Function at 0x449ba0
Capabilities:
Get common file path

Disassembly:
mov eax, 0x180c
call fcn.004af740
mov eax, dword [0x4d88f0]
xor eax, esp
mov dword [esp + 0x1808], eax
push ebp
mov ebp, dword [esp + 0x1814]
push esi
push edi
mov edi, ecx
mov ecx, 0x4c5b28
mov eax, ebp
jmp 0x449bd0
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x449bf6
test dx, dx
je 0x449bf2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x449bf6
add eax, 4
add ecx, 4
test dx, dx
jne 0x449bd0
xor eax, eax
jmp 0x449bfb
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
sete al
cmp byte [edi + 0x81a], 0
mov byte [esp + 0xf], al
je 0x449c6a
xor esi, esi
test al, al
je 0x449c18
mov esi, 1
mov ecx, 0x4c5884
mov eax, ebp
nop
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x449c46
test dx, dx
je 0x449c42
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x449c46
add eax, 4
add ecx, 4
test dx, dx
jne 0x449c20
xor eax, eax
jmp 0x449c4b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x449c55
mov esi, dword [edi + 0x91c]
test esi, esi
je 0x449c6a
push 0
push esi
mov ecx, edi
call fcn.00445510
push 0
jmp 0x449e72
mov byte [edi + 0x81a], 0
cmp byte [0x519779], 0
je 0x449d8a
push 0
push 0x4c6a78
push str.FileList
call fcn.0045fc40
test eax, eax
je 0x449c9e
cmp byte [esp + 0xf], 0
je 0x449e79
push 0x400
lea eax, [esp + 0x1018]
push eax
mov ecx, 0x5209d0
call fcn.004131e0
mov ecx, 0x4c5884
mov eax, ebp
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x449ce6
test dx, dx
je 0x449ce2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x449ce6
add eax, 4
add ecx, 4
test dx, dx
jne 0x449cc0
xor eax, eax
jmp 0x449ceb
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x449d1d
push ebp
mov ecx, 0x5209d0
call fcn.004130c0
test al, al
je 0x449d1d
movzx ecx, byte [esp + 0xf]
neg ecx
sbb ecx, ecx
lea edx, [esp + 0x1014]
and ecx, edx
push ecx
mov ecx, edi
call fcn.00448e00
jmp 0x449e79
push 0x400
lea eax, [esp + 0x818]
push eax
mov ecx, 0x5209d0
call fcn.00413200
xor eax, eax
jmp 0x449d40
movzx ecx, word [esp + eax + 0x814]
mov word [esp + eax + 0x14], cx
add eax, 2
test cx, cx
jne 0x449d40
lea ecx, [esp + 0x14]
push ecx
call fcn.00455cc0
lea edx, [esp + 0x14]
push edx
call fcn.0048a790
mov ecx, edi
call fcn.00447da0
test al, al
je 0x449e79
lea eax, [esp + 0x814]
push eax
call fcn.00455740
jmp 0x449e71
push 0x400
lea ecx, [esp + 0x1018]
push ecx
call fcn.0048b890
cmp byte [esp + 0xf], 0
je 0x449e53
xor eax, eax
lea esp, [esp]
movzx ecx, word [esp + eax + 0x1014]
mov word [esp + eax + 0x14], cx
add eax, 2
test cx, cx
jne 0x449db0
lea edx, [esp + 0x814]
push edx
lea eax, [esp + 0x18]
push eax
call fcn.00456b30
lea ecx, [esp + 0x14]
push ecx
call fcn.004550c0
lea edx, [esp + 0x814]
push edx
call fcn.004550c0
lea eax, [esp + 0x814]
push eax
lea ecx, [esp + 0x18]
push ecx
call fcn.00476b80
test eax, eax
jne 0x449e53
cmp dword [edi + 0x91c], eax
jle 0x449e16
mov byte [edi + 0x81a], 1
push eax
jmp 0x449e72
mov eax, dword [edi]
lea edx, [esp + 0x10]
push edx
push 0x11
push eax
mov dword [esp + 0x1c], 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
mov ecx, dword [esp + 0x10]
push ecx
mov ecx, 0x5200a8
call fcn.004462c0
mov eax, dword [0x53dddc]
mov ecx, dword [esp + 0x10]
mov edx, dword [eax]
mov edx, dword [edx + 0x14]
push ecx
push eax
call edx
push 0
jmp 0x449e72
push ebp
call fcn.0048a790
cmp byte [esp + 0xf], 0
je 0x449e6f
lea eax, [esp + 0x1014]
push eax
call fcn.00455740
jmp 0x449e71
xor eax, eax
push eax
mov ecx, edi
call fcn.00448520
mov ecx, dword [esp + 0x1814]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.004af72c
add esp, 0x180c
ret 4