Function at 0x476ca0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5bb9cd
mov eax, dword fs:[0]
push eax
mov eax, 0x2bd0
call fcn.0059a600
mov eax, dword [0x6319d0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x8cc]
call fcn.00408110
xor ebx, ebx
lea ecx, [ebp - 0x334]
mov dword [ebp - 4], ebx
call fcn.004286c0
push 0x5dc
lea eax, [ebp - 0x2618]
push 0x4b
push eax
mov dword [ebp - 0x261c], ebx
call fcn.00599fb0
mov ecx, 0x5dc
xor eax, eax
lea edi, [ebp - 0x203c]
add esp, 0xc
rep stosd dword es:[edi], eax
mov byte [ebp - 4], 2
call fcn.004a8620
xor ecx, ecx
cmp eax, ebx
setne cl
cmp ecx, ebx
jne 0x476d39
push 0x80004005
call fcn.00401b60
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x2628], eax
mov byte [ebp - 4], 3
call fcn.004a8620
xor ecx, ecx
cmp eax, ebx
setne cl
cmp ecx, ebx
jne 0x476d69
push 0x80004005
call fcn.00401b60
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x2620], eax
push 0x104
lea ecx, [ebp - 0x114]
push ecx
mov byte [ebp - 4], 4
mov dword [ebp - 0x2630], ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea edi, [ebp - 0x114]
dec edi
mov edi, edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x476da0
mov eax, dword [esi + 4]
mov dx, word [0x5cd28c]
mov word [edi], dx
cmp eax, ebx
jne 0x476e86
mov eax, dword [ebp - 0x2620]
add eax, 0xfffffff0
mov byte [ebp - 4], 3
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x476de3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x2628]
add eax, 0xfffffff0
mov byte [ebp - 4], 2
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x476e09
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor esi, esi
mov byte [ebp - 4], 1
cmp dword [ebp - 0x261c], ebx
jbe 0x476e44
jmp 0x476e20
mov eax, dword [ebp + esi*4 - 0x203c]
cmp eax, ebx
je 0x476e3b
push eax
call fcn.004a6dca
add esp, 4
mov dword [ebp + esi*4 - 0x203c], ebx
inc esi
cmp esi, dword [ebp - 0x261c]
jb 0x476e20
lea ecx, [ebp - 0x334]
mov byte [ebp - 4], 0
call fcn.00428700
lea ecx, [ebp - 0x8cc]
call fcn.004082d0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00599ed4
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp - 0x2638]
mov ecx, dword [eax]
mov dword [ebp - 0x2644], eax
add eax, 8
mov dword [ebp - 0x2638], ecx
push eax
lea ecx, [ebp - 0x8cc]
call fcn.0040bbe0
mov edx, dword [ebp - 0x8b4]
push 1
push 1
push edx
lea ecx, [ebp - 0x334]
mov dword [ebp - 0x850], ebx
call fcn.00428bd0
lea ecx, [ebp - 0x334]
call fcn.00427ce0
test eax, eax
je 0x4771ea
lea eax, [ebp - 0x263c]
push eax
lea ecx, [ebp - 0x308]
push ecx
push str.CoInstallers32
lea ecx, [ebp - 0x334]
mov dword [ebp - 0x263c], 0x1f4
call fcn.00427220
test eax, eax
je 0x4771ea
xor esi, esi
cmp dword [ebp - 0x261c], ebx
jbe 0x476f34
lea esp, [esp]
mov eax, dword [ebp + esi*4 - 0x203c]
cmp eax, ebx
je 0x476f2b
push eax
call fcn.004a6dca
add esp, 4
mov dword [ebp + esi*4 - 0x203c], ebx
inc esi
cmp esi, dword [ebp - 0x261c]
jb 0x476f10
push 0x5dc
lea edx, [ebp - 0x2618]
push 0x4b
push edx
mov dword [ebp - 0x261c], ebx
call fcn.00599fb0
mov ecx, dword [ebp - 0x263c]
add esp, 0xc
lea eax, [ebp - 0x261c]
push eax
push ebx
push ecx
lea edx, [ebp - 0x308]
push edx
lea ecx, [ebp - 0x334]
call fcn.00427b10
mov edx, dword [ebp - 0x261c]
cmp edx, ebx
je 0x4771ea
mov eax, dword [ebp - 0x2630]
imul eax, eax, 0x104
lea esi, [ebp + eax - 0x84c]
mov dword [ebp - 0x2634], esi
lea esi, [ebp - 0x114]
sub eax, esi
lea eax, [ebp + eax - 0x84c]
lea ecx, [ebp - 0x2618]
mov dword [ebp - 0x262c], eax
jmp 0x476fcc
mov edx, dword [ebp - 0x261c]
mov ecx, dword [ebp - 0x2624]
cmp ecx, ebx
je 0x477017
lea eax, [ebp - 0x2618]
sub ecx, eax
lea eax, [ecx + 1]
lea ecx, [eax - 1]
cmp ecx, 0x5db
ja 0x477017
cmp eax, edx
jae 0x476ff9
lea eax, [ebp + eax - 0x2618]
mov dword [ebp - 0x2624], eax
jmp 0x476fff
mov dword [ebp - 0x2624], ebx
cmp ecx, edx
jae 0x47701d
cmp ecx, 0xffffffff
je 0x47701d
mov ecx, dword [ebp + ecx*4 - 0x203c]
cmp ecx, ebx
jne 0x477023
xor eax, eax
jmp 0x477031
mov dword [ebp - 0x2624], ebx
xor ecx, ecx
xor eax, eax
jmp 0x477031
mov eax, ecx
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x477028
sub eax, esi
push eax
push ecx
lea ecx, [ebp - 0x2628]
call fcn.004026b0
mov esi, dword [ebp - 0x2628]
cmp dword [esi - 0xc], ebx
jl 0x4771de
push 0x5d26e0
push esi
call fcn.0059a963
add esp, 8
cmp eax, ebx
je 0x4771de
sub eax, esi
cmp eax, 0xffffffff
je 0x4771de
push eax
lea ecx, [ebp - 0x2640]
push ecx
lea ecx, [ebp - 0x2628]
call fcn.004024f0
mov eax, dword [eax]
mov ebx, dword [ebp - 0x2620]
lea esi, [eax - 0x10]
add ebx, 0xfffffff0
mov byte [ebp - 4], 5
cmp esi, ebx
je 0x477130
cmp dword [ebx + 0xc], 0
jl 0x477120
mov ecx, dword [esi]
cmp ecx, dword [ebx]
jne 0x477120
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
call eax
cmp dword [esi + 0xc], 0
lea ecx, [esi + 0xc]
jl 0x4770c8
cmp eax, dword [esi]
jne 0x4770c8
mov edi, esi
mov edx, 1
lock xadd dword [ecx], edx
jmp 0x4770fc
mov ecx, dword [esi + 4]
mov edx, dword [eax]
mov edx, dword [edx]
push 1
push ecx
mov ecx, eax
call edx
mov edi, eax
test edi, edi
je 0x477235
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
mov eax, dword [esi + 4]
inc eax
push eax
add esi, 0x10
push esi
push eax
lea ecx, [edi + 0x10]
push ecx
call fcn.0059aa3b
add esp, 0x10
lea eax, [ebx + 0xc]
or edx, 0xffffffff
lock xadd dword [eax], edx
dec edx
test edx, edx
jg 0x477115
mov ecx, dword [ebx]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push ebx
call edx
add edi, 0x10
mov dword [ebp - 0x2620], edi
jmp 0x477130
mov ecx, dword [eax - 0xc]
push ecx
push eax
lea ecx, [ebp - 0x2620]
call fcn.004026b0
mov eax, dword [ebp - 0x2640]
add eax, 0xfffffff0
mov byte [ebp - 4], 4
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x477156
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [ebp - 0x2620]
call fcn.00408a80
lea ecx, [ebp - 0x2620]
call fcn.00408a00
mov edx, dword [ebp - 0x262c]
lea eax, [ebp - 0x114]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x477178
mov eax, dword [ebp - 0x2620]
mov ecx, eax
lea ebx, [ebx]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x477190
mov edi, dword [ebp - 0x2634]
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x4771a2
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [ebp - 0x2630]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
inc eax
mov ecx, 0x104
add dword [ebp - 0x2634], ecx
add dword [ebp - 0x262c], ecx
mov dword [ebp - 0x2630], eax
mov dword [ebp - 0x850], eax
xor ebx, ebx
cmp dword [ebp - 0x2624], ebx
jne 0x476fc0
lea ecx, [ebp - 0x8cc]
push ecx
lea ecx, [ebp - 0x2bdc]
call fcn.00409000
mov ecx, dword [ebp - 0x2644]
lea edx, [ebp - 0x2bdc]
push edx
add ecx, 8
mov byte [ebp - 4], 6
call fcn.0040bbe0
lea ecx, [ebp - 0x2bdc]
mov byte [ebp - 4], 4
call fcn.004082d0
cmp dword [ebp - 0x2638], ebx
jne 0x476e80
jmp 0x476dbd
call fcn.00401f40
int3