Function at 0x48c188
Capabilities:
Get common file path

Disassembly:
push 0x21c
mov eax, 0x50a998
call fcn.004cea37
mov byte [ebp - 0x221], dl
mov edi, ecx
push str.ProgramFiles64Folder
call fcn.0044808a
xor esi, esi
test eax, eax
jne 0x48c20c
push edi
lea ecx, [ebp - 0x228]
call fcn.004071c5
push str.ProgramW6432
lea ecx, [ebp - 0x228]
mov dword [ebp - 4], esi
call fcn.00476200
test eax, eax
je 0x48c1fd
lea eax, [ebp - 0x228]
mov ecx, edi
push eax
call fcn.00446330
mov ecx, edi
call fcn.004737f0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x228]
call fcn.004068c3
mov al, 1
jmp 0x48c521
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x228]
call fcn.004068c3
push str.SystemFolder
lea ecx, [ebp - 0x220]
call fcn.00409ea5
mov dword [ebp - 4], 1
mov ecx, edi
push dword [eax]
call fcn.0044808a
mov ebx, eax
lea ecx, [ebp - 0x220]
neg ebx
sbb bl, bl
or dword [ebp - 4], 0xffffffff
call fcn.004068c3
add bl, 1
je 0x48c292
cmp byte [ebp - 0x221], 0
lea eax, [ebp - 0x21c]
push eax
push esi
push esi
push 0x29
pop eax
push 0x25
pop ecx
cmovne eax, ecx
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea eax, [ebp - 0x21c]
push eax
call fcn.004d3ded
pop ecx
push eax
lea eax, [ebp - 0x21c]
mov ecx, edi
push eax
call fcn.00409e0a
mov ecx, edi
call fcn.004737f0
xor eax, eax
inc eax
jmp 0x48c521
push str.System32Folder
lea ecx, [ebp - 0x220]
call fcn.00409ea5
mov dword [ebp - 4], 2
mov ecx, edi
push dword [eax]
call fcn.0044808a
mov ebx, eax
lea ecx, [ebp - 0x220]
neg ebx
sbb bl, bl
or dword [ebp - 4], 0xffffffff
call fcn.004068c3
add bl, 1
je 0x48c2e5
push 0x104
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
jmp 0x48c331
call fcn.004ce683
push str.WindowsFolder
lea ecx, [ebp - 0x220]
call fcn.00409ea5
mov dword [ebp - 4], 3
mov ecx, edi
push dword [eax]
call fcn.0044808a
mov ebx, eax
lea ecx, [ebp - 0x220]
neg ebx
sbb bl, bl
or dword [ebp - 4], 0xffffffff
call fcn.004068c3
add bl, 1
je 0x48c345
push 0x104
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push 0x5c
pop ecx
mov word [ebp + eax*2 - 0x21c], cx
lea eax, [eax*2 + 2]
jmp 0x48c3c0
push str.WindowsVolume
lea ecx, [ebp - 0x220]
call fcn.00409ea5
mov dword [ebp - 4], 4
mov ecx, edi
push dword [eax]
call fcn.0044808a
mov ebx, eax
lea ecx, [ebp - 0x220]
neg ebx
sbb bl, bl
or dword [ebp - 4], 0xffffffff
call fcn.004068c3
add bl, 1
je 0x48c39c
push 0x104
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
xor eax, eax
mov word [ebp - 0x216], ax
jmp 0x48c3d5
push str.TempFolder
mov ecx, edi
call fcn.0044808a
test eax, eax
jne 0x48c3f6
lea eax, [ebp - 0x21c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
add eax, eax
cmp eax, 0x208
jae 0x48c2e0
xor ecx, ecx
mov word [ebp + eax - 0x21c], cx
lea eax, [ebp - 0x21c]
push eax
call fcn.004d3ded
pop ecx
push eax
lea eax, [ebp - 0x21c]
mov ecx, edi
push eax
call fcn.00409e0a
jmp 0x48c28a
push str.SETUPEXEDIR
mov ecx, edi
call fcn.0044808a
test eax, eax
jne 0x48c484
mov eax, dword [0x5736d8]
mov ebx, 0x5736d8
cmp dword [eax - 0xc], esi
jne 0x48c477
push 0x104
lea eax, [ebp - 0x21c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
sub eax, 1
je 0x48c43f
push 0x5c
pop ecx
cmp word [ebp + eax*2 - 0x21c], cx
je 0x48c43f
sub eax, 1
jne 0x48c430
lea eax, [eax*2 + 2]
cmp eax, 0x208
jae 0x48c2e0
xor ecx, ecx
mov word [ebp + eax - 0x21c], cx
lea eax, [ebp - 0x21c]
push eax
call fcn.004d3ded
pop ecx
push eax
lea eax, [ebp - 0x21c]
mov ecx, ebx
push eax
call fcn.00409e0a
push ebx
mov ecx, edi
call fcn.00446330
jmp 0x48c28a
xor esi, esi
push dword [esi*4 + 0x533c40]
mov ecx, edi
call fcn.0044808a
test eax, eax
je 0x48c49e
inc esi
cmp esi, 0xe
jb 0x48c486
cmp esi, 0xe
jae 0x48c51f
lea eax, [ebp - 0x220]
push eax
push dword [esi*4 + 0x533c04]
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
je 0x48c4dc
mov ecx, dword [esi*4 + 0x533c04]
mov edx, edi
call fcn.0048c527
test al, al
jne 0x48c28a
mov ecx, edi
call fcn.0048c61a
jmp 0x48c521
lea eax, [ebp - 0x21c]
push eax
push dword [ebp - 0x220]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
and dword [ebp - 0x228], 0
mov esi, eax
lea eax, [ebp - 0x228]
push eax
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
mov ecx, dword [ebp - 0x228]
push dword [ebp - 0x220]
push ecx
mov edx, dword [ecx]
call dword [edx + 0x14]
test esi, esi
jne 0x48c267
xor al, al
call fcn.004ce9e1
ret