Function at 0x402a17
Capabilities:
Get common file path
Get program files directory

Disassembly:
push 0x22c
mov eax, 0x464208
call fcn.00457013
mov eax, dword [0x4833bc]
mov ebx, ecx
mov edi, 0x4833bc
mov ecx, edi
mov dword [ebp - 0x230], ebx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x22c], eax
and dword [ebp - 4], 0
mov eax, dword [0x4833bc]
mov ecx, edi
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x224], esi
mov byte [ebp - 4], 1
mov eax, dword [0x4833bc]
mov ecx, edi
call dword [eax + 0xc]
lea ecx, [eax + 0x10]
mov dword [ebp - 0x228], ecx
mov byte [ebp - 4], 2
mov eax, dword [ebx]
mov eax, dword [eax - 0xc]
cmp eax, 3
jge 0x402aa0
lea eax, [ecx - 0x10]
call fcn.00404929
lea eax, [esi - 0x10]
call fcn.00404929
mov eax, dword [ebp - 0x22c]
add eax, 0xfffffff0
jmp 0x402c7f
mov eax, ebx
lea edi, [ebp - 0x224]
call fcn.004052c3
mov eax, dword [ebx]
cmp word [eax], 0x25
je 0x402ace
mov eax, dword [ebp - 0x228]
add eax, 0xfffffff0
call fcn.00404929
mov eax, dword [ebp - 0x224]
add eax, 0xfffffff0
jmp 0x402a8d
xor ecx, ecx
push 0x25
inc ecx
mov esi, ebx
call fcn.0040502d
cmp eax, 0xffffffff
mov dword [ebp - 0x234], eax
je 0x402ab5
lea ecx, [eax - 1]
lea eax, [ebp - 0x238]
xor edx, edx
push eax
inc edx
mov eax, ebx
call fcn.00404df9
lea edi, [ebp - 0x22c]
mov byte [ebp - 4], 3
call fcn.004052c3
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x238]
add eax, 0xfffffff0
call fcn.00404929
mov esi, dword [ebp - 0x22c]
mov edi, dword [sym.imp.MSVCR80.dll__wcsicmp]
push str.ksafepath
push esi
call edi
test eax, eax
pop ecx
pop ecx
jne 0x402b54
lea eax, [ebp - 0x224]
push eax
call fcn.00402030
mov ecx, eax
call fcn.0040215f
test eax, eax
jge 0x402ce2
jmp 0x402c60
push str.ksafedata
push esi
call edi
test eax, eax
pop ecx
pop ecx
jne 0x402b86
call fcn.00402030
push 0x400000
push str.Data
lea ecx, [ebp - 0x224]
push ecx
mov edx, str.DataPath
mov ecx, eax
call fcn.0040247a
jmp 0x402b47
push str.ksafeconfig
push esi
call edi
test eax, eax
pop ecx
pop ecx
jne 0x402ba8
push eax
call fcn.00402030
push eax
lea ecx, [ebp - 0x224]
call fcn.00402177
jmp 0x402b47
push str.ksafeupdate
push esi
call edi
test eax, eax
pop ecx
pop ecx
jne 0x402bd6
call fcn.00402030
push eax
lea ecx, [ebp - 0x224]
call fcn.00402207
test eax, eax
jl 0x402c60
mov ebx, str.update
jmp 0x402bfe
push str.ksafeviruslib
push esi
call edi
test eax, eax
pop ecx
pop ecx
jne 0x402c14
call fcn.00402030
push eax
lea ecx, [ebp - 0x224]
call fcn.00402291
test eax, eax
jl 0x402c60
mov ebx, 0x467388
lea eax, [ebp - 0x224]
call fcn.004045fb
mov ebx, dword [ebp - 0x230]
jmp 0x402ce2
push str.system32
push esi
call edi
test eax, eax
pop ecx
pop ecx
jne 0x402c8a
xor edi, edi
push 0x208
lea eax, [ebp - 0x21e]
push edi
push eax
mov word [ebp - 0x220], di
call sub.MSVCR80.dll_memset
add esp, 0xc
push 0x104
lea eax, [ebp - 0x220]
push eax
mov word [ebp - 0x18], di
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, edi
jne 0x402ccf
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [ebp - 0x228]
add eax, 0xfffffff0
call fcn.00404929
mov eax, dword [ebp - 0x224]
add eax, 0xfffffff0
call fcn.00404929
lea eax, [esi - 0x10]
call fcn.00404929
call fcn.00457096
ret
push str.program_files
push esi
call edi
test eax, eax
pop ecx
pop ecx
jne 0x402c60
xor edi, edi
push 0x208
lea eax, [ebp - 0x21e]
push edi
push eax
mov word [ebp - 0x220], di
call sub.MSVCR80.dll_memset
add esp, 0xc
push edi
push 0x26
lea eax, [ebp - 0x220]
push eax
push edi
mov word [ebp - 0x18], di
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x402c5a
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x224]
push eax
call fcn.00405232
mov eax, dword [ebx]
mov eax, dword [eax - 0xc]
lea ecx, [eax - 1]
mov eax, dword [ebp - 0x234]
cmp eax, ecx
jge 0x402d2e
lea edx, [eax + 1]
lea eax, [ebp - 0x234]
push eax
mov eax, ebx
call fcn.00404ddb
mov byte [ebp - 4], 4
mov ebx, dword [eax]
lea eax, [ebp - 0x224]
call fcn.004045fb
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x234]
add eax, 0xfffffff0
call fcn.00404929
mov ebx, dword [ebp - 0x230]
lea eax, [ebp - 0x224]
mov edi, ebx
call fcn.004052c3
jmp 0x402c60