Function at 0x479c3d
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5e0
push edi
mov dword [ebp - 0x5e0], ecx
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x108], eax
mov ecx, dword [ebp - 0x108]
call fcn.00414edc
mov dword [ebp - 0x220], eax
mov dword [ebp - 0x10c], 0
mov byte [ebp - 0x218], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x217]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x104], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x103]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x104
lea ecx, [ebp - 0x218]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea edx, [ebp + eax - 0x218]
mov dword [ebp - 0x110], edx
push 0x104
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea ecx, [ebp + eax - 0x104]
mov dword [ebp - 0x114], ecx
mov dword [ebp - 0x21c], 0
jmp 0x479cfc
mov edx, dword [ebp - 0x21c]
add edx, 1
mov dword [ebp - 0x21c], edx
cmp dword [ebp - 0x21c], 0x17
jae 0x479fbb
mov byte [ebp - 0x324], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x323]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [ebp - 0x21c]
cmp dword [eax*8 + 0x535cb0], 1
jne 0x479d6b
mov ecx, dword [ebp - 0x21c]
mov edx, dword [ecx*8 + 0x535cb4]
push edx
push 0x104
mov eax, dword [ebp - 0x110]
push eax
call fcn.004154e0
lea ecx, [ebp - 0x218]
push ecx
push 0x104
lea edx, [ebp - 0x324]
push edx
call fcn.004154e0
jmp 0x479db2
mov eax, dword [ebp - 0x21c]
cmp dword [eax*8 + 0x535cb0], 2
jne 0x479db2
mov ecx, dword [ebp - 0x21c]
mov edx, dword [ecx*8 + 0x535cb4]
push edx
push 0x104
mov eax, dword [ebp - 0x114]
push eax
call fcn.004154e0
lea ecx, [ebp - 0x104]
push ecx
push 0x104
lea edx, [ebp - 0x324]
push edx
call fcn.004154e0
mov dword [ebp - 0x328], 0
lea eax, [ebp - 0x324]
push eax
call fcn.0042ae0a
add esp, 4
test eax, eax
jne 0x479dde
mov dword [ebp - 0x328], 1
jmp 0x479f4b
lea ecx, [ebp - 0x324]
push ecx
call fcn.0044b990
mov ecx, eax
call fcn.0044bdb4
test eax, eax
jne 0x479f4b
mov dword [ebp - 0x32c], 0xffffffff
push 0
push 0
push 3
push 0
push 7
push 0x120089
lea edx, [ebp - 0x324]
push edx
call dword [0x54299c]
mov dword [ebp - 0x32c], eax
cmp dword [ebp - 0x32c], 0xffffffff
jne 0x479e71
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x20
jne 0x479e6c
mov dword [ebp - 0x328], 1
mov eax, dword [ebp + 0xc]
push eax
push 0x44c
lea ecx, [ebp - 0x324]
push ecx
mov edx, dword [ebp - 0x5e0]
push edx
call dword [ebp + 8]
mov eax, dword [ebp - 0x10c]
add eax, 1
mov dword [ebp - 0x10c], eax
jmp 0x479f1f
mov ecx, dword [ebp - 0x32c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edx, [ebp - 0x324]
push edx
call fcn.0042d5f8
add esp, 4
mov dword [ebp - 0x330], eax
cmp dword [ebp - 0x220], 2
je 0x479ee3
cmp dword [ebp - 0x330], 1
je 0x479ee1
cmp dword [ebp - 0x330], 2
je 0x479ee1
mov dword [ebp - 0x328], 1
mov eax, dword [ebp + 0xc]
push eax
push 0x44c
lea ecx, [ebp - 0x324]
push ecx
mov edx, dword [ebp - 0x5e0]
push edx
call dword [ebp + 8]
mov eax, dword [ebp - 0x10c]
add eax, 1
mov dword [ebp - 0x10c], eax
jmp 0x479f1f
cmp dword [ebp - 0x330], 1
je 0x479f1f
mov dword [ebp - 0x328], 1
mov ecx, dword [ebp + 0xc]
push ecx
push 0x44c
lea edx, [ebp - 0x324]
push edx
mov eax, dword [ebp - 0x5e0]
push eax
call dword [ebp + 8]
mov ecx, dword [ebp - 0x10c]
add ecx, 1
mov dword [ebp - 0x10c], ecx
cmp dword [ebp - 0x328], 0
je 0x479f4b
cmp dword [ebp - 0x21c], 0
jne 0x479f4b
push str.CFTMON.exe
call fcn.0043a2cf
add esp, 4
push str.iexpe.exe
call fcn.0043a2cf
add esp, 4
cmp dword [ebp - 0x328], 0
je 0x479fb6
mov dword [ebp - 0x468], 0
mov dword [ebp - 0x470], 2
mov dword [ebp - 0x45c], 0
mov dword [ebp - 0x338], 0
lea edx, [ebp - 0x324]
push edx
push 0x104
lea eax, [ebp - 0x5d8]
push eax
call fcn.004154e0
mov dword [ebp - 0x5dc], 0
lea ecx, [ebp - 0x5dc]
push ecx
lea edx, [ebp - 0x5d8]
push edx
mov ecx, 0x55a980
call fcn.00416ee0
jmp 0x479ced
mov eax, dword [ebp - 0x10c]
pop edi
mov esp, ebp
pop ebp
ret 8