Function at 0x4be264
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x109
push 0
push 0
dec ecx
jne 0x4be26c
push ecx
push ebx
push esi
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405f48
xor eax, eax
push ebp
push 0x4be6b3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x3e8
call fcn.004030f8
mov esi, eax
mov eax, esi
xor ecx, ecx
mov edx, 0x3e8
call fcn.00403a48
mov eax, dword [ebp - 4]
mov edx, 0x4be6cc
call fcn.00406594
jne 0x4be2c5
push 0x3e8
push esi
call sub.kernel32.dll_GetWindowsDirectoryW
mov eax, dword [ebp - 4]
mov edx, 0x4be6e8
call fcn.00406594
jne 0x4be2df
push 0x3e8
push esi
call sub.kernel32.dll_GetSystemDirectoryW
mov eax, dword [ebp - 4]
mov edx, 0x4be704
call fcn.00406594
jne 0x4be2f9
push esi
push 0x3e8
call sub.kernel32.dll_GetTempPathW
mov eax, dword [ebp - 4]
mov edx, 0x4be71c
call fcn.00406594
jne 0x4be313
push esi
push 0x3e8
call sub.kernel32.dll_GetCurrentDirectoryW
mov eax, ebx
mov edx, esi
call fcn.0040610c
lea ecx, [ebp - 0x820]
mov eax, dword [ebx]
mov edx, 1
call fcn.004b916c
mov eax, dword [ebp - 0x820]
mov edx, 0x4be738
call fcn.00406594
je 0x4be34c
mov eax, ebx
mov edx, 0x4be738
call fcn.0040629c
mov eax, dword [ebp - 4]
mov edx, 0x4be748
call fcn.00406594
jne 0x4be505
mov eax, ebx
xor edx, edx
call fcn.00405f60
push 0
push 0x26
lea eax, [ebp - 0x81a]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderPathW
test eax, eax
je 0x4be474
lea eax, [ebp - 8]
lea edx, [ebp - 0x81a]
mov ecx, 0x401
call fcn.00406148
lea edx, [ebp - 0x824]
mov eax, dword [ebp - 8]
call fcn.0040ba28
mov edx, dword [ebp - 0x824]
lea eax, [ebp - 8]
call fcn.00405fb4
lea ecx, [ebp - 0x828]
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.004b916c
mov eax, dword [ebp - 0x828]
mov edx, 0x4be738
call fcn.00406594
je 0x4be3e3
lea eax, [ebp - 8]
mov edx, 0x4be738
call fcn.0040629c
mov edx, dword [ebp - 8]
mov eax, 0x4be75c
call fcn.004068b4
test eax, eax
jle 0x4be412
lea eax, [ebp - 0x14]
push eax
xor ecx, ecx
mov edx, 0x4be774
mov eax, dword [ebp - 8]
call fcn.0040a21c
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 0x14]
call fcn.00405fb4
lea eax, [ebp - 0x82c]
mov ecx, 0x4be790
mov edx, dword [ebp - 8]
call fcn.0040631c
mov eax, dword [ebp - 0x82c]
call fcn.0040cd44
test al, al
je 0x4be443
mov eax, ebx
mov ecx, 0x4be790
mov edx, dword [ebp - 8]
call fcn.0040631c
lea eax, [ebp - 0x830]
mov ecx, 0x4be790
mov edx, dword [ebp - 0xc]
call fcn.0040631c
mov eax, dword [ebp - 0x830]
call fcn.0040cd44
test al, al
je 0x4be474
mov eax, ebx
mov ecx, 0x4be790
mov edx, dword [ebp - 0xc]
call fcn.0040631c
cmp dword [ebx], 0
jne 0x4be505
push 0x3e8
push esi
call sub.kernel32.dll_GetWindowsDirectoryW
lea eax, [ebp - 8]
mov edx, esi
call fcn.0040610c
lea eax, [ebp - 0x838]
mov edx, dword [ebp - 8]
call fcn.004061c4
mov eax, dword [ebp - 0x838]
lea ecx, [ebp - 0x834]
mov edx, 1
call fcn.0040a33c
lea eax, [ebp - 0x834]
mov edx, 0x4be7d4
call fcn.00405d10
mov edx, dword [ebp - 0x834]
lea eax, [ebp - 8]
call fcn.004061b0
lea eax, [ebp - 0x83c]
mov ecx, 0x4be790
mov edx, dword [ebp - 8]
call fcn.0040631c
mov eax, dword [ebp - 0x83c]
call fcn.0040cd44
test al, al
je 0x4be505
mov eax, ebx
mov ecx, 0x4be790
mov edx, dword [ebp - 8]
call fcn.0040631c
mov eax, dword [ebp - 4]
mov edx, 0x4be804
call fcn.00406594
jne 0x4be651
mov eax, ebx
xor edx, edx
call fcn.00405f60
push 0
push 1
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
mov ecx, 0x4be830
mov edx, Ordinal_2
xor eax, eax
call fcn.004bce90
test al, al
je 0x4be54c
mov eax, ebx
mov edx, dword [ebp - 0x10]
call fcn.00405f60
push 0x4be86c
push 1
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
mov ecx, 0x4be888
mov edx, Ordinal_2
xor eax, eax
call fcn.004bce90
test al, al
je 0x4be5af
push 0
push 1
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x840]
mov ecx, 0x4be930
mov edx, dword [ebp - 0x10]
call fcn.0040631c
mov ecx, dword [ebp - 0x840]
mov edx, Ordinal_2
xor eax, eax
call fcn.004bce90
test al, al
je 0x4be5af
mov eax, ebx
mov edx, dword [ebp - 0x10]
call fcn.00405f60
lea edx, [ebp - 0x844]
mov eax, dword [ebx]
call fcn.0040bf14
mov edx, dword [ebp - 0x844]
mov eax, ebx
call fcn.00405f60
lea eax, [ebp - 8]
push eax
mov eax, dword [ebx]
mov ecx, 0x4be964
mov edx, 0x4be964
call fcn.004bd7a8
mov eax, dword [ebp - 8]
call fcn.0040cd44
test al, al
je 0x4be5f6
mov eax, ebx
mov edx, dword [ebp - 8]
call fcn.00405f60
jmp 0x4be651
mov edx, dword [ebx]
mov eax, 0x4be974
call fcn.004068b4
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 1
jle 0x4be651
lea eax, [ebp - 0x84c]
mov edx, dword [ebx]
call fcn.004061c4
mov eax, dword [ebp - 0x84c]
lea ecx, [ebp - 0x848]
mov edx, dword [ebp - 0x18]
dec edx
call fcn.0040a33c
mov edx, dword [ebp - 0x848]
lea eax, [ebp - 8]
call fcn.004061b0
mov eax, dword [ebp - 8]
call fcn.0040cd44
test al, al
je 0x4be651
mov eax, ebx
mov edx, dword [ebp - 8]
call fcn.00405f60
mov eax, esi
call fcn.0040312c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4be6ba
lea eax, [ebp - 0x84c]
mov edx, 2
call fcn.00405b18
lea eax, [ebp - 0x844]
mov edx, 3
call fcn.00405f58
lea eax, [ebp - 0x838]
mov edx, 2
call fcn.00405b18
lea eax, [ebp - 0x830]
mov edx, 5
call fcn.00405f58
lea eax, [ebp - 0x14]
mov edx, 5
call fcn.00405f58
ret