Function at 0x413378
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x1a0]
sub esp, 0x220
mov eax, dword [0x438060]
push ebx
xor eax, ebp
push edi
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpA]
mov ebx, ecx
mov dword [ebp + 0x19c], eax
mov eax, dword [ebx]
push str.ProgramFiles64Folder
push eax
mov dword [ebp - 0x80], ebx
call edi
test eax, eax
jne 0x4133fd
mov eax, dword [ebx]
sub eax, 0x10
call fcn.00401c33
add eax, 0x10
mov dword [ebp - 0x7c], eax
push str.ProgramW6432
lea eax, [ebp - 0x7c]
call fcn.004137f7
test eax, eax
je 0x4133f2
lea eax, [ebp - 0x7c]
mov edi, ebx
call fcn.00401bc0
mov eax, ebx
call fcn.00411555
mov eax, dword [ebp - 0x7c]
add eax, 0xfffffff0
call fcn.0040147d
mov al, 1
jmp 0x413643
mov eax, dword [ebp - 0x7c]
add eax, 0xfffffff0
call fcn.0040147d
push esi
push str.SystemFolder
lea esi, [ebp - 0x78]
mov byte [ebp - 0x71], 1
call fcn.004015d9
mov eax, dword [eax]
mov ebx, dword [ebx]
push eax
push ebx
call edi
mov ebx, eax
mov eax, dword [ebp - 0x78]
neg ebx
sbb bl, bl
add eax, 0xfffffff0
inc bl
call fcn.0040147d
test bl, bl
je 0x413464
push 0x104
lea eax, [ebp + 0x98]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov byte [ebp + eax + 0x98], 0x5c
mov byte [ebp + eax + 0x99], 0
lea eax, [ebp + 0x98]
push eax
push dword [ebp - 0x80]
call fcn.004018a3
jmp 0x41363f
push str.WindowsFolder
lea esi, [ebp - 0x78]
call fcn.004015d9
mov eax, dword [eax]
mov esi, dword [ebp - 0x80]
mov ecx, dword [esi]
push eax
push ecx
call edi
mov ebx, eax
mov eax, dword [ebp - 0x78]
neg ebx
sbb bl, bl
add eax, 0xfffffff0
inc bl
call fcn.0040147d
test bl, bl
je 0x4134bf
push 0x104
lea eax, [ebp + 0x98]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov byte [ebp + eax + 0x98], 0x5c
mov byte [ebp + eax + 0x99], 0
lea eax, [ebp + 0x98]
push eax
push esi
jmp 0x41345a
push str.WindowsVolume
lea esi, [ebp - 0x78]
call fcn.004015d9
mov eax, dword [eax]
mov ecx, dword [ebp - 0x80]
mov ecx, dword [ecx]
push eax
push ecx
call edi
mov ebx, eax
mov eax, dword [ebp - 0x78]
neg ebx
sbb bl, bl
add eax, 0xfffffff0
inc bl
call fcn.0040147d
test bl, bl
je 0x41350c
push 0x104
lea eax, [ebp + 0x98]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov byte [ebp + 0x9b], 0
jmp 0x413450
mov ebx, dword [ebp - 0x80]
mov eax, dword [ebx]
push str.TempFolder
push eax
call edi
test eax, eax
jne 0x413544
lea eax, [ebp + 0x98]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov byte [ebp + eax + 0x98], 0
lea eax, [ebp + 0x98]
push eax
push ebx
jmp 0x41345a
mov eax, dword [ebx]
push str.SETUPEXEDIR
push eax
call edi
test eax, eax
jne 0x4135a5
mov eax, dword [0x438d00]
cmp dword [eax - 0xc], 0
mov esi, 0x438d00
jne 0x413597
push 0x105
lea eax, [ebp - 0x70]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
jmp 0x41357c
cmp byte [ebp + eax - 0x70], 0x5c
je 0x41357f
dec eax
jne 0x413575
lea ecx, [ebp - 0x70]
mov byte [ebp + eax - 0x6f], 0
call fcn.0040195b
push eax
lea eax, [ebp - 0x70]
push eax
push esi
call fcn.004018bd
mov eax, esi
mov edi, ebx
call fcn.00401bc0
jmp 0x41363f
xor esi, esi
mov eax, dword [esi*4 + 0x438960]
mov ecx, dword [ebx]
push eax
push ecx
call edi
test eax, eax
je 0x4135be
inc esi
cmp esi, 0xe
jb 0x4135a7
cmp esi, 0xe
jae 0x41363b
lea eax, [ebp - 0x78]
push eax
lea esi, [esi*4 + 0x431e98]
push dword [esi]
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
je 0x4135f5
push dword [esi]
call fcn.0041365a
test al, al
pop ecx
jne 0x41363f
mov edi, dword [ebp - 0x80]
call fcn.0041372a
mov byte [ebp - 0x71], al
jmp 0x41363f
lea eax, [ebp + 0x98]
push eax
push dword [ebp - 0x78]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
and dword [ebp - 0x7c], 0
mov esi, eax
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
mov eax, dword [ebp - 0x7c]
push dword [ebp - 0x78]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
test esi, esi
je 0x41363b
lea eax, [ebp + 0x98]
push eax
push ebx
call fcn.004018a3
mov eax, ebx
call fcn.00411555
jmp 0x41363f
mov byte [ebp - 0x71], 0
mov al, byte [ebp - 0x71]
pop esi
mov ecx, dword [ebp + 0x19c]
pop edi
xor ecx, ebp
pop ebx
call fcn.0042e08a
add ebp, 0x1a0
leave
ret