Function at 0x416230
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x439190]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
xor ebx, ebx
push 0x103
lea eax, [ebp - 0x107]
push ebx
push eax
mov byte [ebp - 0x108], bl
call fcn.00419b60
mov eax, dword [ebp + 8]
add esp, 0xc
mov byte [esi], bl
cmp eax, 0x12c
jg 0x41635c
je 0x416307
add eax, 0xffffff9c
cmp eax, 5
ja case.0x416371.303
jmp dword [eax*4 + 0x41653c]
push 0x103
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x5c
push esi
call fcn.0041a030
add esp, 8
cmp eax, ebx
je case.0x416371.303
mov byte [eax], bl
jmp case.0x416371.303
push esi
push 0x103
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
jmp 0x41629b
push 1
push 0x26
push esi
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
jmp case.0x416371.303
push 1
push 0x1a
push esi
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
jmp case.0x416371.303
push 1
push 0x25
push esi
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
jmp case.0x416371.303
push 1
push 5
push esi
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
jmp case.0x416371.303
push 0x103
lea ecx, [ebp - 0x20b]
push ebx
push ecx
mov byte [ebp - 0x20c], bl
call fcn.00419b60
add esp, 0xc
push 1
push 0x26
lea edx, [ebp - 0x20c]
push edx
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
cmp eax, 1
jne case.0x416371.303
push 0x430010
lea eax, [ebp - 0x20c]
push eax
push 0x432f7c
push esi
call fcn.0041874b
add esp, 0x10
jmp case.0x416371.303
add eax, 0xfffffed3
cmp eax, 0x6c
ja case.0x416371.303
movzx ecx, byte [eax + 0x416584]
jmp dword [ecx*4 + 0x416554]
push 0x103
lea edx, [ebp - 0x20b]
push ebx
push edx
mov byte [ebp - 0x20c], bl
call fcn.00419b60
push ebx
lea eax, [ebp - 0x20c]
push eax
push 0x12c
call fcn.00416230
push str.Agent
lea ecx, [ebp - 0x20c]
push ecx
push 0x432f7c
push esi
call fcn.0041874b
add esp, 0x28
jmp case.0x416371.303
push 0x103
lea edx, [ebp - 0x20b]
push ebx
push edx
mov byte [ebp - 0x20c], bl
call fcn.00419b60
push ebx
lea eax, [ebp - 0x20c]
push eax
push 0x67
call fcn.00416230
push 0x430010
jmp 0x4163a7
push ebx
lea edx, [ebp - 0x108]
push edx
push 0x64
call fcn.00416230
push str.AgentFiles_agentfile.list
lea eax, [ebp - 0x108]
push eax
jmp 0x4164f0
push ebx
lea ecx, [ebp - 0x108]
push ecx
push 0x64
call fcn.00416230
push str.AgentSetupAgent.nsi
lea edx, [ebp - 0x108]
push edx
jmp 0x4164f0
push ebx
lea eax, [ebp - 0x108]
push eax
push 0x64
call fcn.00416230
push str.AgentSetupAgentSetup.nsi
jmp 0x4164e9
push ebx
lea edx, [ebp - 0x108]
push edx
push 0x64
call fcn.00416230
push str.AgentSetupmakensis.exe
lea eax, [ebp - 0x108]
push eax
jmp 0x4164f0
push ebx
lea ecx, [ebp - 0x108]
push ecx
push 0x64
call fcn.00416230
push str.AgentSetupTFG_Agent_Setup.exe
lea edx, [ebp - 0x108]
push edx
jmp 0x4164f0
push ebx
lea eax, [ebp - 0x108]
push eax
push 0x64
call fcn.00416230
push str.AgentSetup
jmp 0x4164e9
push ebx
lea edx, [ebp - 0x108]
push edx
push 0x64
call fcn.00416230
push str.AgentFiles
lea eax, [ebp - 0x108]
push eax
jmp 0x4164f0
push ebx
lea ecx, [ebp - 0x108]
push ecx
push 0x64
call fcn.00416230
push str.centerfile.list
lea edx, [ebp - 0x108]
push edx
jmp 0x4164f0
push ebx
lea eax, [ebp - 0x108]
push eax
push 0x64
call fcn.00416230
push str.agentfile.list
lea ecx, [ebp - 0x108]
push ecx
push 0x432f7c
push esi
call fcn.0041874b
add esp, 0x1c
mov eax, esi
cmp byte [ebp + 0x10], bl
je 0x41652b
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x416508
sub eax, edx
je 0x416529
push esi
call fcn.00415d80
add esp, 4
test eax, eax
jne 0x416529
push esi
call fcn.00415db0
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.004180c9
mov esp, ebp
pop ebp
ret