
lea ecx, [esi + 0x14]
call fcn.004f190c
mov byte [ebp - 4], 6
mov ecx, esi
call fcn.004e897d
push 0x8c
push esi
call fcn.00507268
add esp, 8
push 1
mov ecx, edi
mov dword [edi + 0x66c], 0
call fcn.004ae8c0
test eax, eax
je 0x4af194
lea ecx, [ebp - 0x464]
push ecx
lea ecx, [ebp - 0x44c]
push ecx
lea ecx, [ebp - 0x478]
push ecx
mov ecx, eax
call fcn.0041b0d0
mov edi, dword [ebp - 0x444]
lea ecx, [ebp - 0x438]
push 0xffffffffffffffff
push 0
mov dword [ebp - 0x424], edi
call fcn.004e8c08
xor esi, esi
test edi, edi
jle 0x4af175
test esi, esi
js 0x4aeeb3
cmp esi, dword [ebp - 0x45c]
jge 0x4aeeb3
mov eax, dword [ebp - 0x460]
lea ecx, [eax + esi*4]
cmp esi, dword [ebp - 0x444]
jge 0x4aeeb3
mov eax, dword [ebp - 0x448]
push 0
push 0xffffffffffffffff
push str.spoolsv.exe
push dword [ecx]
mov edi, dword [eax + esi*4]
call fcn.0049c330
add esp, 0x10
test eax, eax
jne 0x4af16c
push edi
push dword [ebp - 0x430]
lea ecx, [ebp - 0x438]
call fcn.004e8bd5
inc esi
cmp esi, dword [ebp - 0x424]
jl 0x4af111
cmp dword [ebp - 0x430], 0
je 0x4af194
mov ecx, dword [ebp - 0x50c]
lea eax, [ebp - 0x438]
push eax
call fcn.004e89bd
xor esi, esi
jmp 0x4af199
mov esi, 1
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x438]
call fcn.004e897d
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x464]
call fcn.004f190c
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x44c]
call fcn.004e897d
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x4fc]
call fcn.00467ce0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x478]
call fcn.004f190c
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00507257
mov esp, ebp
pop ebp
ret 4