Function at 0x41c7c0
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 8], esi
call fcn.004096c0
mov dword [ebp - 4], eax
mov eax, dword [esi + 0x528]
push 0x44a5b8
push eax
call fcn.004112c0
mov esi, dword [ebp + 8]
add esp, 8
mov ecx, esi
call fcn.00421c20
mov ecx, esi
call fcn.0041c170
lea ebx, [esi + 0x2fc]
test ebx, ebx
jne 0x41c80c
xor eax, eax
jmp 0x41c83f
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, eax
inc edi
lea eax, [edi + edi]
add eax, 3
and al, 0xfc
call fcn.0042a4e0
mov eax, esp
push edi
push eax
push 0xffffffffffffffff
push ebx
push 0
push 0
mov dword [ebp + 8], eax
mov word [eax], 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
push esi
push 0x417f60
push eax
push 0
push 0
call fcn.00409610
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
push ecx
push edx
push esi
mov ecx, esi
call fcn.0041c1a0
test eax, eax
jne 0x41c875
lea esp, [ebp - 0x21c]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov ecx, esi
call fcn.00421c20
mov eax, dword [ebp - 8]
push 0x44a598
mov ecx, dword [eax + 0x528]
push ecx
call fcn.004112c0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x20f]
mov byte [ebp - 0x210], 0
rep stosd dword es:[edi], eax
add esp, 8
lea edx, [ebp - 0x210]
stosw word es:[edi], ax
push ebx
push 0x44a58c
push 0x104
push edx
stosb byte es:[edi], al
call fcn.0042b070
mov eax, dword [ebp - 8]
add esp, 0x10
mov ecx, dword [eax + 0x528]
push 0x44a56c
push ecx
call fcn.004112c0
add esp, 8
mov ecx, esi
call fcn.00421c20
mov ecx, esi
call fcn.0041c170
lea edx, [ebp - 0x210]
test edx, edx
jne 0x41c8f9
xor ebx, ebx
jmp 0x41c932
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, eax
inc edi
lea eax, [edi + edi]
add eax, 3
and al, 0xfc
call fcn.0042a4e0
mov ebx, esp
push edi
push ebx
lea ecx, [ebp - 0x210]
push 0xffffffffffffffff
push ecx
push 0
push 0
mov word [ebx], 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, dword [ebp - 4]
push esi
push 0x417f60
push ebx
push 0
push 0
call fcn.00409610
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
push edx
push eax
push esi
mov ecx, esi
call fcn.0041c1a0
test eax, eax
jne 0x41c968
lea esp, [ebp - 0x21c]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov ecx, esi
call fcn.00421c20
mov ebx, dword [ebp - 8]
push 0x44a54c
mov ecx, dword [ebx + 0x528]
push ecx
call fcn.004112c0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x10b]
mov byte [ebp - 0x10c], 0
rep stosd dword es:[edi], eax
add esp, 8
lea edx, [ebp - 0x10c]
stosw word es:[edi], ax
push 0
push 0x26
push edx
push 0
stosb byte es:[edi], al
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
mov ecx, 0x104
lea eax, [ebp - 0x10c]
cmp byte [eax], 0
je 0x41c9c8
inc eax
dec ecx
jne 0x41c9bd
jmp 0x41ca0d
test ecx, ecx
je 0x41ca0d
lea eax, [ebp + 0x10]
test eax, eax
je 0x41c9dc
mov eax, 0x104
sub eax, ecx
jmp 0x41c9df
mov eax, dword [ebp + 0x10]
mov edx, 0x104
sub edx, eax
lea eax, [ebp + eax - 0x10c]
je 0x41ca0d
mov edi, 0x4417f4
sub edi, eax
mov cl, byte [edi + eax]
test cl, cl
je 0x41ca05
mov byte [eax], cl
inc eax
dec edx
jne 0x41c9f6
jmp 0x41ca09
test edx, edx
jne 0x41ca0a
dec eax
mov byte [eax], 0
mov ecx, dword [ebx + 0x528]
push 0x44a52c
push ecx
call fcn.004112c0
add esp, 8
mov ecx, esi
call fcn.00421c20
mov ecx, esi
call fcn.0041c170
lea edx, [ebp - 0x10c]
test edx, edx
jne 0x41ca3d
xor eax, eax
jmp 0x41ca7b
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, eax
inc edi
lea eax, [edi + edi]
add eax, 3
and al, 0xfc
call fcn.0042a4e0
mov ebx, esp
push edi
push ebx
lea ecx, [ebp - 0x10c]
push 0xffffffffffffffff
push ecx
push 0
push 0
mov word [ebx], 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, ebx
mov ebx, dword [ebp - 8]
mov ecx, dword [ebp - 4]
push esi
push 0x417f60
push eax
push 1
push 0
call fcn.00409610
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
push edx
push eax
push esi
mov ecx, esi
call fcn.0041c1a0
test eax, eax
jne 0x41cab1
lea esp, [ebp - 0x21c]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov ecx, esi
call fcn.00421c20
mov ecx, dword [ebx + 0x528]
push 0x44a50c
push ecx
call fcn.004112c0
add esp, 8
lea edx, [ebp - 0x10c]
push 0
push 0x10
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
mov ecx, 0x104
lea eax, [ebp - 0x10c]
cmp byte [eax], 0
je 0x41caf5
inc eax
dec ecx
jne 0x41caea
jmp 0x41cb3a
test ecx, ecx
je 0x41cb3a
lea eax, [ebp + 0x10]
test eax, eax
je 0x41cb09
mov eax, 0x104
sub eax, ecx
jmp 0x41cb0c
mov eax, dword [ebp + 0x10]
mov edx, 0x104
sub edx, eax
lea eax, [ebp + eax - 0x10c]
je 0x41cb3a
mov edi, 0x4417f4
sub edi, eax
mov cl, byte [edi + eax]
test cl, cl
je 0x41cb32
mov byte [eax], cl
inc eax
dec edx
jne 0x41cb23
jmp 0x41cb36
test edx, edx
jne 0x41cb37
dec eax
mov byte [eax], 0
mov ecx, dword [ebx + 0x528]
push 0x44a4f0
push ecx
call fcn.004112c0
add esp, 8
mov ecx, esi
call fcn.00421c20
mov ecx, esi
mov dword [esi + 0x40c], 1
call fcn.0041c170
lea edx, [ebp - 0x10c]
test edx, edx
jne 0x41cb74
xor eax, eax
jmp 0x41cbb2
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, eax
inc edi
lea eax, [edi + edi]
add eax, 3
and al, 0xfc
call fcn.0042a4e0
mov ebx, esp
push edi
push ebx
lea ecx, [ebp - 0x10c]
push 0xffffffffffffffff
push ecx
push 0
push 0
mov word [ebx], 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, ebx
mov ebx, dword [ebp - 8]
mov ecx, dword [ebp - 4]
push esi
push 0x417f60
push eax
xor edi, edi
push 1
push edi
call fcn.00409610
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
push edx
push eax
push esi
mov ecx, esi
call fcn.0041c1a0
test eax, eax
mov dword [esi + 0x40c], edi
jne 0x41cbf1
xor eax, eax
lea esp, [ebp - 0x21c]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov ecx, esi
call fcn.00421c20
mov ecx, dword [ebx + 0x528]
push 0x44a4d4
push ecx
call fcn.004112c0
add esp, 8
lea edx, [ebp - 0x10c]
push edi
push 0x19
push edx
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
mov ecx, 0x104
lea eax, [ebp - 0x10c]
cmp byte [eax], 0
je 0x41cc33
inc eax
dec ecx
jne 0x41cc28
jmp 0x41cc78
cmp ecx, edi
je 0x41cc78
lea eax, [ebp + 0x10]
test eax, eax
je 0x41cc47
mov eax, 0x104
sub eax, ecx
jmp 0x41cc4a
mov eax, dword [ebp + 0x10]
mov edx, 0x104
sub edx, eax
lea eax, [ebp + eax - 0x10c]
je 0x41cc78
mov edi, 0x4417f4
sub edi, eax
mov cl, byte [edi + eax]
test cl, cl
je 0x41cc70
mov byte [eax], cl
inc eax
dec edx
jne 0x41cc61
jmp 0x41cc74
test edx, edx
jne 0x41cc75
dec eax
mov byte [eax], 0
mov ecx, dword [ebx + 0x528]
push 0x44a4b4
push ecx
call fcn.004112c0
add esp, 8
mov ecx, esi
call fcn.00421c20
mov ecx, esi
mov dword [esi + 0x40c], 1
call fcn.0041c170
lea edx, [ebp - 0x10c]
test edx, edx
jne 0x41ccb2
xor eax, eax
jmp 0x41ccf0
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, eax
inc edi
lea eax, [edi + edi]
add eax, 3
and al, 0xfc
call fcn.0042a4e0
mov ebx, esp
push edi
push ebx
lea ecx, [ebp - 0x10c]
push 0xffffffffffffffff
push ecx
push 0
push 0
mov word [ebx], 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, ebx
mov ebx, dword [ebp - 8]
mov ecx, dword [ebp - 4]
push esi
push 0x417f60
push eax
push 1
push 0
call fcn.00409610
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
push edx
push eax
push esi
mov ecx, esi
call fcn.0041c1a0
test eax, eax
mov dword [esi + 0x40c], 0
jne 0x41cd32
xor eax, eax
lea esp, [ebp - 0x21c]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov ecx, esi
call fcn.00421c20
mov ecx, dword [ebx + 0x528]
push 0x44a494
push ecx
call fcn.004112c0
mov edx, dword [ebx + 0x528]
add esp, 8
push 0x44a478
push edx
call fcn.004112c0
add esp, 8
mov ecx, esi
call fcn.00421c20
mov edx, 0x44a474
lea ecx, [ebp - 0x10c]
mov edi, 0x104
lea eax, [ebp - 0x10c]
sub edx, ecx
mov cl, byte [edx + eax]
test cl, cl
je 0x41cd8f
mov byte [eax], cl
inc eax
dec edi
jne 0x41cd80
jmp 0x41cd93
test edi, edi
jne 0x41cd94
dec eax
mov byte [eax], 0
mov al, byte [ebp - 0x10c]
cmp al, 0x5a
jg 0x41cddd
lea edx, [ebp - 0x10c]
push edx
call fcn.00402c50
add esp, 4
test eax, eax
je 0x41cdcb
lea eax, [ebp - 0x10c]
push eax
call fcn.00405170
add esp, 4
test eax, eax
je 0x41ce5d
mov al, byte [ebp - 0x10c]
inc al
cmp al, 0x5a
mov byte [ebp - 0x10c], al
jle 0x41cda1
mov ecx, esi
call fcn.00421c20
mov eax, dword [ebx + 0x528]
push 0x44a458
push eax
call fcn.004112c0
mov ecx, dword [ebx + 0x528]
add esp, 8
push 0x44a438
push ecx
call fcn.004112c0
add esp, 8
mov ecx, esi
call fcn.00421c20
mov ecx, esi
call fcn.0041d490
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
push edx
push eax
push esi
push ecx
mov ecx, esi
call fcn.0041d500
mov ecx, esi
call fcn.00421c20
mov edx, dword [ebx + 0x528]
push 0x44a418
push edx
call fcn.004112c0
add esp, 8
mov eax, 2
lea esp, [ebp - 0x21c]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov ecx, esi
mov dword [esi + 0x408], 1
call fcn.0041c170
lea ecx, [ebp - 0x10c]
test ecx, ecx
jne 0x41ce7c
xor eax, eax
jmp 0x41ceba
lea edx, [ebp - 0x10c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, eax
inc edi
lea eax, [edi + edi]
add eax, 3
and al, 0xfc
call fcn.0042a4e0
mov ebx, esp
push edi
push ebx
lea eax, [ebp - 0x10c]
push 0xffffffffffffffff
push eax
push 0
push 0
mov word [ebx], 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, ebx
mov ebx, dword [ebp - 8]
mov ecx, dword [ebp - 4]
push esi
push 0x417f60
push eax
xor edi, edi
push 1
push edi
call fcn.00409610
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
push ecx
push edx
push esi
mov ecx, esi
call fcn.0041c1a0
test eax, eax
mov dword [esi + 0x408], edi
jne 0x41cddd
lea esp, [ebp - 0x21c]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc