Function at 0x4cbb93
Capabilities:
Get common file path

Disassembly:
push ebp
push ebx
mov edx, 0x50
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x4cbb9a
mov eax, dword [esp + 0x14c]
mov dword [0x9b3e20], eax
mov dword [esp + 0x124], 0xff
push dword [0x9b3e20]
push dword [0x9b3e20]
push dword [esp + 0x12c]
call fcn.00556460
lea eax, [esp + 0x12c]
push eax
call fcn.00559740
mov edx, 0x6fb198
lea ecx, [esp + 0x138]
call fcn.0051f008
lea eax, [esp + 0x124]
push eax
mov eax, dword [esp + 0x12c]
push eax
call sub.KERNEL32.dll_GetWindowsDirectoryW
push dword [0x9b3e20]
push dword [0x9b3e20]
push dword [esp + 0x130]
call fcn.00556580
lea eax, [esp + 0x13c]
push eax
call fcn.00559740
mov edx, dword [esp + 0x138]
push dword [0x9b3e20]
push edx
call fcn.005597c0
mov edx, str._system32kernel32.dll
push edx
call fcn.005597c0
lea eax, [esp + 0x138]
push eax
call fcn.00559740
push dword [0x9b3e20]
push 0x40
push dword [esp + 0x13c]
call fcn.0050b552
lea eax, [esp + 0x130]
push eax
call fcn.00559740
push dword [0x9b3e20]
push dword [0x9b3e20]
mov eax, 0x6fec6e
push eax
push 3
push dword [esp + 0x13c]
call fcn.00556db0
lea eax, [esp + 0x134]
push eax
call fcn.00559740
push dword [esp + 0x130]
call fcn.00556b90
mov dword [esp + 0x13c], eax
lea ebp, [esp]
mov dword [ebp], 0x11c
mov eax, str.ntdll.dll
push eax
push 0xffffffff
call fcn.00529fca
mov dword [esp + 0x120], eax
cmp dword [esp + 0x120], 0
je 0x4cbd10
mov eax, str.RtlGetVersion
push eax
push dword [esp + 0x124]
call fcn.0052a024
mov dword [esp + 0x11c], eax
push dword [esp + 0x120]
call fcn.00529f0a
mov ebx, dword [esp + 0x11c]
and ebx, ebx
je 0x4cbd2e
lea eax, [esp]
push eax
call dword [esp + 0x120]
mov ebx, eax
and ebx, ebx
jne 0x4cbd2e
jmp 0x4cbd35
mov eax, 1
jmp 0x4cbd37
xor eax, eax
and eax, eax
je 0x4cbd58
mov edx, str.Error:_Cant_call_Windows_API_function_RtlGetVersion__.
push dword [0x9b3e20]
push edx
call fcn.005597c0
pop eax
add eax, dword [0x9a36fc]
jmp 0x4cc404
lea ebp, [esp]
mov ebx, dword [ebp + 0x10]
cmp ebx, 2
je 0x4cbd80
mov edx, str.No_Windows_NT_based_operating_system
push dword [0x9b3e20]
push edx
call fcn.005597c0
pop eax
add eax, dword [0x9a36fc]
jmp 0x4cc404
lea ebp, [esp]
push dword [ebp + 4]
mov ebx, 3
cmp ebx, dword [esp]
jne 0x4cbdff
lea ebp, [esp + 4]
movsx ebx, byte [ebp + 0x11a]
cmp ebx, 1
jne 0x4cbdce
mov eax, dword [esp + 0x150]
mov dword [0x9b3e20], eax
mov edx, str.Windows_NT_3.5_Workstation
push dword [0x9b3e20]
push edx
call fcn.005597c0
pop eax
add eax, dword [0x9a36fc]
add esp, 4
jmp 0x4cc404
mov eax, dword [esp + 0x150]
mov dword [0x9b3e20], eax
mov edx, str.Windows_NT_3.5_Server
push dword [0x9b3e20]
push edx
call fcn.005597c0
pop eax
add eax, dword [0x9a36fc]
add esp, 4
jmp 0x4cc404
mov ebx, 4
cmp ebx, dword [esp]
jne 0x4cbe78
lea ebp, [esp + 4]
movsx ebx, byte [ebp + 0x11a]
cmp ebx, 1
jne 0x4cbe47
mov eax, dword [esp + 0x150]
mov dword [0x9b3e20], eax
mov edx, str.Windows_NT_4.0_Workstation
push dword [0x9b3e20]
push edx
call fcn.005597c0
pop eax
add eax, dword [0x9a36fc]
add esp, 4
jmp 0x4cc404
mov eax, dword [esp + 0x150]
mov dword [0x9b3e20], eax
mov edx, str.Windows_NT_4.0_Server
push dword [0x9b3e20]
push edx
call fcn.005597c0
pop eax
add eax, dword [0x9a36fc]
add esp, 4
jmp 0x4cc404
mov ebx, 5
cmp ebx, dword [esp]
jne 0x4cbff8
lea ebp, [esp + 4]
push dword [ebp + 8]
xor ebx, ebx
cmp ebx, dword [esp]
jne 0x4cbf03
lea ebp, [esp + 8]
movsx ebx, byte [ebp + 0x11a]
cmp ebx, 1
jne 0x4cbed2
mov eax, dword [esp + 0x154]
mov dword [0x9b3e20], eax
mov edx, str.Windows_2000_Workstation
push dword [0x9b3e20]
push edx
call fcn.005597c0
pop eax
add eax, dword [0x9a36fc]
add esp, 8
jmp 0x4cc404
mov eax, dword [esp + 0x154]
mov dword [0x9b3e20], eax
mov edx, str.Windows_2000_Server
push dword [0x9b3e20]
push edx
call fcn.005597c0
pop eax
add eax, dword [0x9a36fc]
add esp, 8
jmp 0x4cc404
mov ebx, 1
cmp ebx, dword [esp]
jne 0x4cbf7e
lea ebp, [esp + 8]
movsx ebx, word [ebp + 0x118]
and ebx, 0x200
and ebx, ebx
je 0x4cbf50
mov eax, dword [esp + 0x154]
mov dword [0x9b3e20], eax
mov edx, str.Windows_XP_Home_Edition
push dword [0x9b3e20]
push edx
call fcn.005597c0
pop eax
add eax, dword [0x9a36fc]
add esp, 8
jmp 0x4cc404
mov eax, dword [esp + 0x154]
mov dword [0x9b3e20], eax
mov edx, str.Windows_XP_Professional
push dword [0x9b3e20]
push edx
call fcn.005597c0
pop eax
add eax, dword [0x9a36fc]
add esp, 8
jmp 0x4cc404
mov ebx, 2
cmp ebx, dword [esp]
jne 0x4cbff2
lea ebp, [esp + 8]
movsx ebx, byte [ebp + 0x11a]
cmp ebx, 1
jne 0x4cbfc6
mov eax, dword [esp + 0x154]
mov dword [0x9b3e20], eax
mov edx, str.Windows_XP_64_bit_Edition
push dword [0x9b3e20]
push edx
call fcn.005597c0
pop eax
add eax, dword [0x9a36fc]
add esp, 8
jmp 0x4cc404
mov eax, dword [esp + 0x154]
mov dword [0x9b3e20], eax
mov edx, str.Windows_Server_2003
push dword [0x9b3e20]
push edx
call fcn.005597c0
pop eax
add eax, dword [0x9a36fc]
add esp, 8
jmp 0x4cc404
pop eax
jmp 0x4cc3d9
mov ebx, 6
cmp ebx, dword [esp]
jne 0x4cc26d
lea ebp, [esp + 4]
push dword [ebp + 8]
xor ebx, ebx
cmp ebx, dword [esp]
jne 0x4cc083
lea ebp, [esp + 8]
movsx ebx, byte [ebp + 0x11a]
cmp ebx, 1
jne 0x4cc052
mov eax, dword [esp + 0x154]
mov dword [0x9b3e20], eax
mov edx, str.Windows_Vista
push dword [0x9b3e20]
push edx
call fcn.005597c0
pop eax
add eax, dword [0x9a36fc]
add esp, 8
jmp 0x4cc404
mov eax, dword [esp + 0x154]
mov dword [0x9b3e20], eax
mov edx, str.Windows_Server_2008
push dword [0x9b3e20]
push edx
call fcn.005597c0
pop eax
add eax, dword [0x9a36fc]
add esp, 8
jmp 0x4cc404
mov ebx, 1
cmp ebx, dword [esp]
jne 0x4cc0fc
lea ebp, [esp + 8]
movsx ebx, byte [ebp + 0x11a]
cmp ebx, 1
jne 0x4cc0cb
mov eax, dword [esp + 0x154]
mov dword [0x9b3e20], eax
mov edx, str.Windows_7
push dword [0x9b3e20]
push edx
call fcn.005597c0
pop eax
add eax, dword [0x9a36fc]
add esp, 8
jmp 0x4cc404
mov eax, dword [esp + 0x154]
mov dword [0x9b3e20], eax
mov edx, str.Windows_Server_2008_R2
push dword [0x9b3e20]
push edx
call fcn.005597c0
pop eax
add eax, dword [0x9a36fc]
add esp, 8
jmp 0x4cc404
mov ebx, 2
cmp ebx, dword [esp]
jne 0x4cc1b4
lea ebp, [esp + 8]
movsx ebx, byte [ebp + 0x11a]
cmp ebx, 1
jne 0x4cc183
mov ebx, dword [esp + 0x144]
cmp ebx, 0x4f7c
jl 0x4cc155
mov eax, dword [esp + 0x154]
mov dword [0x9b3e20], eax
mov edx, str.Windows_11
push dword [0x9b3e20]
push edx
call fcn.005597c0
pop eax
add eax, dword [0x9a36fc]
add esp, 8
jmp 0x4cc404
mov eax, dword [esp + 0x154]
mov dword [0x9b3e20], eax
mov edx, str.Windows_8
push dword [0x9b3e20]
push edx
call fcn.005597c0
pop eax
add eax, dword [0x9a36fc]
add esp, 8
jmp 0x4cc404
mov eax, dword [esp + 0x154]
mov dword [0x9b3e20], eax
mov edx, str.Windows_Server_2012
push dword [0x9b3e20]
push edx
call fcn.005597c0
pop eax
add eax, dword [0x9a36fc]
add esp, 8
jmp 0x4cc404
mov ebx, 3
cmp ebx, dword [esp]
jne 0x4cc267
lea ebp, [esp + 8]
movsx ebx, byte [ebp + 0x11a]
cmp ebx, 1
jne 0x4cc23b
mov ebx, dword [esp + 0x144]
cmp ebx, 0x4f7c
jl 0x4cc20d
mov eax, dword [esp + 0x154]
mov dword [0x9b3e20], eax
mov edx, str.Windows_11
push dword [0x9b3e20]
push edx
call fcn.005597c0
pop eax
add eax, dword [0x9a36fc]
add esp, 8
jmp 0x4cc404
mov eax, dword [esp + 0x154]
mov dword [0x9b3e20], eax
mov edx, str.Windows_8.1
push dword [0x9b3e20]
push edx
call fcn.005597c0
pop eax
add eax, dword [0x9a36fc]
add esp, 8
jmp 0x4cc404
mov eax, dword [esp + 0x154]
mov dword [0x9b3e20], eax
mov edx, str.Windows_Server_2012_R2
push dword [0x9b3e20]
push edx
call fcn.005597c0
pop eax
add eax, dword [0x9a36fc]
add esp, 8
jmp 0x4cc404
pop eax
jmp 0x4cc3d9
mov ebx, 0xa
cmp ebx, dword [esp]
jne 0x4cc3d9
lea ebp, [esp + 4]
movsx ebx, byte [ebp + 0x11a]
cmp ebx, 1
jne 0x4cc32a
lea ebp, [esp + 4]
mov ebx, dword [ebp + 0xc]
cmp ebx, 0x55f0
jge 0x4cc2af
mov ebx, dword [esp + 0x140]
cmp ebx, 0x4f7c
jge 0x4cc2af
jmp 0x4cc2b6
mov eax, 1
jmp 0x4cc2b8
xor eax, eax
and eax, eax
je 0x4cc2ea
mov eax, dword [esp + 0x150]
mov dword [0x9b3e20], eax
mov edx, str.Windows_11
push dword [0x9b3e20]
push edx
call fcn.005597c0
pop eax
add eax, dword [0x9a36fc]
add esp, 4
jmp 0x4cc404
lea ebp, [esp + 4]
mov ebx, dword [ebp + 0xc]
cmp ebx, 0x2800
jl 0x4cc325
mov eax, dword [esp + 0x150]
mov dword [0x9b3e20], eax
mov edx, str.Windows_10
push dword [0x9b3e20]
push edx
call fcn.005597c0
pop eax
add eax, dword [0x9a36fc]
add esp, 4
jmp 0x4cc404
jmp 0x4cc3d9
lea ebp, [esp + 4]
mov ebx, dword [ebp + 0xc]
cmp ebx, 0x4f7c
jl 0x4cc367
mov eax, dword [esp + 0x150]
mov dword [0x9b3e20], eax
mov edx, str.Windows_Server_2022
push dword [0x9b3e20]
push edx
call fcn.005597c0
pop eax
add eax, dword [0x9a36fc]
add esp, 4
jmp 0x4cc404
lea ebp, [esp + 4]
mov ebx, dword [ebp + 0xc]
cmp ebx, 0x4563
jl 0x4cc3a1
mov eax, dword [esp + 0x150]
mov dword [0x9b3e20], eax
mov edx, str.Windows_Server_2019
push dword [0x9b3e20]
push edx
call fcn.005597c0
pop eax
add eax, dword [0x9a36fc]
add esp, 4
jmp 0x4cc404
lea ebp, [esp + 4]
mov ebx, dword [ebp + 0xc]
cmp ebx, 0x3839
jl 0x4cc3d9
mov eax, dword [esp + 0x150]
mov dword [0x9b3e20], eax
mov edx, str.Windows_Server_2016
push dword [0x9b3e20]
push edx
call fcn.005597c0
pop eax
add eax, dword [0x9a36fc]
add esp, 4
jmp 0x4cc404
pop eax
mov edx, str.Unknown_Windows_version
push dword [0x9b3e20]
push edx
call fcn.005597c0
pop eax
add eax, dword [0x9a36fc]
jmp 0x4cc404
push dword [esp + 0x138]
call fcn.00559820
push dword [esp + 0x134]
call fcn.00559820
push dword [esp + 0x130]
call fcn.00559820
push dword [esp + 0x12c]
call fcn.00559820
push dword [esp + 0x128]
call fcn.00559820
add esp, 0x140
pop ebx
pop ebp
ret