Function at 0x4e01b0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x6dc0b8]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
mov ebx, dword [sym.imp.SHELL32.dll_SHGetFolderLocation]
lea eax, [ebp - 0x218]
push esi
push edi
push eax
push 0
push 0
push 3
push 0
mov esi, edx
mov dword [ebp - 0x218], 0
mov edi, ecx
call ebx
push 1
push ecx
mov ecx, dword [ebp - 0x218]
lea edx, [ebp - 0x214]
call fcn.004dffd0
add esp, 8
push dword [ebp - 0x218]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
push edi
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x4e0271
mov dword [ebp - 0x21c], eax
lea eax, [ebp - 0x21c]
push eax
push 0
push 0
push 3
push 0
call ebx
test eax, eax
js 0x4e025e
push 0x8000
push ecx
mov ecx, dword [ebp - 0x21c]
mov edx, esi
call fcn.004dffd0
mov eax, dword [sym.imp.ole32.dll_CoTaskMemFree]
add esp, 8
push dword [ebp - 0x21c]
call eax
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00545b50
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x218]
push eax
push 0
push 0
push 0xa
push 0
call ebx
push 1
push ecx
mov ecx, dword [ebp - 0x218]
lea edx, [ebp - 0x214]
call fcn.004dffd0
mov eax, dword [sym.imp.ole32.dll_CoTaskMemFree]
add esp, 8
push dword [ebp - 0x218]
call eax
push edi
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x4e0308
mov dword [ebp - 0x21c], eax
lea eax, [ebp - 0x21c]
push eax
push 0
push 0
push 0xa
push 0
call ebx
test eax, eax
js 0x4e025e
push 0x8000
push ecx
mov ecx, dword [ebp - 0x21c]
mov edx, esi
call fcn.004dffd0
add esp, 8
push dword [ebp - 0x21c]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00545b50
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x218]
push eax
push 0
push 0
push 0x11
push 0
call ebx
push 1
push ecx
mov ecx, dword [ebp - 0x218]
lea edx, [ebp - 0x214]
call fcn.004dffd0
add esp, 8
push dword [ebp - 0x218]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
push edi
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x4e03a2
mov dword [ebp - 0x21c], eax
lea eax, [ebp - 0x21c]
push eax
push 0
push 0
push 0x11
push 0
call ebx
test eax, eax
js 0x4e025e
push 0x8000
push ecx
mov ecx, dword [ebp - 0x21c]
mov edx, esi
call fcn.004dffd0
add esp, 8
push dword [ebp - 0x21c]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00545b50
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x218]
push eax
push 0
push 0
push 0x12
push 0
call ebx
push 1
push ecx
mov ecx, dword [ebp - 0x218]
lea edx, [ebp - 0x214]
call fcn.004dffd0
add esp, 8
push dword [ebp - 0x218]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
push edi
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x4e040e
push 0x8000
push ecx
mov edx, esi
lea ecx, [eax + 0x12]
call fcn.004e0070
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00545b50
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x218]
push eax
push 0
push 0
push 0x31
push 0
call ebx
push 1
push ecx
mov ecx, dword [ebp - 0x218]
lea edx, [ebp - 0x214]
call fcn.004dffd0
add esp, 8
push dword [ebp - 0x218]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
push edi
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x4e047a
push 0x8000
push ecx
mov edx, esi
lea ecx, [eax + 0x31]
call fcn.004e0070
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00545b50
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x218]
push eax
push 0
push 0
push 4
push 0
call ebx
push 1
push ecx
mov ecx, dword [ebp - 0x218]
lea edx, [ebp - 0x214]
call fcn.004dffd0
add esp, 8
push dword [ebp - 0x218]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
push edi
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x4e04e6
push 0x8000
push ecx
mov edx, esi
lea ecx, [eax + 4]
call fcn.004e0070
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00545b50
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x218]
push eax
push 0
push 0
push 6
push 0
call ebx
push 1
push ecx
mov ecx, dword [ebp - 0x218]
lea edx, [ebp - 0x214]
call fcn.004dffd0
add esp, 8
push dword [ebp - 0x218]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
push edi
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x4e0552
push 0x8000
push ecx
mov edx, esi
lea ecx, [eax + 6]
call fcn.004e0070
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00545b50
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x218]
push eax
push 0
push 0
push 0x27
push 0
call ebx
push 1
push ecx
mov ecx, dword [ebp - 0x218]
lea edx, [ebp - 0x214]
call fcn.004dffd0
add esp, 8
push dword [ebp - 0x218]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
push edi
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x4e05c0
push 0x8000
push ecx
mov edx, esi
mov ecx, 0x27
call fcn.004e0070
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00545b50
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x218]
push eax
push 0
push 0
push 0xd
push 0
call ebx
push 1
push ecx
mov ecx, dword [ebp - 0x218]
lea edx, [ebp - 0x214]
call fcn.004dffd0
add esp, 8
push dword [ebp - 0x218]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
push edi
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x4e062e
push 0x8000
push ecx
mov edx, esi
mov ecx, 0xd
call fcn.004e0070
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00545b50
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x218]
push eax
push 0
push 0
push 0xe
push 0
call ebx
push 1
push ecx
mov ecx, dword [ebp - 0x218]
lea edx, [ebp - 0x214]
call fcn.004dffd0
add esp, 8
push dword [ebp - 0x218]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
push edi
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x4e069c
push 0x8000
push ecx
mov edx, esi
mov ecx, 0xe
call fcn.004e0070
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00545b50
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x218]
push eax
push 0
push 0
push 5
push 0
call ebx
push 1
push ecx
mov ecx, dword [ebp - 0x218]
lea edx, [ebp - 0x214]
call fcn.004dffd0
add esp, 8
push dword [ebp - 0x218]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
push edi
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x4e070a
push 0x8000
push ecx
mov edx, esi
mov ecx, 5
call fcn.004e0070
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00545b50
mov esp, ebp
pop ebp
ret
mov ebx, dword [sym.imp.KERNEL32.dll_CompareStringW]
push 0xffffffffffffffff
push edi
push 0xffffffffffffffff
push 0x6b60b8
push 1
push 0x7f
call ebx
cmp eax, 2
jne 0x4e074a
push 0x8000
push ecx
mov edx, esi
xor ecx, ecx
call fcn.004e0070
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00545b50
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
push edi
push 0xffffffffffffffff
push str.Pictures
push 1
push 0x7f
call ebx
cmp eax, 2
je 0x4e0598
push 0xffffffffffffffff
push edi
push 0xffffffffffffffff
push str.Music
push 1
push 0x7f
call ebx
cmp eax, 2
je 0x4e0606
push 0xffffffffffffffff
push edi
push 0xffffffffffffffff
push str.Videos
push 1
push 0x7f
call ebx
cmp eax, 2
je 0x4e0674
push 0xffffffffffffffff
push edi
push 0xffffffffffffffff
push str.Documents
push 1
push 0x7f
call ebx
cmp eax, 2
je 0x4e06e2
mov ecx, dword [ebp - 8]
mov eax, 0x80004005
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00545b50
mov esp, ebp
pop ebp
ret