Function at 0x41be20
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ce3c9
mov eax, dword fs:[0]
push eax
sub esp, 0x380
mov eax, dword [0x4fbf60]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
test byte [0x5022fc], 1
jne 0x41be73
or dword [0x5022fc], 1
push 0x4d1170
mov dword [0x5022a4], ebx
call fcn.0047f953
add esp, 4
cmp byte [0x502198], 0
jne 0x41c3a3
push 0x1f8
mov byte [0x502198], 1
call fcn.0047f786
add esp, 4
cmp eax, ebx
je 0x41bea1
call fcn.0041c700
mov esi, eax
jmp 0x41bea3
xor esi, esi
mov dword [ebp - 0x38c], esi
push ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [esi + 0x1c]
mov dword [ebp - 0x358], eax
lea eax, [esi + 0x38]
lea ecx, [esi + 0x8c]
mov dword [ebp - 0x354], eax
mov dword [ebp - 0x350], ecx
lea edx, [esi + 0x70]
lea eax, [esi + 0x54]
lea ecx, [esi + 0xa8]
mov dword [ebp - 0x34c], edx
mov dword [ebp - 0x348], eax
mov dword [ebp - 0x344], ecx
lea edx, [esi + 0xc4]
lea eax, [esi + 0xfc]
lea ecx, [esi + 0xe0]
mov dword [ebp - 0x340], edx
mov dword [ebp - 0x33c], eax
mov dword [ebp - 0x338], ecx
lea edx, [esi + 0x118]
lea eax, [esi + 0x134]
lea ecx, [esi + 0x150]
mov dword [ebp - 0x334], edx
mov dword [ebp - 0x330], eax
mov dword [ebp - 0x32c], ecx
mov dword [ebp - 0x378], ebx
lea edx, [ebp - 0x378]
push edx
push 0x4df3d8
push 1
push ebx
push 0x4d293c
mov byte [ebp - 4], 1
call dword [sym.imp.ole32.dll_CoCreateInstance]
cmp eax, ebx
jge 0x41bf67
mov dword [ebp - 0x378], ebx
jmp 0x41bf75
mov eax, dword [ebp - 0x378]
cmp eax, ebx
jne 0x41c3d0
mov eax, 0x1c
mov dword [ebp - 0x24c], eax
mov dword [ebp - 0x248], eax
mov eax, 5
mov dword [ebp - 0x244], eax
mov dword [ebp - 0x240], 0x28
mov dword [ebp - 0x23c], 0x14
mov dword [ebp - 0x238], ebx
mov dword [ebp - 0x234], 0x1a
mov dword [ebp - 0x230], 0x21
mov dword [ebp - 0x22c], 0xb
mov dword [ebp - 0x228], 0x24
mov dword [ebp - 0x224], eax
mov dword [ebp - 0x220], 0x29
xor edi, edi
jmp 0x41bff0
push 0x208
lea ecx, [ebp - 0x21a]
xor eax, eax
push ebx
push ecx
mov word [ebp - 0x21c], ax
call fcn.00483200
mov eax, dword [ebp + edi - 0x24c]
add esp, 0xc
lea edx, [ebp - 0x21c]
push edx
push ebx
push ebx
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x41c05e
mov ecx, dword [ebp + edi - 0x358]
lea eax, [ebp - 0x21c]
lea ebx, [eax + 2]
lea ebx, [ebx]
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x41c040
sub eax, ebx
sar eax, 1
push eax
lea edx, [ebp - 0x21c]
push edx
call fcn.004028fc
xor ebx, ebx
add edi, 4
cmp edi, 0x30
jb 0x41bff0
push 0x208
lea ecx, [ebp - 0x21a]
xor eax, eax
push ebx
push ecx
mov word [ebp - 0x21c], ax
call fcn.00483200
add esp, 0xc
lea edx, [ebp - 0x21c]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x21c]
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x41c0a0
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x21c]
push eax
mov ecx, esi
call fcn.004028fc
xor ecx, ecx
push 0xa
mov word [ebp - 0x328], cx
push 0x4decd0
lea ecx, [ebp - 0x328]
mov dword [ebp - 0x314], 7
mov dword [ebp - 0x318], ebx
call fcn.004028fc
lea ebx, [ebp - 0x328]
lea ecx, [esi + 0x1c]
lea edi, [ebp - 0x374]
mov byte [ebp - 4], 2
call fcn.0041c970
push eax
lea ecx, [esi + 0x16c]
mov byte [ebp - 4], 3
call fcn.004132a0
cmp dword [ebp - 0x360], 8
jb 0x41c129
mov edx, dword [ebp - 0x374]
push edx
call fcn.0047f3b4
add esp, 4
xor ebx, ebx
xor eax, eax
mov edi, 7
mov byte [ebp - 4], 1
cmp dword [ebp - 0x314], 8
mov dword [ebp - 0x360], edi
mov dword [ebp - 0x364], ebx
mov word [ebp - 0x374], ax
jb 0x41c161
mov ecx, dword [ebp - 0x328]
push ecx
call fcn.0047f3b4
add esp, 4
push 5
xor edx, edx
push str.Panel
lea ecx, [ebp - 0x374]
mov dword [ebp - 0x360], edi
mov dword [ebp - 0x364], ebx
mov word [ebp - 0x374], dx
call fcn.004028fc
mov byte [ebp - 4], 4
push 6
xor eax, eax
push 0x4decf4
lea ecx, [ebp - 0x328]
mov dword [ebp - 0x314], edi
mov dword [ebp - 0x318], ebx
mov word [ebp - 0x328], ax
call fcn.004028fc
lea ebx, [ebp - 0x328]
lea ecx, [esi + 0x1c]
lea edi, [ebp - 0x344]
mov byte [ebp - 4], 5
call fcn.0041c970
lea ebx, [ebp - 0x374]
mov ecx, eax
lea edi, [ebp - 0x238]
mov byte [ebp - 4], 6
call fcn.0041c970
mov ebx, 7
push eax
lea ecx, [esi + 0x188]
mov byte [ebp - 4], bl
call fcn.004132a0
mov edi, 8
cmp dword [ebp - 0x224], edi
jb 0x41c212
mov ecx, dword [ebp - 0x238]
push ecx
call fcn.0047f3b4
add esp, 4
xor edx, edx
mov dword [ebp - 0x224], ebx
mov dword [ebp - 0x228], 0
mov word [ebp - 0x238], dx
cmp dword [ebp - 0x330], edi
jb 0x41c242
mov eax, dword [ebp - 0x344]
push eax
call fcn.0047f3b4
add esp, 4
xor ecx, ecx
mov dword [ebp - 0x330], ebx
mov dword [ebp - 0x334], 0
mov word [ebp - 0x344], cx
cmp dword [ebp - 0x314], edi
jb 0x41c272
mov edx, dword [ebp - 0x328]
push edx
call fcn.0047f3b4
add esp, 4
xor eax, eax
mov byte [ebp - 4], 1
mov dword [ebp - 0x314], ebx
mov dword [ebp - 0x318], 0
mov word [ebp - 0x328], ax
cmp dword [ebp - 0x360], edi
jb 0x41c2a6
mov ecx, dword [ebp - 0x374]
push ecx
call fcn.0047f3b4
add esp, 4
lea edx, [ebp - 0x344]
push edx
mov edi, str.Kometa
lea ebx, [esi + 0x1c]
call fcn.00421040
add esp, 4
lea ebx, [esi + 0x1a4]
push eax
mov ecx, ebx
mov byte [ebp - 4], 8
call fcn.004132a0
mov byte [ebp - 4], 1
cmp dword [ebp - 0x330], 8
jb 0x41c2eb
mov eax, dword [ebp - 0x344]
push eax
call fcn.0047f3b4
add esp, 4
lea ecx, [ebp - 0x344]
push ecx
mov edi, str.Application
call fcn.00421040
add esp, 4
push eax
lea ecx, [esi + 0x1c0]
mov byte [ebp - 4], 9
call fcn.004132a0
mov byte [ebp - 4], 1
cmp dword [ebp - 0x330], 8
jb 0x41c32b
mov edx, dword [ebp - 0x344]
push edx
call fcn.0047f3b4
add esp, 4
lea eax, [ebp - 0x344]
push eax
mov edi, str.User_Data
call fcn.00421040
add esp, 4
push eax
lea ecx, [esi + 0x1dc]
mov byte [ebp - 4], 0xa
call fcn.004132a0
cmp dword [ebp - 0x330], 8
jb 0x41c367
mov ecx, dword [ebp - 0x344]
push ecx
call fcn.0047f3b4
add esp, 4
mov edi, dword [0x5022a4]
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x378]
mov dword [0x5022a4], esi
mov dword [ebp - 0x38c], edi
test eax, eax
je 0x41c38f
mov edx, dword [eax]
push eax
mov eax, dword [edx + 8]
call eax
test edi, edi
je 0x41c3a3
mov esi, edi
call fcn.0041baa0
push edi
call fcn.0047f3b4
add esp, 4
movzx eax, byte [0x4ffc06]
neg eax
sbb eax, eax
and eax, dword [0x5022a4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0047f164
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x4d28bc]
mov edx, dword [0x4d28c0]
mov dword [ebp - 0x30c], ecx
mov ecx, dword [0x4d28c4]
mov dword [ebp - 0x308], edx
mov edx, dword [0x4d28c8]
mov dword [ebp - 0x304], ecx
mov ecx, dword [0x4d28cc]
mov dword [ebp - 0x300], edx
mov edx, dword [0x4d28d0]
mov dword [ebp - 0x2fc], ecx
mov ecx, dword [0x4d28d4]
mov dword [ebp - 0x2f8], edx
mov edx, dword [0x4d28d8]
mov dword [ebp - 0x2f4], ecx
mov ecx, dword [0x4d289c]
mov dword [ebp - 0x2f0], edx
mov edx, dword [0x4d28a0]
mov dword [ebp - 0x2ec], ecx
mov ecx, dword [0x4d28a4]
mov dword [ebp - 0x2e8], edx
mov edx, dword [0x4d28a8]
mov dword [ebp - 0x2e4], ecx
mov ecx, dword [0x4d290c]
mov dword [ebp - 0x2e0], edx
mov edx, dword [0x4d2910]
mov dword [ebp - 0x2dc], ecx
mov ecx, dword [0x4d2914]
mov dword [ebp - 0x2d8], edx
mov edx, dword [0x4d2918]
mov dword [ebp - 0x2d4], ecx
mov ecx, dword [0x4d286c]
mov dword [ebp - 0x2d0], edx
mov edx, dword [0x4d2870]
mov dword [ebp - 0x2cc], ecx
mov ecx, dword [0x4d2874]
mov dword [ebp - 0x2c8], edx
mov edx, dword [0x4d2878]
mov dword [ebp - 0x2c4], ecx
mov ecx, dword [0x4d287c]
mov dword [ebp - 0x2c0], edx
mov edx, dword [0x4d2880]
mov dword [ebp - 0x2bc], ecx
mov ecx, dword [0x4d2884]
mov dword [ebp - 0x2b8], edx
mov edx, dword [0x4d2888]
mov dword [ebp - 0x2b4], ecx
mov ecx, dword [0x4d28ac]
mov dword [ebp - 0x2b0], edx
mov edx, dword [0x4d28b0]
mov dword [ebp - 0x2ac], ecx
mov ecx, dword [0x4d28b4]
mov dword [ebp - 0x2a8], edx
mov edx, dword [0x4d28b8]
mov dword [ebp - 0x2a4], ecx
mov ecx, dword [0x4d28dc]
mov dword [ebp - 0x2a0], edx
mov edx, dword [0x4d28e0]
mov dword [ebp - 0x29c], ecx
mov ecx, dword [0x4d28e4]
mov dword [ebp - 0x298], edx
mov edx, dword [0x4d28e8]
mov dword [ebp - 0x294], ecx
mov ecx, dword [0x4d288c]
mov dword [ebp - 0x290], edx
mov edx, dword [0x4d2890]
mov dword [ebp - 0x28c], ecx
mov ecx, dword [0x4d2894]
mov dword [ebp - 0x288], edx
mov edx, dword [0x4d2898]
mov dword [ebp - 0x284], ecx
mov ecx, dword [0x4d28fc]
mov dword [ebp - 0x280], edx
mov edx, dword [0x4d2900]
mov dword [ebp - 0x27c], ecx
mov ecx, dword [0x4d2904]
mov dword [ebp - 0x278], edx
mov edx, dword [0x4d2908]
mov dword [ebp - 0x274], ecx
mov ecx, dword [0x4d291c]
mov dword [ebp - 0x270], edx
mov edx, dword [0x4d2920]
mov dword [ebp - 0x26c], ecx
mov ecx, dword [0x4d2924]
mov dword [ebp - 0x268], edx
mov edx, dword [0x4d2928]
mov dword [ebp - 0x264], ecx
mov ecx, dword [0x4d28ec]
mov dword [ebp - 0x260], edx
mov edx, dword [0x4d28f0]
mov dword [ebp - 0x25c], ecx
mov ecx, dword [0x4d28f4]
mov dword [ebp - 0x258], edx
mov edx, dword [0x4d28f8]
mov dword [ebp - 0x254], ecx
lea ecx, [ebp - 0x30c]
mov dword [ebp - 0x250], edx
mov dword [ebp - 0x384], ebx
mov dword [ebp - 0x37c], ecx
jmp 0x41c636
mov eax, dword [ebp - 0x378]
mov dword [ebp - 0x388], ebx
cmp eax, ebx
je 0x41c6f0
mov edx, dword [eax]
mov edx, dword [edx + 0x18]
lea ecx, [ebp - 0x388]
push ecx
mov ecx, dword [ebp - 0x37c]
push ecx
push eax
call edx
mov eax, dword [ebp - 0x388]
cmp eax, ebx
je 0x41c6ce
lea edx, [ebp - 0x380]
push edx
mov dword [ebp - 0x380], ebx
mov ecx, dword [eax]
push 0x8000
push eax
mov eax, dword [ecx + 0x18]
call eax
mov edx, dword [ebp - 0x380]
cmp edx, ebx
je 0x41c6c0
mov eax, edx
lea edi, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x41c690
mov ecx, dword [ebp - 0x384]
mov ecx, dword [ebp + ecx*4 - 0x358]
sub eax, edi
sar eax, 1
push eax
push edx
call fcn.004028fc
mov edx, dword [ebp - 0x380]
push edx
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov eax, dword [ebp - 0x388]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [ebp - 0x384]
add dword [ebp - 0x37c], 0x10
inc eax
mov dword [ebp - 0x384], eax
cmp eax, 0xc
jb 0x41c630
jmp 0x41c066
push 0x80004003
call fcn.0049ab80
int3