Function at 0x477055
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x6a9a60]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x6b389c], 0
push edi
mov edi, ecx
jne 0x4773b3
push ebx
xor ebx, ebx
push esi
mov esi, ebx
push 0x208
lea eax, [ebp - 0x20c]
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x20c]
push ebx
push dword [esi + 0x6a911c]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x210]
call fcn.004040f0
push 0x613008
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
pop ecx
push eax
push 0x613008
lea ecx, [ebp - 0x210]
call fcn.0040c36b
push dword [esi + 0x6a9118]
lea ecx, [ebp - 0x214]
call fcn.004040f0
lea ecx, [ebp - 0x214]
call fcn.0040c9f9
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x214]
push eax
lea ecx, [ebp - 0x21c]
call fcn.004304f0
lea eax, [ebp - 0x21c]
mov ecx, 0x6b3898
push eax
lea eax, [ebp - 0x224]
push eax
call fcn.00430574
lea ecx, [ebp - 0x21c]
call fcn.0040c172
mov ecx, dword [ebp - 0x214]
lea ecx, [ecx - 0x10]
call fcn.004023e0
mov ecx, dword [ebp - 0x210]
lea ecx, [ecx - 0x10]
call fcn.004023e0
add esi, 8
cmp esi, 0x118
jb 0x47707e
push 0x613008
lea eax, [ebp - 0x214]
push ebx
push eax
call fcn.0045a7af
pop ecx
pop ecx
push eax
lea eax, [ebp - 0x210]
push eax
call fcn.00413eaa
push 0x10
pop ebx
mov dword [ebp - 0x21c], 0x6163c4
mov eax, dword [eax]
sub eax, ebx
push eax
call fcn.00404b40
add esp, 0x10
mov ecx, 0x6b3898
lea esi, [eax + 0x10]
lea eax, [ebp - 0x21c]
mov dword [ebp - 0x218], esi
push eax
lea eax, [ebp - 0x224]
push eax
call fcn.0043263f
lea ecx, [esi - 0x10]
call fcn.004023e0
mov ecx, dword [ebp - 0x210]
lea ecx, [ecx - 0x10]
call fcn.004023e0
mov ecx, dword [ebp - 0x214]
lea ecx, [ecx - 0x10]
call fcn.004023e0
push 0x613008
lea eax, [ebp - 0x214]
push 0
push eax
call fcn.0045a839
pop ecx
pop ecx
push eax
lea eax, [ebp - 0x210]
push eax
call fcn.00413eaa
mov dword [ebp - 0x21c], str.desktop_user
mov eax, dword [eax]
sub eax, ebx
push eax
call fcn.00404b40
add esp, 0x10
mov ecx, 0x6b3898
lea esi, [eax + 0x10]
lea eax, [ebp - 0x21c]
mov dword [ebp - 0x218], esi
push eax
lea eax, [ebp - 0x224]
push eax
call fcn.0043263f
lea ecx, [esi - 0x10]
call fcn.004023e0
mov ecx, dword [ebp - 0x210]
lea ecx, [ecx - 0x10]
call fcn.004023e0
mov ecx, dword [ebp - 0x214]
lea ecx, [ecx - 0x10]
call fcn.004023e0
push 0x613008
lea eax, [ebp - 0x214]
push 0
push eax
call fcn.00413a13
pop ecx
pop ecx
push eax
lea eax, [ebp - 0x210]
push eax
call fcn.00413eaa
mov dword [ebp - 0x21c], str.exedir
mov eax, dword [eax]
sub eax, ebx
push eax
call fcn.00404b40
add esp, 0x10
mov ecx, 0x6b3898
lea esi, [eax + 0x10]
lea eax, [ebp - 0x21c]
mov dword [ebp - 0x218], esi
push eax
lea eax, [ebp - 0x224]
push eax
call fcn.0043263f
lea ecx, [esi - 0x10]
call fcn.004023e0
mov ecx, dword [ebp - 0x210]
lea ecx, [ecx - 0x10]
call fcn.004023e0
mov ecx, dword [ebp - 0x214]
lea ecx, [ecx - 0x10]
call fcn.004023e0
push 0x613008
lea eax, [ebp - 0x214]
push 0x400000
push eax
call fcn.00413a13
pop ecx
pop ecx
push eax
lea eax, [ebp - 0x210]
push eax
call fcn.00413eaa
mov dword [ebp - 0x21c], str.dlldir
mov eax, dword [eax]
sub eax, ebx
push eax
call fcn.00404b40
add esp, 0x10
mov ecx, 0x6b3898
lea esi, [eax + 0x10]
lea eax, [ebp - 0x21c]
mov dword [ebp - 0x218], esi
push eax
lea eax, [ebp - 0x224]
push eax
call fcn.0043263f
lea ecx, [esi - 0x10]
call fcn.004023e0
mov ecx, dword [ebp - 0x210]
lea ecx, [ecx - 0x10]
call fcn.004023e0
mov ecx, dword [ebp - 0x214]
lea ecx, [ecx - 0x10]
call fcn.004023e0
lea eax, [ebp - 0x210]
mov ecx, edi
push eax
call fcn.0047744e
mov dword [ebp - 0x21c], str.iedir
mov eax, dword [eax]
sub eax, ebx
push eax
call fcn.00404b40
pop ecx
mov ecx, 0x6b3898
lea esi, [eax + 0x10]
lea eax, [ebp - 0x21c]
mov dword [ebp - 0x218], esi
push eax
lea eax, [ebp - 0x224]
push eax
call fcn.0043263f
lea ecx, [esi - 0x10]
call fcn.004023e0
mov ecx, dword [ebp - 0x210]
add ecx, 0xfffffff0
call fcn.004023e0
pop esi
pop ebx
mov ecx, dword [ebp - 4]
mov eax, edi
xor ecx, ebp
pop edi
call fcn.004b3004
leave
ret