Function at 0x47cea0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x524
mov eax, dword [0x4f72bc]
xor eax, esp
mov dword [esp + 0x520], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
xor edi, edi
mov ebx, ecx
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], edi
mov dword [esp + 0x14], edi
cmp dword [0x506e0c], edi
je 0x47cf0f
lea ecx, [esp + 0x1c]
push str.KERNEL32.DLL
mov dword [esp + 0x14], ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
cmp esi, edi
je 0x47cf0f
push str.Wow64DisableWow64FsRedirection
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, edi
je 0x47cf08
lea edx, [esp + 0x10]
push edx
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 0x400
push edi
push 0x506848
call fcn.004d29c0
push 0x400
lea eax, [esp + 0x30]
push edi
push eax
call fcn.004d29c0
add esp, 0x18
mov edx, str.SYSTEMROOT
mov ecx, ebx
call fcn.0047bb80
test eax, eax
je 0x47cf95
push 0x104
lea ecx, [esp + 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov eax, 0x104
lea ecx, [esp + 0x20]
jmp 0x47cf60
cmp byte [ecx], 0
je 0x47cf6e
inc ecx
dec eax
jne 0x47cf60
jmp 0x47d11b
cmp eax, edi
je 0x47d11b
mov ecx, 0x104
sub ecx, eax
mov eax, 0x104
add ebx, 0xc
sub eax, ecx
lea ecx, [esp + ecx + 0x20]
mov edx, 0x7fffffff
jmp 0x47d115
mov edx, str._WINDIR_
mov ecx, ebx
call fcn.0047bb80
test eax, eax
je 0x47cff5
push 0x104
lea edx, [esp + 0x24]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov eax, 0x104
lea ecx, [esp + 0x20]
mov edi, edi
cmp byte [ecx], 0
je 0x47cfce
inc ecx
dec eax
jne 0x47cfc0
jmp 0x47d11b
cmp eax, edi
je 0x47d11b
mov ecx, 0x104
sub ecx, eax
mov eax, 0x104
add ebx, 8
sub eax, ecx
lea ecx, [esp + ecx + 0x20]
mov edx, 0x7fffffff
jmp 0x47d115
mov edx, str._PROGRAMFILES_
mov ecx, ebx
call fcn.0047bb80
test eax, eax
je 0x47d085
push 0x104
push str.ProgramFilesDir
push str.SOFTWAREMicrosoftWindowsCurrentVersion
lea ecx, [esp + 0x2c]
mov edx, CreateStatusWindowA
call fcn.004bff10
add esp, 0xc
test eax, eax
jne 0x47d045
push 0x4ec31c
mov edx, 0x7ffffffe
mov eax, 0x104
lea ecx, [esp + 0x24]
call fcn.004010b0
mov eax, 0x104
lea ecx, [esp + 0x20]
mov edi, edi
cmp byte [ecx], 0
je 0x47d05e
inc ecx
dec eax
jne 0x47d050
jmp 0x47d11b
cmp eax, edi
je 0x47d11b
mov ecx, 0x104
sub ecx, eax
mov eax, 0x104
add ebx, 0xe
sub eax, ecx
lea ecx, [esp + ecx + 0x20]
mov edx, 0x7fffffff
jmp 0x47d115
mov edx, str._PROGRAMFILES_X86__
mov ecx, ebx
call fcn.0047bb80
lea ecx, [esp + 0x20]
test eax, eax
je 0x47d10b
push 0x104
push str.ProgramFilesDir__x86_
push str.SOFTWAREMicrosoftWindowsCurrentVersion
mov edx, CreateStatusWindowA
call fcn.004bff10
add esp, 0xc
test eax, eax
jne 0x47d0d1
push str.C:Program_Files__x86_
mov edx, 0x7ffffffe
mov eax, 0x104
lea ecx, [esp + 0x24]
call fcn.004010b0
mov eax, 0x104
lea ecx, [esp + 0x20]
lea ebx, [ebx]
cmp byte [ecx], 0
je 0x47d0eb
inc ecx
dec eax
jne 0x47d0e0
jmp 0x47d11b
cmp eax, edi
je 0x47d11b
mov ecx, 0x104
sub ecx, eax
mov eax, 0x104
add ebx, 0x13
sub eax, ecx
lea ecx, [esp + ecx + 0x20]
mov edx, 0x7fffffff
jmp 0x47d115
mov edx, 0x7ffffffe
mov eax, 0x104
push ebx
call fcn.004010b0
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [esp + 0x20]
push eax
xor ebx, ebx
xor esi, esi
call edi
test eax, eax
jle 0x47d1d0
cmp byte [esp + esi + 0x20], 0x2e
jne 0x47d168
movsx ecx, byte [esp + esi + 0x22]
push ecx
call fcn.004d1039
add esp, 4
cmp eax, 0x58
je 0x47d1a6
cmp byte [esp + esi + 0x20], 0x2e
jne 0x47d168
movsx edx, byte [esp + esi + 0x22]
push edx
call fcn.004d1039
add esp, 4
cmp eax, 0x4c
je 0x47d1a6
movsx eax, byte [esp + esi + 0x20]
push eax
call fcn.004d1039
mov byte [ebx + 0x506848], al
add esp, 4
inc ebx
cmp byte [esp + esi + 0x20], 0x3a
jne 0x47d198
lea ecx, [esi - 1]
mov dword [esp + 0x14], ecx
cmp esi, 1
jge 0x47d198
mov dword [esp + 0x14], 0
lea edx, [esp + 0x20]
push edx
inc esi
call edi
cmp esi, eax
jl 0x47d134
jmp 0x47d1d0
xor edi, edi
lea esi, [esp + esi + 0x20]
lea esp, [esp]
movsx eax, byte [esi + edi]
push eax
call fcn.004d1039
mov byte [ebx + 0x506848], al
inc edi
add esp, 4
inc ebx
cmp edi, 4
jl 0x47d1b0
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
mov eax, dword [esp + 0x18]
mov byte [ebx + 0x506848], 0
mov ebx, dword [esp + 0x14]
lea ebx, [ebx + 0x506848]
mov edx, ebx
mov esi, 0x104
sub edx, eax
mov edi, edi
lea ecx, [esi + 0x7ffffefa]
test ecx, ecx
je 0x47d209
mov cl, byte [eax + edx]
test cl, cl
je 0x47d209
mov byte [eax], cl
inc eax
dec esi
jne 0x47d1f0
jmp 0x47d20d
test esi, esi
jne 0x47d20e
dec eax
cmp dword [0x506e0c], 0
mov byte [eax], 0
je 0x47d30b
lea edx, [esp + 0x1c]
push str.KERNEL32.DLL
mov dword [esp + 0x14], edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x47d255
push str.Wow64RevertWow64FsRedirection
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x47d24e
lea ecx, [esp + 0x10]
push ecx
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov esi, dword [esp + 0x18]
push esi
call edi
test eax, eax
jle 0x47d30b
mov ecx, esi
call fcn.0047af20
test eax, eax
jne 0x47d30b
mov edx, str.Program_Files__x86_
mov ecx, esi
call fcn.0047bb80
test eax, eax
je 0x47d30b
push str.C:Program_Files_
mov edx, 0x7ffffffe
mov eax, 0x104
lea ecx, [esp + 0x424]
call fcn.004010b0
mov eax, 0x104
lea ecx, [esp + 0x420]
mov edi, edi
cmp byte [ecx], 0
je 0x47d2bb
inc ecx
dec eax
jne 0x47d2b0
jmp 0x47d2e2
test eax, eax
je 0x47d2e2
mov ecx, 0x104
sub ecx, eax
lea edx, [esi + 0x17]
mov eax, 0x104
push edx
sub eax, ecx
lea ecx, [esp + ecx + 0x424]
mov edx, 0x7fffffff
call fcn.004010b0
lea ecx, [esp + 0x420]
call fcn.0047af20
test eax, eax
je 0x47d30b
lea eax, [esp + 0x420]
push eax
mov edx, 0x7ffffffe
mov eax, 0x104
mov ecx, esi
call fcn.004010b0
push ebx
call edi
mov ecx, dword [esp + 0x52c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004cf2b6
mov esp, ebp
pop ebp
ret