Function at 0x487bc0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x4f72bc]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x505890], 0
push esi
push edi
mov dword [ebp - 0x118], 0
je 0x487bed
call fcn.004c2580
cmp dword [0x506e0c], 0
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x505890], 0
mov dword [0x5060a8], 7
je 0x487c49
lea eax, [ebp - 0x118]
push str.KERNEL32.DLL
mov dword [ebp - 0x114], eax
call edi
mov esi, eax
test esi, esi
je 0x487c49
push str.Wow64DisableWow64FsRedirection
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x487c42
lea ecx, [ebp - 0x114]
push ecx
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 1
push 0
push 0
push 0x486eb0
push 0x4edc2c
call fcn.00486cb0
add esp, 0x14
push 0x104
lea edx, [ebp - 0x110]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x487c91
push 1
push 0
push 0
lea eax, [ebp - 0x110]
push 0x486eb0
push eax
call fcn.00486cb0
add esp, 0x14
mov esi, dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x104
lea ecx, [ebp - 0x110]
push ecx
call esi
test eax, eax
je 0x487cc3
push 1
push 0
push 1
lea edx, [ebp - 0x110]
push 0x486eb0
push edx
call fcn.00486cb0
add esp, 0x14
push 0x104
push str.CommonFilesDir
push str.SOFTWAREMicrosoftWindowsCurrentVersion
lea ecx, [ebp - 0x110]
mov edx, CreateStatusWindowA
call fcn.004bff10
add esp, 0xc
test eax, eax
je 0x487d03
push 1
push 0
push 1
lea eax, [ebp - 0x110]
push 0x486eb0
push eax
call fcn.00486cb0
add esp, 0x14
lea ecx, [ebp - 0x110]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x487d54
lea edx, [ebp - 0x110]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp byte [ebp + eax - 0x111], 0x5c
lea eax, [ebp + eax - 0x111]
jne 0x487d3a
mov byte [eax], 0
push 1
push 0
push 1
lea eax, [ebp - 0x110]
push 0x486eb0
push eax
call fcn.00486cb0
add esp, 0x14
cmp dword [0x506e0c], 0
je 0x487f5f
push 0x104
lea ecx, [ebp - 0x110]
push ecx
call esi
test eax, eax
je 0x487dcd
mov edx, 0x104
lea eax, [ebp - 0x110]
mov edi, edi
cmp byte [eax], 0
je 0x487d8b
inc eax
dec edx
jne 0x487d80
jmp 0x487db3
test edx, edx
je 0x487db3
mov ecx, 0x104
sub ecx, edx
mov eax, 0x104
sub eax, ecx
push str.SysWOW64
lea ecx, [ebp + ecx - 0x110]
mov edx, 0x7fffffff
call fcn.004010b0
push 1
push 0
push 1
lea edx, [ebp - 0x110]
push 0x486eb0
push edx
call fcn.00486cb0
add esp, 0x14
push 0x104
lea eax, [ebp - 0x110]
push eax
call esi
test eax, eax
je 0x487e3d
mov edx, 0x104
lea eax, [ebp - 0x110]
lea ebx, [ebx]
cmp byte [eax], 0
je 0x487dfb
inc eax
dec edx
jne 0x487df0
jmp 0x487e23
test edx, edx
je 0x487e23
mov ecx, 0x104
sub ecx, edx
mov eax, 0x104
sub eax, ecx
push str.driversetc
lea ecx, [ebp + ecx - 0x110]
mov edx, 0x7fffffff
call fcn.004010b0
push 1
push 0
push 1
lea ecx, [ebp - 0x110]
push 0x486eb0
push ecx
call fcn.00486cb0
add esp, 0x14
push 0x104
lea edx, [ebp - 0x110]
push edx
call esi
test eax, eax
je 0x487ead
mov edx, 0x104
lea eax, [ebp - 0x110]
lea ebx, [ebx]
cmp byte [eax], 0
je 0x487e6b
inc eax
dec edx
jne 0x487e60
jmp 0x487e93
test edx, edx
je 0x487e93
mov ecx, 0x104
sub ecx, edx
mov eax, 0x104
sub eax, ecx
push str.drivers
lea ecx, [ebp + ecx - 0x110]
mov edx, 0x7fffffff
call fcn.004010b0
push 1
push 0
push 1
lea eax, [ebp - 0x110]
push 0x486eb0
push eax
call fcn.00486cb0
add esp, 0x14
push 0x104
lea ecx, [ebp - 0x110]
push ecx
call esi
test eax, eax
je 0x487f1d
mov edx, 0x104
lea eax, [ebp - 0x110]
lea ebx, [ebx]
cmp byte [eax], 0
je 0x487edb
inc eax
dec edx
jne 0x487ed0
jmp 0x487f03
test edx, edx
je 0x487f03
mov ecx, 0x104
sub ecx, edx
mov eax, 0x104
sub eax, ecx
push str.config
lea ecx, [ebp + ecx - 0x110]
mov edx, 0x7fffffff
call fcn.004010b0
push 1
push 0
push 1
lea edx, [ebp - 0x110]
push 0x486eb0
push edx
call fcn.00486cb0
add esp, 0x14
cmp dword [0x506e0c], 0
je 0x487f5f
lea eax, [ebp - 0x118]
push str.KERNEL32.DLL
mov dword [ebp - 0x114], eax
call edi
mov esi, eax
test esi, esi
je 0x487f5f
push str.Wow64RevertWow64FsRedirection
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x487f58
lea ecx, [ebp - 0x114]
push ecx
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
mov eax, dword [0x505890]
pop edi
xor ecx, ebp
pop esi
call fcn.004cf2b6
mov esp, ebp
pop ebp
ret