Function at 0x4449b2
Capabilities:
Get common file path

Disassembly:
push 0x2e4
mov eax, 0x5f6c7c
call fcn.004e1c06
mov dword [ebp - 0x2d8], ecx
mov ebx, dword [ebp + 8]
xor edi, edi
call fcn.00443ad2
cmp dword [ebx + 0x10], edi
je 0x444dfe
push str.Uninstall
lea ecx, [ebp - 0x2b4]
call fcn.0040ab57
lea eax, [ebp - 0x2d4]
mov dword [ebp - 4], edi
push eax
push edi
push edi
push 0x63905c
mov dword [ebp - 0x2d4], edi
call sub.SHELL32.dll_SHGetKnownFolderPath
mov esi, eax
test esi, esi
js 0x444adb
push dword [ebp - 0x2d4]
lea ecx, [ebp - 0x2f0]
call fcn.0040ab57
push 0x623a8c
mov ecx, eax
mov byte [ebp - 4], 1
call fcn.0040a742
push eax
lea ecx, [ebp - 0x2cc]
call fcn.0040a998
lea ecx, [ebp - 0x2f0]
mov byte [ebp - 4], 3
call fcn.00405a95
push ebx
lea ecx, [ebp - 0x284]
call fcn.0040ada4
push edi
push dword [ebp - 0x2d4]
lea ecx, [ebp - 0x284]
mov byte [ebp - 4], 4
call fcn.00412898
push dword [ebp - 0x2d4]
mov edi, eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
cmp edi, 0xffffffff
je 0x444a9a
mov ecx, dword [ebp - 0x2bc]
push 0x653c34
inc ecx
push ecx
push edi
lea ecx, [ebp - 0x284]
call 0x44603c
cmp dword [ebp - 0x270], 8
lea eax, [ebp - 0x284]
push dword [ebp - 0x274]
cmovae eax, dword [ebp - 0x284]
lea ecx, [ebp - 0x2b4]
push eax
call fcn.0040a6e1
lea ecx, [ebp - 0x284]
call fcn.00405a95
lea ecx, [ebp - 0x2cc]
call fcn.00405a95
jmp 0x444b9e
push 0x4e
lea eax, [ebp - 0x60]
push edi
push eax
call fcn.0041ab50
xor eax, eax
lea edi, [ebp - 0x27c]
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x27c]
push eax
call dword [sym.imp.ole32.dll_CoCreateGuid]
mov esi, eax
test esi, esi
js 0x444b8f
movzx eax, byte [ebp - 0x26d]
push eax
movzx eax, byte [ebp - 0x26e]
push eax
movzx eax, byte [ebp - 0x26f]
push eax
movzx eax, byte [ebp - 0x270]
push eax
movzx eax, byte [ebp - 0x271]
push eax
movzx eax, byte [ebp - 0x272]
push eax
movzx eax, byte [ebp - 0x273]
push eax
movzx eax, byte [ebp - 0x274]
push eax
movzx eax, word [ebp - 0x276]
push eax
movzx eax, word [ebp - 0x278]
push eax
push dword [ebp - 0x27c]
lea eax, [ebp - 0x60]
push str._08X_04X_04X_02X_02X_02X_02X_02X_02X_02X_02X
push 0x27
push eax
call fcn.0043dba2
add esp, 0x38
test eax, eax
jns 0x444b8f
push eax
push str.ScheduleDirectoryRemovalOnNextLogon_StringCchPrintf___failed._hr0x_08X
push 0x623584
push 1
call fcn.0043e026
add esp, 0x10
lea eax, [ebp - 0x60]
push eax
lea ecx, [ebp - 0x2b4]
call fcn.0040a742
xor edi, edi
xor ecx, ecx
push 7
pop eax
mov dword [ebp - 0x29c], edi
mov dword [ebp - 0x28c], edi
mov dword [ebp - 0x288], eax
mov word [ebp - 0x29c], cx
mov byte [ebp - 4], 5
test esi, esi
js 0x444d82
push 0x208
lea eax, [ebp - 0x268]
push edi
push eax
call fcn.0041ab50
add esp, 0xc
lea eax, [ebp - 0x268]
push eax
push edi
push edi
push 0x25
push edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov esi, eax
test esi, esi
js 0x444d7c
push edi
push str.cmd.exe
push 0x104
lea eax, [ebp - 0x268]
push eax
call fcn.0043c8f0
mov esi, eax
mov dword [ebp - 0x26c], esi
test esi, esi
js 0x444d7c
lea eax, [ebp - 0x268]
push eax
lea ecx, [ebp - 0x29c]
call fcn.0040aaa9
push str.__q__c_rmdir__s__q__
lea ecx, [ebp - 0x29c]
call fcn.0040a742
cmp dword [ebx + 0x14], 8
mov eax, ebx
jb 0x444c4e
mov eax, dword [ebx]
push eax
lea ecx, [ebp - 0x29c]
call fcn.0040a742
push 0x623b84
lea ecx, [ebp - 0x29c]
call fcn.0040a742
cmp dword [ebx + 0x18], edi
je 0x444d7c
cmp dword [ebx + 0x14], 8
mov edi, dword [0x68e000]
mov eax, dword [edi]
mov ecx, dword [eax + 8]
mov eax, ebx
mov dword [ebp - 0x2d0], ecx
jb 0x444c8e
mov eax, dword [ebx]
push eax
call dword [0x6147a0]
mov ecx, edi
call dword [ebp - 0x2d0]
test eax, eax
je 0x444d7c
cmp dword [ebx + 0x14], 8
mov esi, dword [0x68e000]
mov eax, dword [esi]
mov edi, dword [eax + 0xc]
mov eax, ebx
jb 0x444cba
mov eax, dword [ebx]
push eax
mov ecx, edi
call dword [0x6147a0]
mov ecx, esi
call edi
test eax, eax
jne 0x444cf5
cmp dword [ebx + 0x14], 8
mov esi, dword [0x68e000]
mov eax, dword [esi]
mov edi, dword [eax + 0xc]
mov eax, ebx
jb 0x444ce0
mov eax, dword [ebx]
push eax
mov ecx, edi
call dword [0x6147a0]
mov ecx, esi
call edi
test eax, eax
je 0x444dfe
mov edi, dword [0x68e000]
lea ecx, [ebp - 0x29c]
cmp dword [ebp - 0x288], 8
cmovae ecx, dword [ebp - 0x29c]
mov eax, dword [edi]
cmp dword [ebp - 0x2a0], 8
mov esi, dword [eax + 4]
mov eax, dword [ebp - 0x28c]
lea edx, [eax + eax]
push edx
push ecx
push 1
lea eax, [ebp - 0x2b4]
mov ecx, esi
cmovae eax, dword [ebp - 0x2b4]
push eax
push 0x623b88
push dword [ebx + 0x18]
call dword [0x6147a0]
mov ecx, edi
call esi
test eax, eax
je 0x444d62
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
js 0x444d7c
jmp 0x444d68
mov esi, dword [ebp - 0x26c]
cmp dword [ebx + 0x14], 8
jb 0x444d70
mov ebx, dword [ebx]
mov ecx, dword [ebp - 0x2d8]
push ebx
call fcn.00441c77
mov eax, dword [ebp - 0x288]
cmp eax, 8
jb 0x444dcf
mov ecx, dword [ebp - 0x29c]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x26c], eax
mov dword [ebp - 0x2d0], ecx
cmp eax, 0x1000
jb 0x444dc6
lea eax, [ebp - 0x26c]
push eax
lea eax, [ebp - 0x2d0]
push eax
call fcn.00405a41
mov eax, dword [ebp - 0x26c]
mov ecx, dword [ebp - 0x2d0]
push eax
push ecx
call fcn.00419529
pop ecx
pop ecx
and dword [ebp - 0x28c], 0
lea ecx, [ebp - 0x2b4]
xor eax, eax
mov dword [ebp - 0x288], 7
mov word [ebp - 0x29c], ax
call fcn.00405a95
mov eax, esi
call fcn.004e1bb5
ret 4
push 0x80004005
call fcn.004059b0
int3