Function at 0x487c80
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x4c32cc]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x4cd38c], 0
push esi
push edi
mov dword [ebp - 0x118], 0
je 0x487cad
call fcn.0048fcc0
cmp dword [0x4d2afc], 0
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x4cd38c], 0
mov dword [0x4d1bc0], 7
je 0x487d09
lea eax, [ebp - 0x118]
push str.KERNEL32.DLL
mov dword [ebp - 0x114], eax
call edi
mov esi, eax
test esi, esi
je 0x487d09
push str.Wow64DisableWow64FsRedirection
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x487d02
lea ecx, [ebp - 0x114]
push ecx
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 1
push 0
push 0
push 0x487110
push 0x4bcbd4
call fcn.00486f10
add esp, 0x14
push 0x104
lea edx, [ebp - 0x110]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x487d51
push 1
push 0
push 0
lea eax, [ebp - 0x110]
push 0x487110
push eax
call fcn.00486f10
add esp, 0x14
mov esi, dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x104
lea ecx, [ebp - 0x110]
push ecx
call esi
test eax, eax
je 0x487d83
push 1
push 0
push 1
lea edx, [ebp - 0x110]
push 0x487110
push edx
call fcn.00486f10
add esp, 0x14
push 0x104
push str.CommonFilesDir
push str.SOFTWAREMicrosoftWindowsCurrentVersion
lea ecx, [ebp - 0x110]
mov edx, 0x80000002
call fcn.0048e050
add esp, 0xc
test eax, eax
je 0x487dc3
push 1
push 0
push 1
lea eax, [ebp - 0x110]
push 0x487110
push eax
call fcn.00486f10
add esp, 0x14
lea ecx, [ebp - 0x110]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x487e14
lea edx, [ebp - 0x110]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp byte [ebp + eax - 0x111], 0x5c
lea eax, [ebp + eax - 0x111]
jne 0x487dfa
mov byte [eax], 0
push 1
push 0
push 1
lea eax, [ebp - 0x110]
push 0x487110
push eax
call fcn.00486f10
add esp, 0x14
cmp dword [0x4d2afc], 0
je 0x48801f
push 0x104
lea ecx, [ebp - 0x110]
push ecx
call esi
test eax, eax
je 0x487e8d
mov edx, 0x104
lea eax, [ebp - 0x110]
mov edi, edi
cmp byte [eax], 0
je 0x487e4b
inc eax
dec edx
jne 0x487e40
jmp 0x487e73
test edx, edx
je 0x487e73
mov ecx, 0x104
sub ecx, edx
mov eax, 0x104
sub eax, ecx
push str.SysWOW64
lea ecx, [ebp + ecx - 0x110]
mov edx, 0x7fffffff
call fcn.00401000
push 1
push 0
push 1
lea edx, [ebp - 0x110]
push 0x487110
push edx
call fcn.00486f10
add esp, 0x14
push 0x104
lea eax, [ebp - 0x110]
push eax
call esi
test eax, eax
je 0x487efd
mov edx, 0x104
lea eax, [ebp - 0x110]
lea ebx, [ebx]
cmp byte [eax], 0
je 0x487ebb
inc eax
dec edx
jne 0x487eb0
jmp 0x487ee3
test edx, edx
je 0x487ee3
mov ecx, 0x104
sub ecx, edx
mov eax, 0x104
sub eax, ecx
push str.driversetc
lea ecx, [ebp + ecx - 0x110]
mov edx, 0x7fffffff
call fcn.00401000
push 1
push 0
push 1
lea ecx, [ebp - 0x110]
push 0x487110
push ecx
call fcn.00486f10
add esp, 0x14
push 0x104
lea edx, [ebp - 0x110]
push edx
call esi
test eax, eax
je 0x487f6d
mov edx, 0x104
lea eax, [ebp - 0x110]
lea ebx, [ebx]
cmp byte [eax], 0
je 0x487f2b
inc eax
dec edx
jne 0x487f20
jmp 0x487f53
test edx, edx
je 0x487f53
mov ecx, 0x104
sub ecx, edx
mov eax, 0x104
sub eax, ecx
push str.drivers
lea ecx, [ebp + ecx - 0x110]
mov edx, 0x7fffffff
call fcn.00401000
push 1
push 0
push 1
lea eax, [ebp - 0x110]
push 0x487110
push eax
call fcn.00486f10
add esp, 0x14
push 0x104
lea ecx, [ebp - 0x110]
push ecx
call esi
test eax, eax
je 0x487fdd
mov edx, 0x104
lea eax, [ebp - 0x110]
lea ebx, [ebx]
cmp byte [eax], 0
je 0x487f9b
inc eax
dec edx
jne 0x487f90
jmp 0x487fc3
test edx, edx
je 0x487fc3
mov ecx, 0x104
sub ecx, edx
mov eax, 0x104
sub eax, ecx
push str.config
lea ecx, [ebp + ecx - 0x110]
mov edx, 0x7fffffff
call fcn.00401000
push 1
push 0
push 1
lea edx, [ebp - 0x110]
push 0x487110
push edx
call fcn.00486f10
add esp, 0x14
cmp dword [0x4d2afc], 0
je 0x48801f
lea eax, [ebp - 0x118]
push str.KERNEL32.DLL
mov dword [ebp - 0x114], eax
call edi
mov esi, eax
test esi, esi
je 0x48801f
push str.Wow64RevertWow64FsRedirection
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x488018
lea ecx, [ebp - 0x114]
push ecx
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
mov eax, dword [0x4cd38c]
pop edi
xor ecx, ebp
pop esi
call fcn.004a01d6
mov esp, ebp
pop ebp
ret