Function at 0x40102f
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x3530
call fcn.0040c020
and byte [ebp - 0x310], 0
push ebx
push esi
push edi
push 0x40
xor eax, eax
pop ecx
lea edi, [ebp - 0x30f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ebx, 0x1008
mov ecx, 0x400
xor eax, eax
lea edi, [ebp - 0x2520]
mov dword [ebp - 0x2528], ebx
mov dword [ebp - 0x2524], 0x1194
rep stosd dword es:[edi], eax
push 0x41f070
xor edi, edi
call dword [sym.imp.KERNEL32.DLL_GetVersionExA]
push 1
push 1
push 0x41a4c4
push 0xc
call fcn.00408cb1
pop ecx
pop ecx
push eax
call fcn.00408952
push eax
lea eax, [ebp - 0x3530]
push ebx
push eax
push edi
push 0x41a4b4
push 0xe
call fcn.00408cb1
pop ecx
pop ecx
push eax
call fcn.00408952
push eax
call fcn.00408323
add esp, 0x14
cmp eax, edi
jle 0x4010e4
push eax
lea eax, [ebp - 0x3530]
push eax
lea eax, [ebp - 0x2528]
push eax
call fcn.0040bce0
add esp, 0xc
push 1
pop edi
mov esi, 0x104
lea eax, [ebp - 0x310]
push esi
push eax
call fcn.0040157f
pop ecx
pop ecx
push 0
push 0x1a
push 0x423b18
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
push 0x208
push 0x423708
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryA]
push 0
push 0x26
push 0x423910
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test edi, edi
je 0x401181
lea eax, [ebp - 0x2320]
push eax
call fcn.00408d5e
test al, al
pop ecx
je 0x401177
lea eax, [ebp - 0x1920]
push eax
call fcn.00408d5e
test al, al
pop ecx
je 0x401177
lea eax, [ebp - 0x2320]
push eax
push 0x4232f8
call fcn.0040bb60
lea eax, [ebp - 0x1920]
push eax
push 0x423500
call fcn.0040bb60
add esp, 0x10
jmp 0x401179
xor edi, edi
test edi, edi
jne 0x40157a
and byte [ebp - 0x518], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x517]
and dword [ebp - 4], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcessId]
push eax
call fcn.0040bc50
pop ecx
xor edi, edi
push esi
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.0040bc80
push esi
lea eax, [ebp - 0x414]
push edi
push eax
call fcn.0040bc80
add esp, 0x18
call fcn.0040bc5d
push 6
cdq
pop ecx
idiv ecx
sub edx, edi
je 0x4013ea
dec edx
je 0x4013cb
dec edx
je 0x40122f
dec edx
je 0x401211
dec edx
je 0x401207
dec edx
jne 0x401306
lea eax, [ebp - 0x20c]
push esi
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryA]
jmp 0x4013f8
push 0x423b18
jmp 0x4013d0
push edi
lea eax, [ebp - 0x20c]
push 5
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
je 0x401306
jmp 0x401400
lea eax, [ebp - 0x108]
push 0x423910
push eax
call fcn.0040bb60
mov edi, 0x41a4b0
lea eax, [ebp - 0x108]
push edi
push eax
call fcn.0040bb70
push 0x41a4a0
push 0xc
call fcn.00408cb1
push eax
lea eax, [ebp - 0x108]
push eax
call fcn.0040bb70
lea eax, [ebp - 0x108]
push eax
call fcn.00408d5e
add esp, 0x24
test al, al
je 0x40129e
lea eax, [ebp - 0x108]
mov dword [ebp - 4], 1
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.0040bb60
pop ecx
xor edi, edi
pop ecx
jmp 0x40130f
lea eax, [ebp - 0x108]
push 0x423910
push eax
call fcn.0040bb60
lea eax, [ebp - 0x108]
push edi
push eax
call fcn.0040bb70
push 0x41a498
push 6
call fcn.00408cb1
push eax
lea eax, [ebp - 0x108]
push eax
call fcn.0040bb70
lea eax, [ebp - 0x108]
push eax
call fcn.00408d5e
add esp, 0x24
test al, al
je 0x401304
lea eax, [ebp - 0x108]
mov dword [ebp - 4], 1
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.0040bb60
pop ecx
pop ecx
xor edi, edi
cmp dword [ebp - 4], edi
je 0x4011a9
push edi
push 0x41a484
push 0x10
call fcn.00408cb1
pop ecx
pop ecx
push eax
call fcn.00408952
push eax
lea eax, [ebp - 0x414]
push 0x103
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.0040953c
add esp, 0x10
test eax, eax
jne 0x401347
mov dword [ebp - 4], edi
cmp dword [ebp - 4], edi
je 0x4011a9
cmp byte [ebp - 0x310], 0
je 0x401375
lea eax, [ebp - 0x310]
push eax
lea eax, [ebp - 0x414]
push eax
call fcn.0040ba90
pop ecx
test eax, eax
pop ecx
jne 0x401375
mov dword [ebp - 4], edi
cmp dword [ebp - 4], edi
je 0x4011a9
lea eax, [ebp - 0x414]
push eax
push 0x4232f8
call fcn.0040bb60
pop ecx
pop ecx
push edi
push 0x41a474
push 0xe
call fcn.00408cb1
pop ecx
pop ecx
push eax
call fcn.00408952
push eax
mov edi, 0x423500
push 0x207
push edi
push 0x4232f8
call fcn.0040953c
add esp, 0x10
test eax, eax
jne 0x40140c
and dword [ebp - 4], eax
jmp 0x4011a9
push 0x423910
lea eax, [ebp - 0x20c]
push eax
call fcn.0040bb60
pop ecx
mov dword [ebp - 4], 1
pop ecx
jmp 0x40130f
lea eax, [ebp - 0x20c]
push esi
push eax
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryA]
test eax, eax
jbe 0x401306
mov dword [ebp - 4], 1
jmp 0x401306
push edi
call fcn.004080e3
pop ecx
xor eax, eax
mov ecx, 0x400
lea edi, [ebp - 0x1518]
push 1
mov dword [ebp - 0x1520], ebx
mov dword [ebp - 0x151c], 0x1194
push 0x41a460
rep stosd dword es:[edi], eax
push 0x13
call fcn.00408cb1
pop ecx
pop ecx
push eax
call fcn.00408952
push eax
mov esi, 0x41a45c
lea eax, [ebp - 0x1118]
push esi
push eax
call fcn.0040ba39
lea eax, [ebp - 0x518]
push eax
call fcn.00401640
add esp, 0x10
lea eax, [ebp - 0x518]
push eax
push 0x41a454
push 6
call fcn.00408cb1
pop ecx
pop ecx
push eax
lea eax, [ebp - 0x1518]
push eax
call fcn.0040ba39
lea eax, [ebp - 0x1318]
push 0x4232f8
push eax
call fcn.0040bb60
add esp, 0x14
push 1
pop edi
push edi
push 0x41a44c
push 6
call fcn.00408cb1
pop ecx
pop ecx
push eax
call fcn.00408952
push eax
lea eax, [ebp - 0xd18]
push eax
call fcn.0040bb60
pop ecx
pop ecx
push edi
push 0x41a444
push 7
call fcn.00408cb1
pop ecx
pop ecx
push eax
call fcn.00408952
push eax
lea eax, [ebp - 0xb18]
push eax
call fcn.0040bb60
push 0x200
lea eax, [ebp - 0xf18]
push 0
push eax
call fcn.0040bc80
add esp, 0x14
push edi
push str.Clickspring
call fcn.00408952
push eax
push esi
lea eax, [ebp - 0xf18]
push 0x1ff
push eax
call fcn.0040b9e8
lea eax, [ebp - 0x918]
push 0x423500
push eax
call fcn.0040bb60
and byte [ebp - 0x718], 0
add esp, 0x18
push 0x80000001
push edi
push 0x41a4c4
push 0xc
call fcn.00408cb1
pop ecx
pop ecx
push eax
call fcn.00408952
push eax
lea eax, [ebp - 0x1520]
push ebx
push eax
push 0
push 0x41a4b4
push 0xe
call fcn.00408cb1
pop ecx
pop ecx
push eax
call fcn.00408952
push eax
call fcn.0040824f
add esp, 0x14
pop edi
pop esi
pop ebx
leave
ret