Function at 0x4368e0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x598afd
mov eax, dword fs:[0]
push eax
sub esp, 0x194
mov eax, dword [0x616738]
xor eax, ebp
mov dword [ebp - 0x1c], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x158], ecx
mov dword [ebp - 0x154], 0
mov dword [ebp - 4], 1
mov dword [ebp - 0x14], 0
lea ecx, [ebp - 0x18]
call fcn.004a2910
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x128]
call fcn.004a2910
mov byte [ebp - 4], 3
lea eax, [ebp - 0x124]
mov dword [ebp - 0x10], eax
push 0
push 0x5a8210
lea ecx, [ebp + 0xc]
call fcn.00408030
test eax, eax
jl 0x43699d
mov dword [ebp - 0x14], 1
push 0x105
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov edx, dword [ebp - 0x10]
push edx
lea ecx, [ebp - 0x18]
call fcn.00409090
lea ecx, [ebp - 0x18]
call fcn.004090f0
push eax
push str._WINDOW_
lea ecx, [ebp + 0xc]
call fcn.0040f800
jmp 0x436e62
push 0
push 0x5a8228
lea ecx, [ebp + 0xc]
call fcn.00408030
test eax, eax
jl 0x4369ed
mov dword [ebp - 0x14], 1
push 0x105
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov ecx, dword [ebp - 0x10]
push ecx
lea ecx, [ebp - 0x18]
call fcn.00409090
lea ecx, [ebp - 0x18]
call fcn.004090f0
push eax
push str._SYSTEM_
lea ecx, [ebp + 0xc]
call fcn.0040f800
jmp 0x436e62
push 0
push 0x5a8240
lea ecx, [ebp + 0xc]
call fcn.00408030
test eax, eax
jl 0x436adf
mov dword [ebp - 0x14], 1
push 0
push ecx
mov ecx, esp
mov dword [ebp - 0x12c], esp
push 0x5a7f57
call fcn.00408ff0
mov dword [ebp - 0x15c], eax
mov edx, dword [ebp - 0x15c]
mov dword [ebp - 0x160], edx
mov byte [ebp - 4], 4
push ecx
mov ecx, esp
mov dword [ebp - 0x130], esp
push 0x5a824c
call fcn.00408ff0
mov dword [ebp - 0x164], eax
mov eax, dword [ebp - 0x164]
mov dword [ebp - 0x168], eax
mov byte [ebp - 4], 5
push ecx
mov ecx, esp
mov dword [ebp - 0x134], esp
push 0x5a825c
call fcn.00408ff0
mov dword [ebp - 0x16c], eax
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x138]
push ecx
mov byte [ebp - 4], 3
call fcn.00492c20
add esp, 0x18
mov dword [ebp - 0x170], eax
mov edx, dword [ebp - 0x170]
mov dword [ebp - 0x174], edx
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0x174]
push eax
lea ecx, [ebp - 0x18]
call fcn.00409070
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x138]
call fcn.00408330
lea ecx, [ebp - 0x18]
call fcn.004090f0
push eax
push str._PROGRAM_
lea ecx, [ebp + 0xc]
call fcn.0040f800
jmp 0x436e62
push 0
push 0x5a8294
lea ecx, [ebp + 0xc]
call fcn.00408030
test eax, eax
jl 0x436b81
mov dword [ebp - 0x14], 1
lea ecx, [ebp + 0x10]
call fcn.00408290
movzx ecx, al
test ecx, ecx
je 0x436b66
push 0x5a7f61
mov ecx, dword [ebp + 8]
call fcn.00408ff0
mov edx, dword [ebp - 0x154]
or edx, 1
mov dword [ebp - 0x154], edx
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x128]
call fcn.00408330
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x18]
call fcn.00408330
mov byte [ebp - 4], 0
lea ecx, [ebp + 0xc]
call fcn.00408330
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x10]
call fcn.00408330
mov eax, dword [ebp + 8]
jmp 0x436ec8
lea ecx, [ebp + 0x10]
call fcn.004090f0
push eax
push str._ROOT_
lea ecx, [ebp + 0xc]
call fcn.0040f800
jmp 0x436e62
push 0
push 0x5a82a4
lea ecx, [ebp + 0xc]
call fcn.00408030
test eax, eax
jl 0x436bc6
mov dword [ebp - 0x14], 1
lea eax, [ebp - 0x124]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea ecx, [ebp - 0x124]
push ecx
push str._TEMP_
lea ecx, [ebp + 0xc]
call fcn.0040f800
jmp 0x436e62
push 0
push 0x5a82b4
lea ecx, [ebp + 0xc]
call fcn.00408030
test eax, eax
jl 0x436c34
mov dword [ebp - 0x14], 1
lea edx, [ebp - 0x13c]
push edx
mov ecx, 0x61c730
call fcn.004065a0
mov dword [ebp - 0x178], eax
mov eax, dword [ebp - 0x178]
mov dword [ebp - 0x17c], eax
mov byte [ebp - 4], 7
mov ecx, dword [ebp - 0x17c]
call fcn.004090f0
push eax
push str._SELF_
lea ecx, [ebp + 0xc]
call fcn.0040f800
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x13c]
call fcn.00408330
jmp 0x436e62
push 0
push 0x5a82c4
lea ecx, [ebp + 0xc]
call fcn.00408030
test eax, eax
jl 0x436c84
mov dword [ebp - 0x14], 1
push 0x105
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov edx, dword [ebp - 0x10]
push edx
lea ecx, [ebp - 0x18]
call fcn.00409090
lea ecx, [ebp - 0x18]
call fcn.004090f0
push eax
push str._WINDOWS_
lea ecx, [ebp + 0xc]
call fcn.0040f800
jmp 0x436e62
push 0
push 0x5a82dc
lea ecx, [ebp + 0xc]
call fcn.00408030
test eax, eax
jl 0x436dc8
mov dword [ebp - 0x14], 1
push 0
push ecx
mov ecx, esp
mov dword [ebp - 0x140], esp
push 0x5a7f62
call fcn.00408ff0
mov dword [ebp - 0x180], eax
mov eax, dword [ebp - 0x180]
mov dword [ebp - 0x184], eax
mov byte [ebp - 4], 8
push ecx
mov ecx, esp
mov dword [ebp - 0x144], esp
push str.ProgramFilesDir
call fcn.00408ff0
mov dword [ebp - 0x188], eax
mov ecx, dword [ebp - 0x188]
mov dword [ebp - 0x18c], ecx
mov byte [ebp - 4], 9
push ecx
mov ecx, esp
mov dword [ebp - 0x148], esp
push str.SOFTWAREMicrosoftWindowsCurrentVersion
call fcn.00408ff0
mov dword [ebp - 0x190], eax
push reloc.OLEAUT32.dll_SysReAllocString
lea edx, [ebp - 0x14c]
push edx
mov byte [ebp - 4], 3
call fcn.00492c20
add esp, 0x18
mov dword [ebp - 0x194], eax
mov eax, dword [ebp - 0x194]
mov dword [ebp - 0x198], eax
mov byte [ebp - 4], 0xa
mov ecx, dword [ebp - 0x198]
push ecx
lea ecx, [ebp - 0x18]
call fcn.00409070
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x14c]
call fcn.00408330
lea ecx, [ebp - 0x18]
call fcn.00408290
movzx edx, al
test edx, edx
je 0x436dad
lea eax, [ebp - 0x150]
push eax
call fcn.00496cc0
add esp, 4
mov dword [ebp - 0x19c], eax
mov ecx, dword [ebp - 0x19c]
mov dword [ebp - 0x1a0], ecx
mov byte [ebp - 4], 0xb
mov edx, dword [ebp - 0x1a0]
push edx
lea ecx, [ebp - 0x18]
call fcn.00409070
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x150]
call fcn.00408330
lea ecx, [ebp - 0x18]
call fcn.004090f0
push eax
push str._PROGRAMFILES_
lea ecx, [ebp + 0xc]
call fcn.0040f800
jmp 0x436e62
push 0
push 0x5a8338
lea ecx, [ebp + 0xc]
call fcn.00408030
test eax, eax
jl 0x436e62
mov dword [ebp - 0x14], 1
lea ecx, [ebp + 0x10]
call fcn.00408290
movzx eax, al
test eax, eax
je 0x436e4c
push 0x5a7f63
mov ecx, dword [ebp + 8]
call fcn.00408ff0
mov ecx, dword [ebp - 0x154]
or ecx, 1
mov dword [ebp - 0x154], ecx
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x128]
call fcn.00408330
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x18]
call fcn.00408330
mov byte [ebp - 4], 0
lea ecx, [ebp + 0xc]
call fcn.00408330
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x10]
call fcn.00408330
mov eax, dword [ebp + 8]
jmp 0x436ec8
lea ecx, [ebp + 0x10]
call fcn.004090f0
push eax
push str._PRODUCTROOT_
lea ecx, [ebp + 0xc]
call fcn.0040f800
push 0x5a8358
push 0x5a835c
lea ecx, [ebp + 0xc]
call fcn.0040f800
lea edx, [ebp + 0xc]
push edx
mov ecx, dword [ebp + 8]
call fcn.00408fd0
mov eax, dword [ebp - 0x154]
or eax, 1
mov dword [ebp - 0x154], eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x128]
call fcn.00408330
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x18]
call fcn.00408330
mov byte [ebp - 4], 0
lea ecx, [ebp + 0xc]
call fcn.00408330
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x10]
call fcn.00408330
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.0056edd3
mov esp, ebp
pop ebp
ret 0xc