Function at 0x46ba23
Capabilities:
Get common file path
Get program files directory

Disassembly:
push 0x450
mov eax, 0x4e159e
call fcn.004b5417
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
mov eax, dword [eax - 0xc]
mov dword [ebp - 0x448], ebx
test eax, eax
jne 0x46ba4a
call fcn.004b549a
ret
lea ecx, [ebp - 0x438]
call fcn.0040c7d0
and dword [ebp - 4], 0
mov eax, dword [ebx]
mov esi, str.CLSID:
lea edi, [ebp - 0x20]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 6
movsd dword es:[edi], dword [esi]
lea ecx, [ebp - 0x20]
push ecx
push eax
movsw word es:[edi], word [esi]
call dword [sym.imp.SHLWAPI.dll_StrCmpNIW]
test eax, eax
jne 0x46bb94
mov eax, dword [ebx]
mov eax, dword [eax - 0xc]
add eax, 0xfffffffa
push eax
lea eax, [ebp - 0x434]
push eax
mov ecx, ebx
call fcn.0046a66c
mov byte [ebp - 4], 1
push dword [eax]
lea eax, [ebp - 0x430]
push str.CLSID_sInprocServer32
push 0x208
push eax
call fcn.00411380
add esp, 0x10
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x434]
call fcn.0040d610
lea eax, [ebp - 0x438]
push eax
push dword [ebp + 0xc]
push ecx
mov ecx, esp
mov dword [ebp - 0x448], esp
push 0x50ea8c
call fcn.0044bc85
mov byte [ebp - 4], 2
push ecx
lea eax, [ebp - 0x430]
mov ecx, esp
mov dword [ebp - 0x440], esp
push eax
call fcn.0044bc85
mov byte [ebp - 4], 3
push 0x80000000
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x45c]
call fcn.00443769
mov byte [ebp - 4], 4
push eax
call fcn.0044b15c
pop ecx
pop ecx
mov esi, eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x45c]
call fcn.00443c39
test esi, esi
je 0x46bb90
push dword [ebp - 0x438]
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
test eax, eax
je 0x46bb90
sub eax, dword [ebp - 0x438]
lea ecx, [ebp - 0x438]
sar eax, 1
push eax
lea eax, [ebp - 0x434]
push eax
call fcn.00443dba
mov byte [ebp - 4], 5
push eax
mov ecx, ebx
call fcn.00446840
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x434]
call fcn.0040d610
xor esi, esi
inc esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x438]
call fcn.0040d610
mov eax, esi
jmp 0x46ba44
xor esi, esi
jmp 0x46bb7a
cmp byte [0x53f288], 0
mov esi, 0x53f28c
mov edi, str.commonfiles_x64_
jne 0x46c223
mov ebx, 0x104
push ebx
lea eax, [ebp - 0x430]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea eax, [ebp - 0x430]
push eax
call dword [sym.imp.SHLWAPI.dll_PathStripToRootW]
push 0x4fe440
lea ecx, [ebp - 0x43c]
call fcn.0044bc85
mov byte [ebp - 4], 6
lea eax, [ebp - 0x43c]
push eax
mov ecx, esi
call fcn.004575a2
lea ecx, [ebp - 0x430]
push ecx
mov ecx, eax
call fcn.00428d50
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x43c]
call fcn.0040d610
and dword [ebp - 0x43c], 0
mov eax, dword [ebp - 0x43c]
push 0
push dword [eax + 0x4fe364]
lea eax, [ebp - 0x228]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x46bc78
mov eax, dword [ebp - 0x43c]
push dword [eax + 0x4fe360]
lea ecx, [ebp - 0x434]
call fcn.0044bc85
mov byte [ebp - 4], 7
lea eax, [ebp - 0x434]
push eax
mov ecx, esi
call fcn.004575a2
lea ecx, [ebp - 0x228]
push ecx
mov ecx, eax
call fcn.00428d50
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x434]
call fcn.0040d610
add dword [ebp - 0x43c], 8
cmp dword [ebp - 0x43c], 0xe0
jb 0x46bc11
xor eax, eax
cmp dword [0x53f2b4], eax
je 0x46be90
push eax
push 0x26
lea ecx, [ebp - 0x228]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x46be90
lea eax, [ebp - 0x228]
push eax
call fcn.004b5ec7
lea eax, [ebp + eax*2 - 0x234]
mov dword [esp], str.__x86_
push eax
mov dword [ebp - 0x434], eax
call fcn.004b58df
pop ecx
pop ecx
test eax, eax
jne 0x46be90
mov ecx, dword [ebp - 0x434]
mov word [ecx], ax
push str.programfiles_x64_
lea ecx, [ebp - 0x434]
call fcn.0044bc85
mov byte [ebp - 4], 8
lea eax, [ebp - 0x434]
push eax
mov ecx, esi
call fcn.004575a2
lea ecx, [ebp - 0x228]
push ecx
mov ecx, eax
call fcn.00428d50
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x434]
call fcn.0040d610
push str.Common_Files
push ebx
lea eax, [ebp - 0x228]
push eax
call fcn.0040b680
push edi
lea ecx, [ebp - 0x434]
call fcn.0044bc85
mov byte [ebp - 4], 9
lea eax, [ebp - 0x434]
push eax
mov ecx, esi
call fcn.004575a2
lea ecx, [ebp - 0x228]
push ecx
mov ecx, eax
call fcn.00428d50
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x434]
call fcn.0040d610
push edi
lea ecx, [ebp - 0x43c]
call fcn.0044bc85
mov byte [ebp - 4], 0xa
push str._office2010x64sharedir_
lea ecx, [ebp - 0x434]
call fcn.0044bc85
mov byte [ebp - 4], 0xb
mov ebx, str.Microsoft_Shared
push ebx
lea eax, [ebp - 0x43c]
push eax
mov ecx, esi
call fcn.004575a2
push eax
lea eax, [ebp - 0x440]
push eax
call fcn.00445250
add esp, 0xc
mov byte [ebp - 4], 0xc
push eax
lea eax, [ebp - 0x434]
push eax
mov ecx, esi
call fcn.004575a2
mov ecx, eax
call fcn.00446840
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x440]
call fcn.0040d610
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x434]
call fcn.0040d610
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x43c]
call fcn.0040d610
push edi
lea ecx, [ebp - 0x43c]
call fcn.0044bc85
mov byte [ebp - 4], 0xd
push str._office2013x64sharedir_
lea ecx, [ebp - 0x434]
call fcn.0044bc85
mov byte [ebp - 4], 0xe
push ebx
lea eax, [ebp - 0x43c]
push eax
mov ecx, esi
call fcn.004575a2
push eax
lea eax, [ebp - 0x440]
push eax
call fcn.00445250
add esp, 0xc
mov byte [ebp - 4], 0xf
push eax
lea eax, [ebp - 0x434]
push eax
mov ecx, esi
call fcn.004575a2
mov ecx, eax
call fcn.00446840
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x440]
call fcn.0040d610
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x434]
call fcn.0040d610
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x43c]
call fcn.0040d610
push 0
push 0x2b
lea eax, [ebp - 0x228]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x46c115
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x438]
push str._sMicrosoft_SharedOFFICE9
push eax
call fcn.0040e3f0
mov ebx, dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
add esp, 0xc
push dword [ebp - 0x438]
call ebx
test eax, eax
je 0x46bf17
push str._office2000commdir_
lea ecx, [ebp - 0x434]
call fcn.0044bc85
mov byte [ebp - 4], 0x10
lea eax, [ebp - 0x434]
push eax
mov ecx, esi
call fcn.004575a2
lea ecx, [ebp - 0x438]
push ecx
mov ecx, eax
call fcn.004453ce
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x434]
call fcn.0040d610
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x438]
push str._sMicrosoft_SharedOFFICE10
push eax
call fcn.0040e3f0
add esp, 0xc
push dword [ebp - 0x438]
call ebx
test eax, eax
je 0x46bf7d
push str._office2002commdir_
lea ecx, [ebp - 0x434]
call fcn.0044bc85
mov byte [ebp - 4], 0x11
lea eax, [ebp - 0x434]
push eax
mov ecx, esi
call fcn.004575a2
lea ecx, [ebp - 0x438]
push ecx
mov ecx, eax
call fcn.004453ce
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x434]
call fcn.0040d610
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x438]
push str._sMicrosoft_SharedOFFICE11
push eax
call fcn.0040e3f0
add esp, 0xc
push dword [ebp - 0x438]
call ebx
test eax, eax
je 0x46bfe3
push str._office2003commdir_
lea ecx, [ebp - 0x434]
call fcn.0044bc85
mov byte [ebp - 4], 0x12
lea eax, [ebp - 0x434]
push eax
mov ecx, esi
call fcn.004575a2
lea ecx, [ebp - 0x438]
push ecx
mov ecx, eax
call fcn.004453ce
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x434]
call fcn.0040d610
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x438]
push str._sMicrosoft_SharedOFFICE12
push eax
call fcn.0040e3f0
add esp, 0xc
push dword [ebp - 0x438]
call ebx
test eax, eax
je 0x46c049
push str._office2007commdir_
lea ecx, [ebp - 0x434]
call fcn.0044bc85
mov byte [ebp - 4], 0x13
lea eax, [ebp - 0x434]
push eax
mov ecx, esi
call fcn.004575a2
lea ecx, [ebp - 0x438]
push ecx
mov ecx, eax
call fcn.004453ce
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x434]
call fcn.0040d610
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x438]
push str._sMicrosoft_SharedOFFICE14
push eax
call fcn.0040e3f0
add esp, 0xc
push dword [ebp - 0x438]
call ebx
test eax, eax
je 0x46c0af
push str._office2010commdir_
lea ecx, [ebp - 0x434]
call fcn.0044bc85
mov byte [ebp - 4], 0x14
lea eax, [ebp - 0x434]
push eax
mov ecx, esi
call fcn.004575a2
lea ecx, [ebp - 0x438]
push ecx
mov ecx, eax
call fcn.004453ce
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x434]
call fcn.0040d610
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x438]
push str._sMicrosoft_SharedOFFICE15
push eax
call fcn.0040e3f0
add esp, 0xc
push dword [ebp - 0x438]
call ebx
test eax, eax
je 0x46c115
push str._office2013commdir_
lea ecx, [ebp - 0x434]
call fcn.0044bc85
mov byte [ebp - 4], 0x15
lea eax, [ebp - 0x434]
push eax
mov ecx, esi
call fcn.004575a2
lea ecx, [ebp - 0x438]
push ecx
mov ecx, eax
call fcn.004453ce
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x434]
call fcn.0040d610
xor ebx, ebx
lea eax, [ebp - 0x438]
push eax
push dword [ebx + 0x4fdc20]
push ecx
mov ecx, esp
mov dword [ebp - 0x440], esp
push str.Path
call fcn.0044bc85
mov byte [ebp - 4], 0x16
push ecx
mov ecx, esp
mov dword [ebp - 0x43c], esp
push dword [ebx + 0x4fdc1c]
call fcn.0044bc85
mov byte [ebp - 4], 0x17
push 0x80000002
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x45c]
call fcn.00443769
mov byte [ebp - 4], 0x18
push eax
call fcn.0044b15c
pop ecx
pop ecx
mov dword [ebp - 0x440], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x45c]
call fcn.00443c39
cmp dword [ebp - 0x440], 0
je 0x46c207
mov eax, dword [ebp - 0x438]
mov eax, dword [eax - 0xc]
test eax, eax
jle 0x46c207
dec eax
push eax
lea ecx, [ebp - 0x438]
call fcn.0040c870
cmp ax, 0x5c
jne 0x46c1c7
mov eax, dword [ebp - 0x438]
mov eax, dword [eax - 0xc]
dec eax
push eax
lea ecx, [ebp - 0x438]
call fcn.0040d6b0
push dword [ebx + 0x4fdc18]
lea ecx, [ebp - 0x434]
call fcn.0044bc85
mov byte [ebp - 4], 0x19
lea eax, [ebp - 0x434]
push eax
mov ecx, esi
call fcn.004575a2
lea ecx, [ebp - 0x438]
push ecx
mov ecx, eax
call fcn.004453ce
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x434]
call fcn.0040d610
add ebx, 0xc
cmp ebx, 0x420
jb 0x46c117
mov ebx, dword [ebp - 0x448]
mov byte [0x53f288], 1
mov ecx, ebx
call fcn.00445121
cmp dword [0x53f2b4], 0
je 0x46c26e
cmp dword [ebp + 0xc], 0
je 0x46c26e
mov eax, dword [ebx]
push str.programfiles
push eax
call fcn.004b58df
pop ecx
pop ecx
test eax, eax
jne 0x46c253
push str.programfiles_x64_
jmp 0x46c267
mov eax, dword [ebx]
push str.commonfiles
push eax
call fcn.004b58df
pop ecx
pop ecx
test eax, eax
jne 0x46c26e
push edi
mov ecx, ebx
call fcn.00428d50
push ebx
lea eax, [ebp - 0x44c]
push eax
mov ecx, esi
call fcn.0046fdc4
push esi
push dword [0x53f2a4]
lea ecx, [ebp - 0x444]
call fcn.004424c1
lea eax, [ebp - 0x444]
push eax
lea ecx, [ebp - 0x44c]
call fcn.0043cc0e
test al, al
jne 0x46bb90
lea ecx, [ebp - 0x44c]
call fcn.00478005
add eax, 4
push eax
mov ecx, ebx
call fcn.00446840
jmp 0x46bb77