Function at 0x4ae0d0
Capabilities:
Get common file path
Get startup folder

Disassembly:
push 0xffffffffffffffff
push 0x55ba3e
mov eax, dword fs:[0]
push eax
sub esp, 0xec
push ebx
push ebp
push esi
push edi
mov eax, dword [0x660038]
xor eax, esp
push eax
lea eax, [esp + 0x100]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x120]
xor edi, edi
push str.Dbghelp
mov dword [esp + 0x2c], edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
cmp eax, edi
jne 0x4ae147
mov eax, dword [0x676f64]
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [esp + 0x114]
push eax
push esi
call fcn.00497730
mov dword [esp + 0x108], edi
mov dword [esp + 0x28], 1
jmp 0x4ae6b8
push str.MiniDumpWriteDump
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esp + 0x38], eax
cmp eax, edi
jne 0x4ae18a
mov ecx, dword [0x676f64]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [esp + 0x114]
push eax
push esi
call fcn.00497730
mov dword [esp + 0x108], edi
mov dword [esp + 0x28], 1
jmp 0x4ae6b8
mov eax, dword [esp + 0x114]
push edi
or edi, 0xffffffff
lea esi, [esp + 0x18]
call fcn.00494ae0
mov ebx, 1
mov dword [esp + 0x108], ebx
lea edx, [esp + 0x20]
push edx
lea edx, [edi + 5]
mov ecx, esi
call fcn.00494ec0
mov byte [esp + 0x108], 2
push eax
mov edx, str..exe
call fcn.00495390
test eax, eax
sete byte [esp + 0x1f]
mov byte [esp + 0x108], bl
lea ecx, [esp + 0x20]
call fcn.00494b70
cmp byte [esp + 0x1f], 0
je 0x4ae221
mov eax, esi
call fcn.00495300
mov edx, eax
lea eax, [esp + 0x20]
sub edx, 4
push eax
mov ecx, esi
call fcn.00494f40
mov byte [esp + 0x108], 3
mov edi, esi
call fcn.00494c50
mov byte [esp + 0x108], bl
lea ecx, [esp + 0x20]
call fcn.00494b70
mov ecx, dword [esp + 0x118]
push ecx
push 0
push 0x100450
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ecx, eax
lea eax, [esp + 0x2c]
call fcn.004a9e00
mov byte [esp + 0x108], 4
call fcn.00407eb0
mov dword [esp + 0x34], eax
test eax, eax
jne 0x4ae30e
mov edx, dword [0x676f64]
push edx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [esp + 0x84]
push eax
call fcn.00497730
mov byte [esp + 0x108], 5
mov ecx, dword [0x676f64]
push ecx
push 0xe1040073
lea edx, [esp + 0xb8]
push edx
call fcn.00497730
mov byte [esp + 0x108], 6
lea eax, [esp + 0x14]
call fcn.00407eb0
push eax
lea ecx, [esp + 0xb4]
call fcn.00497ba0
lea ecx, [esp + 0x7c]
call fcn.00497ce0
push eax
lea ecx, [esp + 0xb4]
call fcn.00497ba0
mov esi, dword [esp + 0x110]
lea eax, [esp + 0xb0]
push eax
mov ecx, esi
call fcn.00497830
mov dword [esp + 0x28], ebx
mov byte [esp + 0x108], 5
lea ecx, [esp + 0xb0]
call fcn.004978f0
mov byte [esp + 0x108], 4
lea ecx, [esp + 0x7c]
call fcn.004978f0
jmp 0x4ae697
lea ecx, [esp + 0x18]
call fcn.004949f0
mov byte [esp + 0x108], 7
mov eax, 0x104
lea ecx, [esp + 0x18]
call fcn.00494be0
push eax
push 0
push 0
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
or eax, 0xffffffff
lea ecx, [esp + 0x18]
call fcn.00495310
lea eax, [esp + 0x18]
call fcn.00495300
mov edi, eax
sub edi, ebx
lea eax, [esp + 0x18]
call fcn.00495830
cmp word [eax], 0x5c
je 0x4ae36f
push 0x5c
lea edi, [esp + 0x1c]
call fcn.00494d30
push 0
or edi, 0xffffffff
mov eax, str..dmp
lea esi, [esp + 0x24]
call fcn.00494ae0
mov byte [esp + 0x108], 8
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x38]
push eax
call fcn.00495940
mov byte [esp + 0x114], 9
mov ecx, esi
push ecx
push eax
lea edx, [esp + 0x38]
push edx
call fcn.00495940
add esp, 0x18
mov byte [esp + 0x108], 0xb
lea ecx, [esp + 0x30]
call fcn.00494b70
mov byte [esp + 0x108], 0xc
mov ecx, esi
call fcn.00494b70
lea eax, [esp + 0xe4]
push eax
call fcn.00499570
mov byte [esp + 0x108], 0xd
lea ecx, [esp + 0x48]
call fcn.004977b0
mov byte [esp + 0x108], 0xe
push 2
push 0xc0000000
lea eax, [esp + 0x2c]
call fcn.00407eb0
push eax
lea ecx, [esp + 0xf0]
call fcn.00499750
test al, al
jne 0x4ae4d3
mov ecx, dword [0x676f64]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea edx, [esp + 0xb8]
push edx
call fcn.00497730
mov byte [esp + 0x108], 0xf
mov eax, dword [0x676f64]
push eax
push 0xe1040072
lea ecx, [esp + 0x84]
push ecx
call fcn.00497730
mov byte [esp + 0x108], 0x10
lea edx, [esp + 0x7c]
push edx
lea edi, [esp + 0x4c]
call fcn.00497a80
mov byte [esp + 0x108], 0xf
lea ecx, [esp + 0x7c]
call fcn.004978f0
lea eax, [esp + 0x14]
call fcn.00407eb0
push eax
mov ecx, edi
call fcn.00497ba0
lea eax, [esp + 0x24]
call fcn.00407eb0
push eax
mov ecx, edi
call fcn.00497ba0
lea ecx, [esp + 0xb0]
call fcn.00497ce0
push eax
mov ecx, edi
call fcn.00497ba0
mov byte [esp + 0x108], 0xe
lea ecx, [esp + 0xb0]
call fcn.004978f0
jmp 0x4ae639
mov eax, dword [esp + 0x11c]
mov edx, dword [0x666f34]
mov dword [esp + 0x40], ebp
push 0
push 0
neg ebp
sbb ebp, ebp
lea ecx, [esp + 0x44]
and ebp, ecx
mov ecx, dword [esp + 0x120]
push ebp
push edx
mov edx, dword [esp + 0x44]
mov dword [esp + 0x4c], eax
mov eax, dword [esp + 0xf8]
push eax
push ecx
push edx
mov dword [esp + 0x60], ebx
call dword [esp + 0x54]
test eax, eax
jne 0x4ae5cb
mov eax, dword [0x676f64]
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [esp + 0xb8]
push ecx
call fcn.00497730
mov byte [esp + 0x108], 0x11
mov edx, dword [0x676f64]
push edx
push 0xe1040072
lea eax, [esp + 0x84]
push eax
call fcn.00497730
mov byte [esp + 0x108], 0x12
lea ecx, [esp + 0x7c]
push ecx
lea edi, [esp + 0x4c]
call fcn.00497a80
mov byte [esp + 0x108], 0x11
lea ecx, [esp + 0x7c]
call fcn.004978f0
lea eax, [esp + 0x14]
call fcn.00407eb0
push eax
mov ecx, edi
call fcn.00497ba0
lea eax, [esp + 0x24]
call fcn.00407eb0
push eax
mov ecx, edi
call fcn.00497ba0
lea ecx, [esp + 0xb0]
call fcn.00497ce0
push eax
mov ecx, edi
call fcn.00497ba0
mov byte [esp + 0x108], 0xe
lea ecx, [esp + 0xb0]
call fcn.004978f0
jmp 0x4ae62d
mov edx, dword [0x676f64]
push edx
push 0x61040071
lea eax, [esp + 0x84]
push eax
call fcn.00497730
mov byte [esp + 0x108], 0x13
lea ecx, [esp + 0x7c]
push ecx
lea edi, [esp + 0x4c]
call fcn.00497a80
mov byte [esp + 0x108], 0xe
lea ecx, [esp + 0x7c]
call fcn.004978f0
lea eax, [esp + 0x14]
call fcn.00407eb0
push eax
mov ecx, edi
call fcn.00497ba0
lea eax, [esp + 0x24]
call fcn.00407eb0
push eax
mov ecx, edi
call fcn.00497ba0
lea esi, [esp + 0xe4]
call fcn.00499b60
mov esi, dword [esp + 0x110]
lea edx, [esp + 0x48]
push edx
mov ecx, esi
call fcn.00497830
mov dword [esp + 0x28], ebx
mov byte [esp + 0x108], 0xd
lea ecx, [esp + 0x48]
call fcn.004978f0
mov byte [esp + 0x108], 0xc
lea ecx, [esp + 0xe4]
call fcn.00499600
mov byte [esp + 0x108], 7
lea ecx, [esp + 0x24]
call fcn.00494b70
mov byte [esp + 0x108], 4
lea ecx, [esp + 0x18]
call fcn.00494b70
mov byte [esp + 0x108], bl
lea eax, [esp + 0x2c]
call fcn.004a9db0
mov byte [esp + 0x108], 0
lea ecx, [esp + 0x14]
call fcn.00494b70
mov eax, esi
mov ecx, dword [esp + 0x100]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xf8
ret