Function at 0x428590
Capabilities:
Get common file path
Get program files directory

Disassembly:
push 0xffffffffffffffff
mov eax, dword fs:[0]
push 0x459fca
push eax
mov eax, 0x144c
mov dword fs:[0], esp
call fcn.00457870
push ebx
push ebp
mov ebp, dword [esp + 0x1464]
push esi
push edi
mov eax, dword [ebp]
mov ecx, dword [eax - 8]
test ecx, ecx
je 0x42942a
mov ecx, dword [0x4631a0]
mov dword [esp + 0x18], ecx
mov ecx, dword [0x466e58]
mov eax, dword [0x466e54]
mov edx, dword [str.CLSID:]
mov dword [esp + 0x44], ecx
mov ebx, 6
mov dword [esp + 0x40], eax
mov eax, dword [ebp]
lea ecx, [esp + 0x3c]
mov dword [esp + 0x3c], edx
mov dx, word [0x466e5c]
push ebx
push ecx
push eax
mov dword [esp + 0x1470], 0
mov word [esp + 0x54], dx
call dword [sym.imp.SHLWAPI.dll_StrCmpNIW]
test eax, eax
jne 0x42886f
mov edx, dword [ebp]
mov ecx, ebp
mov eax, dword [edx - 8]
add eax, 0xfffffffa
push eax
lea eax, [esp + 0x14]
push eax
call fcn.0040c6b0
mov ecx, dword [eax]
lea edx, [esp + 0x254]
push ecx
push str.CLSID_sInprocServer32
push 0x208
push edx
mov byte [esp + 0x1474], 1
call fcn.00429450
mov eax, dword [esp + 0x20]
mov edx, dword [0x4631a4]
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
add esp, 0x10
lea ecx, [eax - 0xc]
mov byte [esp + 0x1464], 0
cmp ecx, edx
je 0x428697
add eax, 0xfffffff4
push eax
call edi
test eax, eax
jg 0x428697
mov edx, dword [esp + 0x10]
lea eax, [edx - 0xc]
push eax
call fcn.0044bf22
add esp, 4
mov eax, dword [esp + 0x1470]
push eax
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push 0x468b0c
call fcn.004171e0
push ecx
lea edx, [esp + 0x260]
mov ecx, esp
mov dword [esp + 0x20], esp
push edx
mov byte [esp + 0x1474], 2
call fcn.004171e0
push SysReAllocString
lea ecx, [esp + 0x38]
mov byte [esp + 0x1474], 0
call fcn.00421240
lea ecx, [esp + 0x14]
lea edx, [esp + 0x45c]
push ecx
lea ecx, [esp + 0x14]
push edx
push ecx
push eax
mov byte [esp + 0x1474], 3
mov dword [esp + 0x24], 0x1000
call fcn.00429560
add esp, 0x10
test eax, eax
je 0x428737
mov eax, dword [esp + 0x10]
cmp eax, 2
je 0x42871f
cmp eax, 1
jne 0x428737
lea edx, [esp + 0x45c]
lea ecx, [esp + 0x18]
push edx
call fcn.00405430
mov esi, 1
jmp 0x428739
xor esi, esi
lea ecx, [esp + 0x30]
mov byte [esp + 0x1464], 0
call fcn.00401c80
lea ecx, [esp + 0x2c]
call fcn.00401c80
test esi, esi
je 0x428837
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
test eax, eax
je 0x428837
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0x10]
sub eax, edx
sar eax, 1
push eax
push ecx
lea ecx, [esp + 0x20]
call fcn.00419850
mov esi, eax
mov ecx, dword [ebp]
mov eax, dword [esi]
cmp ecx, eax
mov byte [esp + 0x1464], 4
je 0x4287d7
mov edx, dword [ecx - 0xc]
test edx, edx
jge 0x4287ac
mov edx, dword [0x4631a4]
add ecx, 0xfffffff4
cmp ecx, edx
jne 0x4287b3
mov ecx, dword [eax - 0xc]
test ecx, ecx
jge 0x4287c1
mov edx, dword [eax - 8]
push eax
push edx
mov ecx, ebp
call fcn.00408770
jmp 0x4287d7
mov ecx, ebp
call fcn.00405b60
mov esi, dword [esi]
mov dword [ebp], esi
add esi, 0xfffffff4
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov eax, dword [esp + 0x10]
mov edx, dword [0x4631a4]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x428802
add eax, 0xfffffff4
push eax
call edi
test eax, eax
jg 0x428802
mov edx, dword [esp + 0x10]
add edx, 0xfffffff4
push edx
call fcn.0044bf22
add esp, 4
mov eax, dword [esp + 0x18]
mov edx, dword [0x4631a4]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x42882d
add eax, 0xfffffff4
push eax
call edi
test eax, eax
jg 0x42882d
mov edx, dword [esp + 0x18]
add edx, 0xfffffff4
push edx
call fcn.0044bf22
add esp, 4
mov eax, 1
jmp 0x42942c
mov eax, dword [esp + 0x18]
mov edx, dword [0x4631a4]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x42942a
add eax, 0xfffffff4
push eax
call edi
test eax, eax
jg 0x42942a
mov edx, dword [esp + 0x18]
add edx, 0xfffffff4
push edx
call fcn.0044bf22
add esp, 4
jmp 0x42942a
mov al, byte [0x468fb8]
test al, 1
jne 0x4288a2
or al, 1
lea ecx, [esp + 0x26]
mov byte [0x468fb8], al
lea eax, [esp + 0x27]
push eax
push 0
push ecx
mov ecx, 0x468fc0
call fcn.0042fc70
push 0x429780
call fcn.0045782c
add esp, 4
mov al, byte [0x468da8]
test al, al
jne 0x429386
lea edx, [esp + 0x254]
push 0x104
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea eax, [esp + 0x254]
push eax
call dword [sym.imp.SHLWAPI.dll_PathStripToRootW]
mov ecx, dword [0x4631a0]
mov ebp, dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edx, str.systemroot
mov dword [esp + 0x10], ecx
test edx, edx
je 0x428939
mov eax, edx
shr eax, 0x10
jne 0x428903
xor eax, eax
mov ecx, edx
mov ax, cx
lea ecx, [esp + 0x10]
push eax
call fcn.00405950
jmp 0x428939
push str.systemroot
call ebp
mov esi, eax
test esi, esi
je 0x428939
push esi
lea ecx, [esp + 0x14]
call fcn.00404720
test eax, eax
je 0x428939
mov ecx, dword [esp + 0x10]
lea edx, [esi + esi]
push edx
lea eax, [esi + esi + 2]
push str.systemroot
push eax
push ecx
call fcn.00401bc0
add esp, 0x10
mov edx, dword [0x4631a0]
mov dword [esp + 0x14], edx
lea eax, [esp + 0x14]
lea ecx, [esp + 0x10]
push eax
push ecx
lea ecx, [esp + 0x24]
mov byte [esp + 0x146c], bl
call fcn.0042fcf0
lea edx, [esp + 0x28]
push eax
push edx
mov ecx, 0x468fc0
mov byte [esp + 0x146c], 7
call fcn.0042fb70
mov esi, dword [eax]
lea ecx, [esp + 0x1c]
mov byte [esp + 0x1464], bl
call fcn.0042f920
lea ecx, [esp + 0x14]
mov byte [esp + 0x1464], 5
call fcn.00401c80
lea eax, [esp + 0x254]
add esi, 0x10
test eax, eax
je 0x4289b0
lea ecx, [esp + 0x254]
push ecx
call ebp
lea edx, [esp + 0x254]
mov ecx, esi
push edx
push eax
call fcn.00408770
mov eax, dword [esp + 0x10]
mov edx, dword [0x4631a4]
mov byte [esp + 0x1464], 0
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x4289f7
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x4289f7
mov edx, dword [esp + 0x10]
lea eax, [edx - 0xc]
push eax
call fcn.0044bf22
add esp, 4
mov ebx, 0x45c8d8
mov eax, dword [ebx + 4]
push 0
lea ecx, [esp + 0x50]
push eax
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x428b29
mov esi, dword [ebx]
mov edx, dword [0x4631a0]
test esi, esi
mov dword [esp + 0x10], edx
je 0x428a6e
mov eax, esi
shr eax, 0x10
jne 0x428a40
and esi, 0xffff
lea ecx, [esp + 0x10]
push esi
call fcn.00405950
jmp 0x428a6e
push esi
call ebp
mov edi, eax
test edi, edi
je 0x428a6e
push edi
lea ecx, [esp + 0x14]
call fcn.00404720
test eax, eax
je 0x428a6e
mov eax, dword [esp + 0x10]
lea ecx, [edi + edi]
push ecx
lea edx, [edi + edi + 2]
push esi
push edx
push eax
call fcn.00401bc0
add esp, 0x10
mov ecx, dword [0x4631a0]
mov dword [esp + 0x14], ecx
lea edx, [esp + 0x14]
lea eax, [esp + 0x10]
push edx
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0x146c], 9
call fcn.0042fcf0
lea ecx, [esp + 0x28]
push eax
push ecx
mov ecx, 0x468fc0
mov byte [esp + 0x146c], 0xa
call fcn.0042fb70
mov esi, dword [eax]
lea ecx, [esp + 0x1c]
mov byte [esp + 0x1464], 9
call fcn.0042f920
lea ecx, [esp + 0x14]
mov byte [esp + 0x1464], 8
call fcn.00401c80
lea edx, [esp + 0x4c]
add esi, 0x10
test edx, edx
jne 0x428ade
xor eax, eax
jmp 0x428ae5
lea eax, [esp + 0x4c]
push eax
call ebp
lea ecx, [esp + 0x4c]
push ecx
push eax
mov ecx, esi
call fcn.00408770
mov eax, dword [esp + 0x10]
mov ecx, dword [0x4631a4]
mov byte [esp + 0x1464], 0
lea edx, [eax - 0xc]
cmp edx, ecx
je 0x428b29
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x428b29
mov eax, dword [esp + 0x10]
add eax, 0xfffffff4
push eax
call fcn.0044bf22
add esp, 4
add ebx, 8
cmp ebx, 0x45c9a8
jb 0x4289fc
mov eax, dword [0x468d48]
test eax, eax
je 0x428dcc
push 0
lea ecx, [esp + 0x50]
push 0x26
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x428dcc
lea edx, [esp + 0x4c]
push edx
call dword [sym.imp.MSVCRT.dll_wcslen]
lea esi, [esp + eax*2 + 0x44]
push str.__x86_
push esi
call dword [sym.imp.MSVCRT.dll__wcsicmp]
add esp, 0xc
test eax, eax
jne 0x428dcc
mov word [esi], ax
mov eax, dword [0x4631a0]
mov ecx, str.programfiles_x64_
mov dword [esp + 0x10], eax
test ecx, ecx
je 0x428be7
mov edx, ecx
shr edx, 0x10
jne 0x428bb1
xor eax, eax
mov ax, cx
lea ecx, [esp + 0x10]
push eax
call fcn.00405950
jmp 0x428be7
push str.programfiles_x64_
call ebp
mov esi, eax
test esi, esi
je 0x428be7
push esi
lea ecx, [esp + 0x14]
call fcn.00404720
test eax, eax
je 0x428be7
mov ecx, dword [esp + 0x10]
lea edx, [esi + esi]
push edx
lea eax, [esi + esi + 2]
push str.programfiles_x64_
push eax
push ecx
call fcn.00401bc0
add esp, 0x10
mov edx, dword [0x4631a0]
mov dword [esp + 0x14], edx
lea eax, [esp + 0x14]
lea ecx, [esp + 0x10]
push eax
mov bl, 0xc
push ecx
lea ecx, [esp + 0x24]
mov byte [esp + 0x146c], bl
call fcn.0042fcf0
lea edx, [esp + 0x28]
push eax
push edx
mov ecx, 0x468fc0
mov byte [esp + 0x146c], 0xd
call fcn.0042fb70
mov esi, dword [eax]
lea ecx, [esp + 0x1c]
mov byte [esp + 0x1464], bl
call fcn.0042f920
lea ecx, [esp + 0x14]
mov byte [esp + 0x1464], 0xb
call fcn.00401c80
lea eax, [esp + 0x4c]
add esi, 0x10
test eax, eax
je 0x428c5a
lea ecx, [esp + 0x4c]
push ecx
call ebp
lea edx, [esp + 0x4c]
mov ecx, esi
push edx
push eax
call fcn.00408770
mov eax, dword [esp + 0x10]
mov edx, dword [0x4631a4]
mov byte [esp + 0x1464], 0
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x428c9e
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x428c9e
mov edx, dword [esp + 0x10]
lea eax, [edx - 0xc]
push eax
call fcn.0044bf22
add esp, 4
push str.Common_Files
lea eax, [esp + 0x50]
push 0x104
push eax
call fcn.004294c0
mov ecx, dword [0x4631a0]
mov edx, str.commonfiles_x64_
test edx, edx
mov dword [esp + 0x10], ecx
je 0x428d15
mov eax, edx
shr eax, 0x10
jne 0x428cdf
xor eax, eax
mov ecx, edx
mov ax, cx
lea ecx, [esp + 0x10]
push eax
call fcn.00405950
jmp 0x428d15
push str.commonfiles_x64_
call ebp
mov esi, eax
test esi, esi
je 0x428d15
push esi
lea ecx, [esp + 0x14]
call fcn.00404720
test eax, eax
je 0x428d15
mov ecx, dword [esp + 0x10]
lea edx, [esi + esi]
push edx
lea eax, [esi + esi + 2]
push str.commonfiles_x64_
push eax
push ecx
call fcn.00401bc0
add esp, 0x10
mov edx, dword [0x4631a0]
mov dword [esp + 0x14], edx
lea eax, [esp + 0x14]
lea ecx, [esp + 0x10]
push eax
mov bl, 0xf
push ecx
lea ecx, [esp + 0x24]
mov byte [esp + 0x146c], bl
call fcn.0042fcf0
lea edx, [esp + 0x28]
push eax
push edx
mov ecx, 0x468fc0
mov byte [esp + 0x146c], 0x10
call fcn.0042fb70
mov esi, dword [eax]
lea ecx, [esp + 0x1c]
mov byte [esp + 0x1464], bl
call fcn.0042f920
lea ecx, [esp + 0x14]
mov byte [esp + 0x1464], 0xe
call fcn.00401c80
lea eax, [esp + 0x4c]
add esi, 0x10
test eax, eax
je 0x428d88
lea ecx, [esp + 0x4c]
push ecx
call ebp
lea edx, [esp + 0x4c]
mov ecx, esi
push edx
push eax
call fcn.00408770
mov eax, dword [esp + 0x10]
mov edx, dword [0x4631a4]
mov byte [esp + 0x1464], 0
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x428dcc
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x428dcc
mov edx, dword [esp + 0x10]
lea eax, [edx - 0xc]
push eax
call fcn.0044bf22
add esp, 4
push 0
lea eax, [esp + 0x50]
push 0x2b
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x4291da
lea ecx, [esp + 0x4c]
lea edx, [esp + 0x18]
push ecx
push str._sMicrosoft_SharedOFFICE9
push edx
call fcn.004076f0
mov eax, dword [esp + 0x24]
mov ebp, dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
add esp, 0xc
push eax
call ebp
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
test eax, eax
je 0x428f64
mov ecx, dword [0x4631a0]
mov edx, str._office2000commdir_
test edx, edx
mov dword [esp + 0x10], ecx
je 0x428e7e
mov eax, edx
shr eax, 0x10
jne 0x428e44
xor eax, eax
mov ecx, edx
mov ax, cx
lea ecx, [esp + 0x10]
push eax
call fcn.00405950
jmp 0x428e7e
push str._office2000commdir_
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, eax
test esi, esi
je 0x428e7e
push esi
lea ecx, [esp + 0x14]
call fcn.00404720
test eax, eax
je 0x428e7e
mov ecx, dword [esp + 0x10]
lea edx, [esi + esi]
push edx
lea eax, [esi + esi + 2]
push str._office2000commdir_
push eax
push ecx
call fcn.00401bc0
add esp, 0x10
mov edx, dword [0x4631a0]
mov dword [esp + 0x14], edx
lea eax, [esp + 0x14]
lea ecx, [esp + 0x10]
push eax
mov bl, 0x12
push ecx
lea ecx, [esp + 0x24]
mov byte [esp + 0x146c], bl
call fcn.0042fcf0
lea edx, [esp + 0x28]
push eax
push edx
mov ecx, 0x468fc0
mov byte [esp + 0x146c], 0x13
call fcn.0042fb70
mov esi, dword [eax]
lea ecx, [esp + 0x1c]
mov byte [esp + 0x1464], bl
call fcn.0042f920
lea ecx, [esp + 0x14]
mov byte [esp + 0x1464], 0x11
call fcn.00401c80
mov eax, dword [esi + 0x10]
mov ecx, dword [esp + 0x18]
add esi, 0x10
cmp eax, ecx
je 0x428f2d
mov edx, dword [eax - 0xc]
test edx, edx
jge 0x428f01
mov edx, dword [0x4631a4]
add eax, 0xfffffff4
cmp eax, edx
jne 0x428f08
mov eax, dword [ecx - 0xc]
test eax, eax
jge 0x428f16
mov eax, dword [ecx - 8]
push ecx
push eax
mov ecx, esi
call fcn.00408770
jmp 0x428f2d
mov ecx, esi
call fcn.00405b60
mov ecx, dword [esp + 0x18]
mov dword [esi], ecx
mov edx, dword [esp + 0x18]
add edx, 0xfffffff4
push edx
call edi
mov eax, dword [esp + 0x10]
mov edx, dword [0x4631a4]
mov byte [esp + 0x1464], 0
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x428f64
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x428f64
mov edx, dword [esp + 0x10]
lea eax, [edx - 0xc]
push eax
call fcn.0044bf22
add esp, 4
lea eax, [esp + 0x4c]
lea ecx, [esp + 0x18]
push eax
push str._sMicrosoft_SharedOFFICE10
push ecx
call fcn.004076f0
mov edx, dword [esp + 0x24]
add esp, 0xc
push edx
call ebp
test eax, eax
je 0x4290ae
mov eax, dword [0x4631a0]
mov ecx, str._office2002commdir_
test ecx, ecx
mov dword [esp + 0x10], eax
je 0x428fee
mov edx, ecx
shr edx, 0x10
jne 0x428fb4
xor eax, eax
mov ax, cx
lea ecx, [esp + 0x10]
push eax
call fcn.00405950
jmp 0x428fee
push str._office2002commdir_
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, eax
test esi, esi
je 0x428fee
push esi
lea ecx, [esp + 0x14]
call fcn.00404720
test eax, eax
je 0x428fee
mov ecx, dword [esp + 0x10]
lea edx, [esi + esi]
push edx
lea eax, [esi + esi + 2]
push str._office2002commdir_
push eax
push ecx
call fcn.00401bc0
add esp, 0x10
mov edx, dword [0x4631a0]
mov dword [esp + 0x14], edx
lea eax, [esp + 0x14]
lea ecx, [esp + 0x10]
push eax
mov bl, 0x15
push ecx
lea ecx, [esp + 0x24]
mov byte [esp + 0x146c], bl
call fcn.0042fcf0
lea edx, [esp + 0x28]
push eax
push edx
mov ecx, 0x468fc0
mov byte [esp + 0x146c], 0x16
call fcn.0042fb70
mov esi, dword [eax]
lea ecx, [esp + 0x1c]
mov byte [esp + 0x1464], bl
call fcn.0042f920
lea ecx, [esp + 0x14]
mov byte [esp + 0x1464], 0x14
call fcn.00401c80
mov eax, dword [esi + 0x10]
mov ecx, dword [esp + 0x18]
add esi, 0x10
cmp eax, ecx
je 0x42909d
mov edx, dword [eax - 0xc]
test edx, edx
jge 0x429071
mov edx, dword [0x4631a4]
add eax, 0xfffffff4
cmp eax, edx
jne 0x429078
mov eax, dword [ecx - 0xc]
test eax, eax
jge 0x429086
mov eax, dword [ecx - 8]
push ecx
push eax
mov ecx, esi
call fcn.00408770
jmp 0x42909d
mov ecx, esi
call fcn.00405b60
mov ecx, dword [esp + 0x18]
mov dword [esi], ecx
mov edx, dword [esp + 0x18]
add edx, 0xfffffff4
push edx
call edi
lea ecx, [esp + 0x10]
mov byte [esp + 0x1464], 0
call fcn.00401c80
lea eax, [esp + 0x4c]
lea ecx, [esp + 0x18]
push eax
push str._sMicrosoft_SharedOFFICE11
push ecx
call fcn.004076f0
mov edx, dword [esp + 0x24]
add esp, 0xc
push edx
call ebp
test eax, eax
je 0x429112
push str._office2003commdir_
lea ecx, [esp + 0x18]
call fcn.004171e0
lea eax, [esp + 0x18]
lea ecx, [esp + 0x14]
push eax
push ecx
mov ecx, 0x468fc0
mov byte [esp + 0x146c], 0x17
call fcn.0042f5e0
mov ecx, eax
call fcn.00409c90
lea ecx, [esp + 0x14]
mov byte [esp + 0x1464], 0
call fcn.00401c80
lea edx, [esp + 0x4c]
lea eax, [esp + 0x18]
push edx
push str._sMicrosoft_SharedOFFICE12
push eax
call fcn.004076f0
mov ecx, dword [esp + 0x24]
add esp, 0xc
push ecx
call ebp
test eax, eax
je 0x429176
push str._office2007commdir_
lea ecx, [esp + 0x18]
call fcn.004171e0
lea edx, [esp + 0x18]
lea eax, [esp + 0x14]
push edx
push eax
mov ecx, 0x468fc0
mov byte [esp + 0x146c], 0x18
call fcn.0042f5e0
mov ecx, eax
call fcn.00409c90
lea ecx, [esp + 0x14]
mov byte [esp + 0x1464], 0
call fcn.00401c80
lea ecx, [esp + 0x4c]
lea edx, [esp + 0x18]
push ecx
push str._sMicrosoft_SharedOFFICE14
push edx
call fcn.004076f0
mov eax, dword [esp + 0x24]
add esp, 0xc
push eax
call ebp
test eax, eax
je 0x4291da
push str._office2010commdir_
lea ecx, [esp + 0x18]
call fcn.004171e0
lea ecx, [esp + 0x18]
lea edx, [esp + 0x14]
push ecx
push edx
mov ecx, 0x468fc0
mov byte [esp + 0x146c], 0x19
call fcn.0042f5e0
mov ecx, eax
call fcn.00409c90
lea ecx, [esp + 0x14]
mov byte [esp + 0x1464], 0
call fcn.00401c80
mov edi, 0x45c720
mov bl, 0x1b
lea eax, [esp + 0x18]
push eax
push 0
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push str.Path
call fcn.004171e0
mov edx, dword [edi + 4]
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push edx
mov byte [esp + 0x1478], 0x1a
call fcn.004171e0
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [esp + 0x3c]
mov byte [esp + 0x1478], 0
call fcn.00421240
push eax
mov byte [esp + 0x146c], bl
call fcn.004295d0
add esp, 8
lea ecx, [esp + 0x30]
mov esi, eax
mov byte [esp + 0x1464], 0
call fcn.00401c80
lea ecx, [esp + 0x2c]
call fcn.00401c80
test esi, esi
je 0x4292b7
mov ecx, dword [esp + 0x18]
mov eax, dword [ecx - 8]
test eax, eax
jle 0x4292b7
cmp word [ecx + eax*2 - 2], 0x5c
jne 0x429277
dec eax
push 1
push eax
lea ecx, [esp + 0x20]
call fcn.0040c9e0
mov eax, dword [edi]
lea ecx, [esp + 0x14]
push eax
call fcn.004171e0
lea ecx, [esp + 0x18]
lea edx, [esp + 0x14]
push ecx
push edx
mov ecx, 0x468fc0
mov byte [esp + 0x146c], 0x1c
call fcn.0042f5e0
mov ecx, eax
call fcn.00409c90
lea ecx, [esp + 0x14]
mov byte [esp + 0x1464], 0
call fcn.00401c80
add edi, 8
cmp edi, 0x45c8d8
jb 0x4291e1
mov eax, dword [0x468d4c]
test eax, eax
je 0x429378
mov esi, dword [0x468fd0]
push 0x85
lea ecx, [esp + 0x20]
call fcn.004171e0
mov eax, dword [eax]
push esi
push eax
lea eax, [esp + 0x1c]
push eax
mov byte [esp + 0x1470], 0x1d
call fcn.00421b40
add esp, 0xc
lea ecx, [esp + 0x14]
call fcn.00401c80
lea ecx, [esp + 0x1c]
mov byte [esp + 0x1464], 0
call fcn.00401c80
lea ecx, [esp + 0x10]
push ecx
mov ecx, 0x468fc0
call fcn.0042fce0
mov eax, dword [esp + 0x10]
mov ecx, dword [0x468fc4]
cmp eax, ecx
je 0x429378
mov edx, dword [eax + 0x10]
mov eax, dword [eax + 0xc]
push edx
push eax
lea ecx, [esp + 0x24]
push str._t_s:_t_s_n
push ecx
call fcn.00421b40
add esp, 0x10
lea ecx, [esp + 0x1c]
call fcn.00401c80
lea edx, [esp + 0x14]
push 0
push edx
lea ecx, [esp + 0x18]
call fcn.0042f7d0
mov eax, dword [esp + 0x10]
mov ecx, dword [0x468fc4]
cmp eax, ecx
jne 0x429337
mov ebp, dword [esp + 0x146c]
mov byte [0x468da8], 1
mov ecx, ebp
call fcn.00408830
mov eax, dword [ebp]
push eax
call dword [sym.imp.USER32.dll_CharLowerW]
mov eax, dword [0x468d48]
test eax, eax
je 0x4293e8
mov eax, dword [esp + 0x1470]
test eax, eax
je 0x4293e8
mov eax, dword [ebp]
mov esi, dword [sym.imp.MSVCRT.dll__wcsicmp]
push str.programfiles
push eax
call esi
add esp, 8
test eax, eax
jne 0x4293ca
push str.programfiles_x64_
jmp 0x4293e1
mov eax, dword [ebp]
push str.commonfiles
push eax
call esi
add esp, 8
test eax, eax
jne 0x4293e8
push str.commonfiles_x64_
mov ecx, ebp
call fcn.00405430
lea ecx, [esp + 0x38]
push ebp
push ecx
mov ecx, 0x468fc0
call fcn.0042f740
mov eax, dword [esp + 0x38]
mov ecx, dword [0x468fc4]
cmp eax, ecx
je 0x429421
add eax, 0x10
mov ecx, ebp
push eax
call fcn.00409c90
lea ecx, [esp + 0x18]
call fcn.00401c80
mov eax, 1
jmp 0x42942c
lea ecx, [esp + 0x18]
call fcn.00401c80
xor eax, eax
mov ecx, dword [esp + 0x145c]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x1458
ret