Function at 0x406c10
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x4372d2
mov eax, dword fs:[0]
push eax
sub esp, 0x4a8
mov eax, dword [0x449250]
xor eax, esp
mov dword [esp + 0x4a4], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x449250]
xor eax, esp
push eax
lea eax, [esp + 0x4bc]
mov dword fs:[0], eax
mov eax, dword [esp + 0x4cc]
lea edi, [esp + 0x268]
mov dword [esp + 0x18], eax
mov ebx, ecx
call fcn.0040bd50
mov ebp, 0x105
mov dword [esp + 0x4c4], 0
mov ecx, ebp
lea esi, [esp + 0x270]
mov dword [esp + 0x388], ebp
call fcn.0040c6d0
cmp byte [esp + 0x384], 0
lea eax, [esp + 0x274]
jne 0x406ca1
mov eax, dword [esp + 0x270]
mov edi, dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
add eax, 4
push eax
push 0
push 0
push 0x1a
push 0
call edi
test eax, eax
je 0x406da2
xor eax, eax
cmp dword [esp + 0x388], eax
je 0x406ccf
mov dword [esp + 0x388], eax
mov ecx, 1
lea esi, [esp + 0x270]
mov dword [esp + 0x26c], eax
call fcn.0040c6d0
cmp byte [esp + 0x384], 0
lea eax, [esp + 0x274]
jne 0x406cff
mov eax, dword [esp + 0x270]
xor ecx, ecx
mov word [eax + 4], cx
mov ecx, ebp
lea esi, [esp + 0x270]
mov dword [esp + 0x388], ebp
call fcn.0040c6d0
cmp byte [esp + 0x384], 0
lea eax, [esp + 0x274]
jne 0x406d32
mov eax, dword [esp + 0x270]
add eax, 4
push eax
push 1
push 0
push 0x1a
push 0
call edi
test eax, eax
je 0x406da2
lea eax, [esp + 0x268]
call fcn.0040bf20
mov eax, ebx
call fcn.0040ba40
push 0x441c9c
push 0x441f54
mov edx, eax
call fcn.0040c340
add esp, 8
cmp byte [esp + 0x384], 0
mov dword [esp + method.t_str.virtual_0], vtable.t_str.0
jne 0x406d9b
mov eax, dword [esp + 0x270]
lea edx, [esp + 0x274]
cmp eax, edx
je 0x406d9b
push eax
call fcn.004229f3
add esp, 4
xor al, al
jmp 0x4070cf
lea edi, [esp + 0x268]
call fcn.0040c180
cmp byte [esp + 0x384], 0
lea esi, [esp + 0x274]
jne 0x406dc6
mov esi, dword [esp + 0x270]
lea edi, [esp + 0x140]
call fcn.0040bd50
lea eax, [esi + 4]
mov edx, edi
call fcn.0040bf70
mov byte [esp + 0x4c4], 0
cmp byte [esp + 0x25c], 0
lea eax, [esp + 0x14c]
jne 0x406dfc
mov eax, dword [esp + 0x148]
mov esi, dword [esp + 0x18]
lea ebp, [esi + 0x254]
add eax, 4
mov edx, ebp
call fcn.0040bf70
cmp byte [esp + 0x25c], 0
mov ebx, vtable.t_str.0
mov dword [esp + 0x140], ebx
jne 0x406e41
mov eax, dword [esp + 0x148]
lea ecx, [esp + 0x14c]
cmp eax, ecx
je 0x406e41
push eax
call fcn.004229f3
add esp, 4
cmp byte [esi + 4], 0
je 0x406ffe
cmp byte [ebp + 0x11c], 0
lea eax, [ebp + 0xc]
jne 0x406e5a
mov eax, dword [ebp + 8]
add eax, 4
push 0x5c
push eax
call fcn.0042454b
add esp, 8
test eax, eax
jne 0x406e7f
cmp byte [ebp + 0x11c], al
lea eax, [ebp + 0xc]
jne 0x406e7a
mov eax, dword [ebp + 8]
add eax, 4
jmp 0x406e82
add eax, 2
push eax
lea edi, [esp + 0x144]
call fcn.0040be80
mov ecx, str.Application_Data
mov eax, edi
call fcn.0040c050
test al, al
je 0x406fca
cmp byte [esp + 0x25c], 0
lea eax, [esp + 0x14c]
jne 0x406ebb
mov eax, dword [esp + 0x148]
push 2
add eax, 4
push 0x441820
push eax
call fcn.004245a1
add esp, 0xc
test eax, eax
je 0x406fca
mov ebx, str.AppDataRoaming
xor edx, edx
cmp edx, ebx
jne 0x406ee6
mov ebx, 0x442128
mov eax, ebx
lea edx, [eax + 2]
jmp 0x406ef0
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x406ef0
sub eax, edx
sar eax, 1
lea edi, [eax + 1]
mov ecx, edi
lea esi, [esp + 0x148]
mov dword [esp + 0x144], eax
call fcn.0040c6d0
cmp byte [esp + 0x25c], 0
lea eax, [esp + 0x14c]
jne 0x406f2f
mov eax, dword [esp + 0x148]
lea ecx, [edi + edi]
push ecx
add eax, 4
push ebx
push eax
call fcn.00429cf0
add esp, 0xc
lea eax, [esp + 0x390]
call fcn.0040abc0
push ebp
lea ebx, [esp + 0x394]
mov byte [esp + 0x4c8], 3
call fcn.0040b7c0
cmp byte [esp + 0x25c], 0
lea esi, [esp + 0x14c]
jne 0x406f79
mov esi, dword [esp + 0x148]
lea edi, [esp + 0x1c]
call fcn.0040bd50
lea eax, [esi + 4]
mov edx, edi
call fcn.0040bf70
mov eax, edi
lea esi, [esp + 0x390]
call fcn.0040aef0
mov eax, edi
call fcn.0040ae60
mov ecx, ebp
call fcn.0040b120
test al, al
je 0x406fb5
mov eax, esi
mov edx, ebp
call fcn.0040af40
lea eax, [esp + 0x390]
call fcn.0040ae60
mov esi, dword [esp + 0x18]
mov ebx, vtable.t_str.0
mov byte [esp + 0x4c4], 0
cmp byte [esp + 0x25c], 0
mov dword [esp + 0x140], ebx
jne 0x406ffe
mov eax, dword [esp + 0x148]
lea edx, [esp + 0x14c]
cmp eax, edx
je 0x406ffe
push eax
call fcn.004229f3
add esp, 4
call fcn.00408ef0
test al, al
jne 0x4070a1
push str.Current_AppdataPath:
lea edi, [esp + 0x144]
call fcn.0040be80
mov byte [esp + 0x4c4], 5
cmp byte [esi + 0x370], 0
lea eax, [esi + 0x260]
jne 0x407039
mov eax, dword [esi + 0x25c]
add eax, 4
push eax
push 0x441f54
lea edx, [esp + 0x148]
call fcn.0040c340
add esp, 8
cmp byte [esp + 0x25c], 0
lea eax, [esp + 0x14c]
jne 0x407069
mov eax, dword [esp + 0x148]
add eax, 4
push eax
call fcn.00409060
add esp, 4
cmp byte [esp + 0x25c], 0
mov dword [esp + 0x140], ebx
jne 0x4070a1
mov eax, dword [esp + 0x148]
lea ecx, [esp + 0x14c]
cmp eax, ecx
je 0x4070a1
push eax
call fcn.004229f3
add esp, 4
cmp byte [esp + 0x384], 0
mov dword [esp + 0x268], ebx
jne 0x4070cd
mov eax, dword [esp + 0x270]
lea edx, [esp + 0x274]
cmp eax, edx
je 0x4070cd
push eax
call fcn.004229f3
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x4bc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x4a4]
xor ecx, esp
call fcn.004223b0
add esp, 0x4b4
ret 4