Function at 0x446d60
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push 0x104
push 0x4e4f60
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x446d85
push 0x4e4f60
call dword [sym.imp.SHLWAPI.dll_PathRemoveBackslashW]
push 0x104
push 0x4e5168
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x446da4
push 0x4e5168
call dword [sym.imp.SHLWAPI.dll_PathRemoveBackslashW]
call fcn.00409a90
test eax, eax
je 0x446de2
push 0x4e4f60
push str._s_system
push 0x104
push 0x4e5370
call fcn.004685e6
add esp, 0x10
push 0x4e5168
push 0x104
push 0x4e5578
call fcn.0046a95d
add esp, 0xc
jmp 0x446e15
push 0x4e5168
push 0x104
push 0x4e5370
call fcn.0046a95d
add esp, 0xc
push 0x4e4f60
push str._s_system32
push 0x104
push 0x4e5578
call fcn.004685e6
add esp, 0x10
push 0x4e5780
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x446e34
push 0x4e5780
call dword [sym.imp.SHLWAPI.dll_PathRemoveBackslashW]
push 0x4e5d98
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x446e53
push 0x4e5d98
call dword [sym.imp.SHLWAPI.dll_PathRemoveBackslashW]
mov dword [ebp - 0x10], 0
push str.shfolder.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x446e80
push 0x4ba1a4
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x447180
push 0x4e7e18
push 0
push 0
push 0x8023
push 0
call dword [ebp - 0x10]
test eax, eax
jl 0x446eac
push 0x4e7e18
call dword [sym.imp.SHLWAPI.dll_PathRemoveBackslashW]
push 0x4e4d58
push 0
push 0
push 0x8009
push 0
call dword [ebp - 0x10]
test eax, eax
jl 0x446ece
push 0x4e4d58
call dword [sym.imp.SHLWAPI.dll_PathRemoveBackslashW]
push 0x4e5988
push 0
push 0
push 0x8026
push 0
call dword [ebp - 0x10]
test eax, eax
jl 0x446ef0
push 0x4e5988
call dword [sym.imp.SHLWAPI.dll_PathRemoveBackslashW]
push 0x4e7c10
push 0
push 0
push 0x801a
push 0
call dword [ebp - 0x10]
test eax, eax
jl 0x446f12
push 0x4e7c10
call dword [sym.imp.SHLWAPI.dll_PathRemoveBackslashW]
push 0x4e8020
push 0
push 0
push 0x801c
push 0
call dword [ebp - 0x10]
test eax, eax
jl 0x446f34
push 0x4e8020
call dword [sym.imp.SHLWAPI.dll_PathRemoveBackslashW]
push 0x4e7a08
push 0
push 0
push 0x8018
push 0
call dword [ebp - 0x10]
test eax, eax
jl 0x446f56
push 0x4e7a08
call dword [sym.imp.SHLWAPI.dll_PathRemoveBackslashW]
push 0x4e7800
push 0
push 0
push 0x8007
push 0
call dword [ebp - 0x10]
test eax, eax
jl 0x446f78
push 0x4e7800
call dword [sym.imp.SHLWAPI.dll_PathRemoveBackslashW]
push 0x4e8228
push 0
push 0
push 0x802e
push 0
call dword [ebp - 0x10]
test eax, eax
jl 0x446f9a
push 0x4e8228
call dword [sym.imp.SHLWAPI.dll_PathRemoveBackslashW]
push 0x4e8430
push 0
push 0
push 0x8005
push 0
call dword [ebp - 0x10]
test eax, eax
jl 0x446fbc
push 0x4e8430
call dword [sym.imp.SHLWAPI.dll_PathRemoveBackslashW]
push 0x4e8840
push 0
push 0
push 0x8019
push 0
call dword [ebp - 0x10]
test eax, eax
jl 0x446fde
push 0x4e8840
call dword [sym.imp.SHLWAPI.dll_PathRemoveBackslashW]
push 0x4e8638
push 0
push 0
push 0x8010
push 0
call dword [ebp - 0x10]
test eax, eax
jl 0x447000
push 0x4e8638
call dword [sym.imp.SHLWAPI.dll_PathRemoveBackslashW]
push 0x4e5b90
push 0
push 0
push 0x802b
push 0
call dword [ebp - 0x10]
test eax, eax
jl 0x447022
push 0x4e5b90
call dword [sym.imp.SHLWAPI.dll_PathRemoveBackslashW]
push 0x4e75f8
push 0
push 0
push 0x8016
push 0
call dword [ebp - 0x10]
test eax, eax
jl 0x447044
push 0x4e75f8
call dword [sym.imp.SHLWAPI.dll_PathRemoveBackslashW]
push 0x4e73f0
push 0
push 0
push 0x800b
push 0
call dword [ebp - 0x10]
test eax, eax
jl 0x447066
push 0x4e73f0
call dword [sym.imp.SHLWAPI.dll_PathRemoveBackslashW]
push 0x4e71e8
push 0
push 0
push 0x8017
push 0
call dword [ebp - 0x10]
test eax, eax
jl 0x447088
push 0x4e71e8
call dword [sym.imp.SHLWAPI.dll_PathRemoveBackslashW]
push 0x4e6fe0
push 0
push 0
push 0x8002
push 0
call dword [ebp - 0x10]
test eax, eax
jl 0x4470aa
push 0x4e6fe0
call dword [sym.imp.SHLWAPI.dll_PathRemoveBackslashW]
push 0x4e65b8
push 0
push 0
push 0x8037
push 0
call dword [ebp - 0x10]
test eax, eax
jl 0x4470cc
push 0x4e65b8
call dword [sym.imp.SHLWAPI.dll_PathRemoveBackslashW]
push 0x4e63b0
push 0
push 0
push 0x800e
push 0
call dword [ebp - 0x10]
test eax, eax
jl 0x4470ee
push 0x4e63b0
call dword [sym.imp.SHLWAPI.dll_PathRemoveBackslashW]
push 0x4e69c8
push 0
push 0
push 0x8035
push 0
call dword [ebp - 0x10]
test eax, eax
jl 0x447110
push 0x4e69c8
call dword [sym.imp.SHLWAPI.dll_PathRemoveBackslashW]
push 0x4e67c0
push 0
push 0
push 0x800d
push 0
call dword [ebp - 0x10]
test eax, eax
jl 0x447132
push 0x4e67c0
call dword [sym.imp.SHLWAPI.dll_PathRemoveBackslashW]
push 0x4e6dd8
push 0
push 0
push 0x8036
push 0
call dword [ebp - 0x10]
test eax, eax
jl 0x447154
push 0x4e6dd8
call dword [sym.imp.SHLWAPI.dll_PathRemoveBackslashW]
push 0x4e6bd0
push 0
push 0
push 0x8027
push 0
call dword [ebp - 0x10]
test eax, eax
jl 0x447176
push 0x4e6bd0
call dword [sym.imp.SHLWAPI.dll_PathRemoveBackslashW]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [ebp - 0xc], 0
push str.shell32
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4471ad
push str.SHGetKnownFolderPath
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x44727a
mov dword [ebp - 0x14], 0
lea eax, [ebp - 0x14]
push eax
push 0
push 0x1000
push 0x4000
push 0x8000
call fcn.0044a290
add esp, 8
push eax
call fcn.0044a290
add esp, 8
push eax
push 0x4c13e4
call dword [ebp - 0xc]
test eax, eax
jl 0x447212
mov ecx, dword [ebp - 0x14]
push ecx
push 0x104
push 0x4e61a8
call fcn.0046a95d
add esp, 0xc
push 0x4e61a8
call dword [sym.imp.SHLWAPI.dll_PathRemoveBackslashW]
lea edx, [ebp - 0x14]
push edx
push 0
push 0x1000
push 0x4000
push 0x8000
call fcn.0044a290
add esp, 8
push eax
call fcn.0044a290
add esp, 8
push eax
push 0x4c13d4
call dword [ebp - 0xc]
test eax, eax
jl 0x447266
mov eax, dword [ebp - 0x14]
push eax
push 0x104
push 0x4e5fa0
call fcn.0046a95d
add esp, 0xc
push 0x4e5fa0
call dword [sym.imp.SHLWAPI.dll_PathRemoveBackslashW]
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
movzx eax, word [0x4e61a8]
test eax, eax
jne 0x4472a1
push 0x104
push 0x4e8840
push 0x104
push 0x4e61a8
call fcn.0046b271
add esp, 0x10
movzx ecx, word [0x4e5fa0]
test ecx, ecx
jne 0x4472c8
push 0x104
push 0x4e8638
push 0x104
push 0x4e5fa0
call fcn.0046b271
add esp, 0x10
push 0x104
push 0x4dba10
mov edx, dword [0x4db5e4]
push edx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x44735d
push 0x104
push 0x4dba10
push 0x104
push 0x4db808
call fcn.0046b271
add esp, 0x10
push 0x4db808
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push 0x104
push 0x4dba10
push 0x104
push 0x4dbc18
call fcn.0046b271
add esp, 0x10
push 0x4dbc18
call dword [sym.imp.SHLWAPI.dll_PathStripPathW]
push 0x104
push 0x4dba10
push 0x104
push 0x4dbe20
call fcn.0046b271
add esp, 0x10
push str..cfg
push 0x4dbe20
call dword [sym.imp.SHLWAPI.dll_PathRenameExtensionW]
push 0x4e4f60
push str.InitPathVar_____WINDOWS__s
call fcn.00457270
add esp, 8
push 0x4e5168
push str.InitPathVar_____WINSYS__s
call fcn.00457270
add esp, 8
push 0x4e5780
push str.InitPathVar_____CURRENTDIR__s
call fcn.00457270
add esp, 8
push 0x4e5d98
push str.InitPathVar_____TEMP__s
call fcn.00457270
add esp, 8
push 0x4e4d58
push str.InitPathVar_____SENDTO__s
call fcn.00457270
add esp, 8
push 0x4e5988
push str.InitPathVar_____PROGRAMFILES__s
call fcn.00457270
add esp, 8
push 0x4e5b90
push str.InitPathVar_____PROGRAM_FILES_COMMON__s
call fcn.00457270
add esp, 8
push 0x4e63b0
push str.InitPathVar_____VIDEO_USER__s
call fcn.00457270
add esp, 8
push 0x4e65b8
push str.InitPathVar_____VIDEO_ALLUSERS__s
call fcn.00457270
add esp, 8
push 0x4e67c0
push str.InitPathVar_____MUSIC_USER__s
call fcn.00457270
add esp, 8
push 0x4e69c8
push str.InitPathVar_____MUSIC_ALLUSERS__s
call fcn.00457270
add esp, 8
push 0x4e6bd0
push str.InitPathVar_____PICTURES_USER__s
call fcn.00457270
add esp, 8
push 0x4e6dd8
push str.InitPathVar_____PICTURES_ALLUSERS__s
call fcn.00457270
add esp, 8
push 0x4e6fe0
push str.InitPathVar_____PROGRAMS_USER__s
call fcn.00457270
add esp, 8
push 0x4e71e8
push str.InitPathVar_____PROGRAMS_ALLUSERS__s
call fcn.00457270
add esp, 8
push 0x4e73f0
push str.InitPathVar_____STARTMENU_USER__s
call fcn.00457270
add esp, 8
push 0x4e75f8
push str.InitPathVar_____STARTMENU_ALLUSERS__s
call fcn.00457270
add esp, 8
push 0x4e7800
push str.InitPathVar_____STARTUP_USER__s
call fcn.00457270
add esp, 8
push 0x4e7a08
push str.InitPathVar_____STARTUP_ALLUSERS__s
call fcn.00457270
add esp, 8
push 0x4e7c10
push str.InitPathVar_____APPDATA__s
call fcn.00457270
add esp, 8
push 0x4e7e18
push str.InitPathVar_____COMMON_APPDATA__s
call fcn.00457270
add esp, 8
push 0x4e8020
push str.InitPathVar_____LOCAL_APPDATA__s
call fcn.00457270
add esp, 8
push 0x4e8430
push str.InitPathVar_____DOCUMENTS_USER__s
call fcn.00457270
add esp, 8
push 0x4e8228
push str.InitPathVar_____DOCUMENTS_ALLUSERS__s
call fcn.00457270
add esp, 8
push 0x4e8638
push str.InitPathVar_____DESKTOP_USER__s
call fcn.00457270
add esp, 8
push 0x4e8840
push str.InitPathVar_____DESKTOP_ALLUSERS__s
call fcn.00457270
add esp, 8
push 0x4e5fa0
push str.InitPathVar_____DOWNLOAD_USER__s
call fcn.00457270
add esp, 8
push 0x4e61a8
push str.InitPathVar_____DOWNLOAD_ALLUSERS__s
call fcn.00457270
add esp, 8
push 0x4dba10
push str.InitPathVar____ModuleFile_s
call fcn.00457270
add esp, 8
push 0x4db808
push str.InitPathVar____ModulePath_s
call fcn.00457270
add esp, 8
push 0x4dbc18
push str.InitPathVar____ModuleFileName_s
call fcn.00457270
add esp, 8
push 0x4dbe20
push str.InitPathVar____ConfigFile_s
call fcn.00457270
add esp, 8
mov esp, ebp
pop ebp
ret