Function at 0x40e106
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x1a0]
sub esp, 0x220
mov eax, dword [0x429060]
push ebx
push esi
push edi
xor eax, ebp
mov edi, ecx
push str.SystemFolder
lea esi, [ebp - 0x78]
mov dword [ebp + 0x19c], eax
mov dword [ebp - 0x7c], edi
mov byte [ebp - 0x71], 1
call fcn.00401d1b
mov eax, dword [eax]
mov ecx, dword [edi]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpA]
push eax
push ecx
call edi
mov ebx, eax
mov eax, dword [ebp - 0x78]
neg ebx
sbb bl, bl
add eax, 0xfffffff0
inc bl
call fcn.0040175b
test bl, bl
je 0x40e195
push 0x104
lea eax, [ebp + 0x98]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov byte [ebp + eax + 0x98], 0x5c
mov byte [ebp + eax + 0x99], 0
lea eax, [ebp + 0x98]
push eax
push dword [ebp - 0x7c]
call fcn.00401d4a
jmp 0x40e370
push str.WindowsFolder
lea esi, [ebp - 0x78]
call fcn.00401d1b
mov eax, dword [eax]
mov esi, dword [ebp - 0x7c]
mov ecx, dword [esi]
push eax
push ecx
call edi
mov ebx, eax
mov eax, dword [ebp - 0x78]
neg ebx
sbb bl, bl
add eax, 0xfffffff0
inc bl
call fcn.0040175b
test bl, bl
je 0x40e1f0
push 0x104
lea eax, [ebp + 0x98]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov byte [ebp + eax + 0x98], 0x5c
mov byte [ebp + eax + 0x99], 0
lea eax, [ebp + 0x98]
push eax
push esi
jmp 0x40e18b
push str.WindowsVolume
lea esi, [ebp - 0x78]
call fcn.00401d1b
mov eax, dword [eax]
mov ecx, dword [ebp - 0x7c]
mov ecx, dword [ecx]
push eax
push ecx
call edi
mov ebx, eax
mov eax, dword [ebp - 0x78]
neg ebx
sbb bl, bl
add eax, 0xfffffff0
inc bl
call fcn.0040175b
test bl, bl
je 0x40e23d
push 0x104
lea eax, [ebp + 0x98]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov byte [ebp + 0x9b], 0
jmp 0x40e181
mov ebx, dword [ebp - 0x7c]
mov eax, dword [ebx]
push str.TempFolder
push eax
call edi
test eax, eax
jne 0x40e275
lea eax, [ebp + 0x98]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov byte [ebp + eax + 0x98], 0
lea eax, [ebp + 0x98]
push eax
push ebx
jmp 0x40e18b
mov eax, dword [ebx]
push str.SETUPEXEDIR
push eax
call edi
test eax, eax
jne 0x40e2d6
mov eax, dword [0x429728]
cmp dword [eax - 0xc], 0
mov esi, 0x429728
jne 0x40e2c8
push 0x105
lea eax, [ebp - 0x70]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
jmp 0x40e2ad
cmp byte [ebp + eax - 0x70], 0x5c
je 0x40e2b0
dec eax
jne 0x40e2a6
lea ecx, [ebp - 0x70]
mov byte [ebp + eax - 0x6f], 0
call fcn.00401d64
push eax
lea eax, [ebp - 0x70]
push eax
push esi
call fcn.004017cb
mov eax, esi
mov edi, ebx
call fcn.0040158b
jmp 0x40e370
xor esi, esi
mov eax, dword [esi*4 + 0x4293e8]
mov ecx, dword [ebx]
push eax
push ecx
call edi
test eax, eax
je 0x40e2ef
inc esi
cmp esi, 0xc
jb 0x40e2d8
cmp esi, 0xc
jae 0x40e36c
lea eax, [ebp - 0x78]
push eax
lea esi, [esi*4 + 0x424db8]
push dword [esi]
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
je 0x40e326
push dword [esi]
call fcn.0040e38b
test al, al
pop ecx
jne 0x40e370
mov edi, dword [ebp - 0x7c]
call fcn.0040e44e
mov byte [ebp - 0x71], al
jmp 0x40e370
lea eax, [ebp + 0x98]
push eax
push dword [ebp - 0x78]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
and dword [ebp - 0x80], 0
mov esi, eax
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
mov eax, dword [ebp - 0x80]
push dword [ebp - 0x78]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
test esi, esi
je 0x40e36c
lea eax, [ebp + 0x98]
push eax
push ebx
call fcn.00401d4a
mov eax, ebx
call fcn.0040c50c
jmp 0x40e370
mov byte [ebp - 0x71], 0
mov ecx, dword [ebp + 0x19c]
mov al, byte [ebp - 0x71]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042254d
add ebp, 0x1a0
leave
ret