Function at 0x466491
Capabilities:
Get common file path
Get program files directory
Query environment variable

Disassembly:
push ebp
lea ebp, [esp - 0x94]
sub esp, 0x114
mov eax, dword [0x5466b0]
xor eax, ebp
mov dword [ebp + 0x90], eax
mov eax, dword [ebp + 0x9c]
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 0x7c], eax
lea eax, [ebx + 7]
push 0x25
push eax
call fcn.004ce890
pop ecx
pop ecx
test eax, eax
je 0x466a0c
mov esi, dword [sym.imp.SHLWAPI.dll_StrCmpNIA]
sub eax, ebx
dec eax
mov edi, eax
push edi
push 0x51b84c
inc ebx
push ebx
mov dword [ebp - 0x80], edi
call esi
test eax, eax
jne 0x466560
mov edi, dword [ebp - 0x7c]
push eax
push 0x25
mov esi, 0x105
call fcn.004174b0
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
je 0x466a0c
mov esi, edi
call fcn.004174f0
mov eax, dword [esi]
push 0x51b85c
push 0
push eax
call dword [sym.imp.SHLWAPI.dll_StrRStrIA]
test eax, eax
je 0x46653b
sub eax, dword [esi]
mov edx, esi
call fcn.00404950
push esi
mov edx, 0x51b868
call fcn.004338e0
mov eax, dword [esi]
mov ecx, dword [eax - 0xc]
cmp byte [ecx + eax - 1], 0x5c
mov eax, dword [ebp - 0x80]
lea edx, [ebx + eax + 2]
push esi
je 0x466553
lea edx, [ebx + eax + 1]
call fcn.004338e0
xor eax, eax
inc eax
jmp 0x466a0e
push edi
push 0x51b874
push ebx
call esi
test eax, eax
jne 0x4665b4
mov edi, dword [ebp - 0x7c]
push eax
push 0x26
mov esi, 0x105
call fcn.004174b0
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
je 0x466a0c
mov esi, edi
call fcn.004174f0
mov eax, dword [esi]
push 0x51b88c
push 0
push eax
call dword [sym.imp.SHLWAPI.dll_StrRStrIA]
test eax, eax
je 0x46653b
sub eax, dword [esi]
mov edx, esi
call fcn.00404950
jmp 0x46653b
push edi
push 0x51b894
push ebx
call esi
test eax, eax
jne 0x466602
push 0x104
push eax
mov byte [ebp - 0x78], al
lea eax, [ebp - 0x77]
push eax
call fcn.004d7710
add esp, 0xc
push 0x105
lea eax, [ebp - 0x78]
push eax
push 0x51b8a8
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
test eax, eax
je 0x466558
mov ebx, dword [ebp - 0x7c]
lea edx, [ebp - 0x78]
call fcn.00417210
jmp 0x466558
push edi
push 0x51b8e8
push ebx
call esi
test eax, eax
je 0x4669de
push edi
push 0x51b8f8
push ebx
call esi
test eax, eax
jne 0x466627
push 0x24
jmp 0x4669dd
push edi
push 0x51b908
push ebx
call esi
test eax, eax
jne 0x46663b
push 0x25
jmp 0x4669dd
push edi
push 0x51b918
push ebx
call esi
test eax, eax
jne 0x46664f
push 0x26
jmp 0x4669dd
push edi
push 0x51b92c
push ebx
call esi
test eax, eax
jne 0x466663
push 0x1a
jmp 0x4669dd
push edi
push 0x51b93c
push ebx
call esi
test eax, eax
jne 0x466677
push 0x15
jmp 0x4669dd
push edi
push 0x51b94c
push ebx
call esi
test eax, eax
jne 0x46668b
push 5
jmp 0x4669dd
push edi
push 0x51b960
push ebx
call esi
test eax, eax
jne 0x46669f
push 0x2a
jmp 0x4669dd
push edi
push 0x51b978
push ebx
call esi
test eax, eax
jne 0x4666b3
push 0x29
jmp 0x4669dd
push edi
push 0x51b988
push ebx
call esi
test eax, eax
jne 0x4666c7
push 0x1c
jmp 0x4669dd
push edi
push 0x51b99c
push ebx
call esi
test eax, eax
jne 0x4666db
push 0x1f
jmp 0x4669dd
push edi
push 0x51b9b4
push ebx
call esi
test eax, eax
jne 0x4666ef
push 0x20
jmp 0x4669dd
push edi
push 0x51b9cc
push ebx
call esi
test eax, eax
jne 0x466703
push 0x21
jmp 0x4669dd
push edi
push 0x51b9dc
push ebx
call esi
test eax, eax
jne 0x466717
push 0x22
jmp 0x4669dd
push edi
push 0x51b9ec
push ebx
call esi
test eax, eax
jne 0x46672b
push 0x23
jmp 0x4669dd
push edi
push 0x51ba04
push ebx
call esi
test eax, eax
jne 0x46673f
push 0x27
jmp 0x4669dd
push edi
push 0x51ba18
push ebx
call esi
test eax, eax
jne 0x466753
push 0x2b
jmp 0x4669dd
push edi
push 0x51ba34
push ebx
call esi
test eax, eax
jne 0x466767
push 0x2c
jmp 0x4669dd
push edi
push 0x51ba54
push ebx
call esi
test eax, eax
jne 0x46677b
push 0x2d
jmp 0x4669dd
push edi
push 0x51ba6c
push ebx
call esi
test eax, eax
jne 0x46678f
push 0x2e
jmp 0x4669dd
push edi
push 0x51ba84
push ebx
call esi
test eax, eax
jne 0x4667a3
push 0x35
jmp 0x4669dd
push edi
push 0x51ba98
push ebx
call esi
test eax, eax
jne 0x4667b7
push 0x36
jmp 0x4669dd
push edi
push 0x51bab0
push ebx
call esi
test eax, eax
jne 0x4667cb
push 0x37
jmp 0x4669dd
push edi
push 0x51bac4
push ebx
call esi
test eax, eax
jne 0x4667df
push 0x19
jmp 0x4669dd
push edi
push 0x51bae4
push ebx
call esi
test eax, eax
je 0x466684
push edi
push 0x51baf4
push ebx
call esi
test eax, eax
jne 0x466803
inc eax
jmp 0x4669de
push edi
push 0x51bb04
push ebx
call esi
test eax, eax
jne 0x466817
push 2
jmp 0x4669dd
push edi
push 0x51bb14
push ebx
call esi
test eax, eax
jne 0x46682b
push 0xb
jmp 0x4669dd
push edi
push 0x51bb24
push ebx
call esi
test eax, eax
jne 0x46683f
push 0xd
jmp 0x4669dd
push edi
push 0x51bb34
push ebx
call esi
test eax, eax
jne 0x466853
push 0xe
jmp 0x4669dd
push edi
push 0x51bb44
push ebx
call esi
test eax, eax
jne 0x466867
push 3
jmp 0x4669dd
push edi
push 0x51bb54
push ebx
call esi
test eax, eax
jne 0x46687b
push 4
jmp 0x4669dd
push edi
push 0x51bb64
push ebx
call esi
test eax, eax
jne 0x46688f
push 6
jmp 0x4669dd
push edi
push 0x51bb74
push ebx
call esi
test eax, eax
jne 0x4668a3
push 7
jmp 0x4669dd
push edi
push 0x51bb84
push ebx
call esi
test eax, eax
jne 0x4668b7
push 8
jmp 0x4669dd
push edi
push 0x51bb94
push ebx
call esi
test eax, eax
jne 0x4668cb
push 9
jmp 0x4669dd
push edi
push 0x51bba4
push ebx
call esi
test eax, eax
jne 0x4668df
push 0xa
jmp 0x4669dd
push edi
push 0x51bbb4
push ebx
call esi
test eax, eax
jne 0x4668f3
push 0x10
jmp 0x4669dd
push edi
push 0x51bbcc
push ebx
call esi
test eax, eax
jne 0x466907
push 0x11
jmp 0x4669dd
push edi
push 0x51bbdc
push ebx
call esi
test eax, eax
jne 0x46691b
push 0x12
jmp 0x4669dd
push edi
push 0x51bbec
push ebx
call esi
test eax, eax
jne 0x46692f
push 0x13
jmp 0x4669dd
push edi
push 0x51bbfc
push ebx
call esi
test eax, eax
jne 0x466943
push 0x14
jmp 0x4669dd
push edi
push 0x51bc08
push ebx
call esi
test eax, eax
jne 0x466957
push 0x16
jmp 0x4669dd
push edi
push 0x51bc20
push ebx
call esi
test eax, eax
jne 0x466968
push 0x17
jmp 0x4669dd
push edi
push 0x51bc38
push ebx
call esi
test eax, eax
jne 0x466979
push 0x18
jmp 0x4669dd
push edi
push 0x51bc50
push ebx
call esi
test eax, eax
jne 0x46698a
push 0x1b
jmp 0x4669dd
push edi
push 0x51bc60
push ebx
call esi
test eax, eax
jne 0x46699b
push 0x28
jmp 0x4669dd
push edi
push 0x51bc70
push ebx
call esi
test eax, eax
jne 0x4669ac
push 0x2f
jmp 0x4669dd
push edi
push 0x51bc88
push ebx
call esi
test eax, eax
jne 0x4669bd
push 0x31
jmp 0x4669dd
push edi
push 0x51bc9c
push ebx
call esi
test eax, eax
jne 0x4669ce
push 0x38
jmp 0x4669dd
push edi
push 0x51bcac
push ebx
call esi
test eax, eax
jne 0x466a0c
push 0x30
pop eax
mov edi, dword [ebp - 0x7c]
push 0
push eax
mov esi, 0x105
call fcn.004174b0
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
mov esi, edi
test eax, eax
je 0x466a07
call fcn.004174f0
jmp 0x46653b
call fcn.004174f0
xor eax, eax
mov ecx, dword [ebp + 0x90]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004cb38b
add ebp, 0x94
leave
ret 4