Function at 0x41e6b0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x498488
mov eax, dword fs:[0]
push eax
sub esp, 0x58
mov eax, dword [0x4c606c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov dword [ebp - 0x48], ecx
lea eax, [ebp - 0x44]
mov dword [ebp - 0x44], 0
push eax
push 0
push 0
push 0x49e49c
call dword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
mov edi, eax
test edi, edi
jns 0x41e7bb
lea ecx, [ebp - 0x40]
call fcn.0044b850
mov dword [ebp - 4], 0
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x41e71d
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4ca1e0
call fcn.0040b1e0
add esp, 4
mov edx, str.d:jenkinsworkspace_a_mb4_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040a3c0
mov edx, 0x4adac4
mov ecx, eax
call fcn.0040a3c0
push 0x24a
mov ecx, eax
call fcn.00408a40
mov edx, 0x4adc00
mov ecx, eax
call fcn.0040a3c0
mov edx, str.Failed_to_get_program_files_folder:
mov ecx, eax
call fcn.0040a3c0
push edi
mov ecx, eax
call fcn.00413a80
push eax
call fcn.0040a730
mov edx, dword [ebp - 0x2c]
add esp, 4
cmp edx, 8
jb 0x41e7b4
mov ecx, dword [ebp - 0x40]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x41e7aa
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41eaa8
push edx
push ecx
call fcn.0045a3a4
add esp, 8
xor al, al
jmp 0x41ea8d
mov edx, dword [ebp - 0x44]
xor eax, eax
mov ecx, edx
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41e7d7
sub ecx, edi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x28]
call fcn.00407680
lea eax, [ebp - 0x44]
mov dword [ebp - 4], 1
push eax
mov ecx, 0x4c6c30
call fcn.004341e0
cmp byte [0x4cb658], 0
jne 0x41e90e
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0x18]
cmovae ecx, dword [ebp - 0x28]
push 6
push str.__x86_
push 0
call fcn.00435050
mov edi, eax
add esp, 0xc
cmp edi, 0xffffffff
je 0x41e90e
push edi
push 0
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x28]
call fcn.00414ac0
push 0xffffffffffffffff
lea eax, [edi + 6]
mov byte [ebp - 4], 2
push eax
lea eax, [ebp - 0x60]
push eax
lea ecx, [ebp - 0x28]
call fcn.00414ac0
mov byte [ebp - 4], 3
mov ecx, eax
cmp dword [eax + 0x14], 8
jb 0x41e86f
mov ecx, dword [eax]
push dword [eax + 0x10]
push ecx
lea ecx, [ebp - 0x40]
call fcn.00414d40
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x4c]
cmp edx, 8
jb 0x41e8b9
mov ecx, dword [ebp - 0x60]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x41e8af
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41eaad
push edx
push ecx
call fcn.0045a3a4
add esp, 8
cmp dword [ebp - 0x2c], 8
lea eax, [ebp - 0x40]
push dword [ebp - 0x30]
cmovae eax, dword [ebp - 0x40]
lea ecx, [ebp - 0x28]
push eax
call fcn.00407680
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x2c]
cmp edx, 8
jb 0x41e90e
mov ecx, dword [ebp - 0x40]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x41e904
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41eab2
push edx
push ecx
call fcn.0045a3a4
add esp, 8
lea eax, [ebp - 0x28]
mov ecx, esi
push eax
call fcn.004342a0
push 0x4af9e4
mov ecx, esi
call fcn.00434340
call fcn.0041d680
mov ecx, esi
test al, al
je 0x41e93c
push str.Anti_Ransomware
call fcn.00434340
jmp 0x41e946
push str.Anti_Malware
call fcn.00434340
push dword [ebp - 0x44]
mov edi, dword [sym.imp.ole32.dll_CoTaskMemFree]
call edi
lea eax, [ebp - 0x44]
mov dword [ebp - 0x44], 0
push eax
push 0
push 0
push 0x49e47c
call dword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
mov esi, eax
test esi, esi
jns 0x41ea25
lea ecx, [ebp - 0x60]
call fcn.0044b850
mov byte [ebp - 4], 4
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x41e98c
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4ca1e0
call fcn.0040b1e0
add esp, 4
mov edx, str.d:jenkinsworkspace_a_mb4_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040a3c0
mov edx, 0x4adac4
mov ecx, eax
call fcn.0040a3c0
push 0x268
mov ecx, eax
call fcn.00408a40
mov edx, 0x4adc00
mov ecx, eax
call fcn.0040a3c0
mov edx, str.Failed_to_get_data_directory:
mov ecx, eax
call fcn.0040a3c0
push esi
mov ecx, eax
call fcn.00413a80
push eax
call fcn.0040a730
mov edx, dword [ebp - 0x4c]
add esp, 4
cmp edx, 8
jb 0x41ea55
mov ecx, dword [ebp - 0x60]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x41ea19
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41eab7
push edx
push ecx
call fcn.0045a3a4
add esp, 8
jmp 0x41ea55
mov esi, dword [ebp - 0x44]
mov edx, esi
lea ecx, [edx + 2]
nop dword [eax]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x41ea30
sub edx, ecx
mov ecx, dword [ebp - 0x48]
sar edx, 1
push edx
push esi
call fcn.00407680
push dword [ebp - 0x44]
call edi
mov dword [ebp - 0x44], 0
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x41ea8b
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x41ea81
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41eabc
push edx
push ecx
call fcn.0045a3a4
add esp, 8
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00459e83
mov esp, ebp
pop ebp
ret
call fcn.004750dc
call fcn.004750dc
call fcn.004750dc
call fcn.004750dc
call fcn.004750dc
int3