Function at 0x45c970
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x4af6f0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.ole32.dll_CoCreateGuid]
test eax, eax
jne 0x45c9b3
movdqu xmm0, xmmword [ebp - 0x14]
push 0x104
push 0x4c73e8
sub esp, 0x10
mov eax, esp
movdqu xmmword [eax], xmm0
call fcn.0043d110
add esp, 0x18
jmp 0x45c9ca
push str.A6E044B8_6C25_48fc_806B_002A9582C81F
push 0x104
push 0x4c73e8
call fcn.0046fd12
add esp, 0xc
push 0x104
push 0x4c9020
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov esi, dword [sym.imp.SHLWAPI.dll_PathRemoveBackslashW]
test eax, eax
je 0x45c9eb
push 0x4c9020
call esi
push 0x104
push 0x4c9228
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x45ca06
push 0x4c9228
call esi
call fcn.0043d5d0
test eax, eax
je 0x45ca3e
push 0x4c9020
push str._s_system
push 0x104
push 0x4c9430
call fcn.0046ebde
push 0x4c9228
push 0x104
push 0x4c9638
call fcn.0046fd12
jmp 0x45ca6b
push 0x4c9228
push 0x104
push 0x4c9430
call fcn.0046fd12
push 0x4c9020
push str._s_system32
push 0x104
push 0x4c9638
call fcn.0046ebde
add esp, 0x1c
push 0x4c9840
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x45ca89
push 0x4c9840
call esi
push 0x4c9a48
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x45caa4
push 0x4c9a48
call esi
push str.shfolder.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x45cd54
push 0x49b764
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x45cd54
push 0x4ca060
push 0
push 0
push 0x8023
push 0
call edi
test eax, eax
js 0x45caec
push 0x4ca060
call esi
push 0x4ccb08
push 0
push 0
push 0x8009
push 0
call edi
test eax, eax
js 0x45cb09
push 0x4ccb08
call esi
push 0x4ca268
push 0
push 0
push 0x8026
push 0
call edi
test eax, eax
js 0x45cb26
push 0x4ca268
call esi
push 0x4ca470
push 0
push 0
push 0x801a
push 0
call edi
test eax, eax
js 0x45cb43
push 0x4ca470
call esi
push 0x4ca678
push 0
push 0
push 0x801c
push 0
call edi
test eax, eax
js 0x45cb60
push 0x4ca678
call esi
push 0x4ca880
push 0
push 0
push 0x8018
push 0
call edi
test eax, eax
js 0x45cb7d
push 0x4ca880
call esi
push 0x4caa88
push 0
push 0
push 0x8007
push 0
call edi
test eax, eax
js 0x45cb9a
push 0x4caa88
call esi
push 0x4cac90
push 0
push 0
push 0x802e
push 0
call edi
test eax, eax
js 0x45cbb7
push 0x4cac90
call esi
push 0x4cae98
push 0
push 0
push 0x8005
push 0
call edi
test eax, eax
js 0x45cbd4
push 0x4cae98
call esi
push 0x4cb0a0
push 0
push 0
push 0x8019
push 0
call edi
test eax, eax
js 0x45cbf1
push 0x4cb0a0
call esi
push 0x4cb2a8
push 0
push 0
push 0x8010
push 0
call edi
test eax, eax
js 0x45cc0e
push 0x4cb2a8
call esi
push 0x4cb4b0
push 0
push 0
push 0x802b
push 0
call edi
test eax, eax
js 0x45cc2b
push 0x4cb4b0
call esi
push 0x4cb6b8
push 0
push 0
push 0x8016
push 0
call edi
test eax, eax
js 0x45cc48
push 0x4cb6b8
call esi
push 0x4cb8c0
push 0
push 0
push 0x800b
push 0
call edi
test eax, eax
js 0x45cc65
push 0x4cb8c0
call esi
push 0x4cbac8
push 0
push 0
push 0x8017
push 0
call edi
test eax, eax
js 0x45cc82
push 0x4cbac8
call esi
push 0x4cbcd0
push 0
push 0
push 0x8002
push 0
call edi
test eax, eax
js 0x45cc9f
push 0x4cbcd0
call esi
push 0x4cbed8
push 0
push 0
push 0x8037
push 0
call edi
test eax, eax
js 0x45ccbc
push 0x4cbed8
call esi
push 0x4cc0e0
push 0
push 0
push 0x800e
push 0
call edi
test eax, eax
js 0x45ccd9
push 0x4cc0e0
call esi
push 0x4cc2e8
push 0
push 0
push 0x8035
push 0
call edi
test eax, eax
js 0x45ccf6
push 0x4cc2e8
call esi
push 0x4cc4f0
push 0
push 0
push 0x800d
push 0
call edi
test eax, eax
js 0x45cd13
push 0x4cc4f0
call esi
push 0x4c9c50
push 0
push 0
push 0x8036
push 0
call edi
test eax, eax
js 0x45cd30
push 0x4c9c50
call esi
push 0x4c9e58
push 0
push 0
push 0x8027
push 0
call edi
test eax, eax
js 0x45cd4d
push 0x4c9e58
call esi
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push str.shell32
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
test edi, edi
je 0x45cdf6
push str.SHGetKnownFolderPath
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
test ebx, ebx
je 0x45cdf6
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 0
push eax
push 0
push 0xd000
push 0x49e6d4
call ebx
test eax, eax
js 0x45cdb4
push dword [ebp - 0x18]
push 0x104
push 0x4cc900
call fcn.0046fd12
add esp, 0xc
push 0x4cc900
call esi
lea eax, [ebp - 0x18]
push eax
push 0
push 0xd000
push 0x49e6c4
call ebx
test eax, eax
js 0x45cde6
push dword [ebp - 0x18]
push 0x104
push 0x4cc6f8
call fcn.0046fd12
add esp, 0xc
push 0x4cc6f8
call esi
push dword [ebp - 0x18]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp word [0x4cc900], 0
jne 0x45ce1c
push 0x104
push 0x4cb0a0
push 0x104
push 0x4cc900
call fcn.004702d1
add esp, 0x10
cmp word [0x4cc6f8], 0
jne 0x45ce42
push 0x104
push 0x4cb2a8
push 0x104
push 0x4cc6f8
call fcn.004702d1
add esp, 0x10
push 0x104
push 0x4ccd10
push dword [0x4b550c]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x45cecd
push 0xffffffffffffffff
push 0x4ccd10
push 0x104
push 0x4cd120
call fcn.004702d1
add esp, 0x10
push 0x4cd120
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push 0xffffffffffffffff
push 0x4ccd10
push 0x104
push 0x4ccf18
call fcn.004702d1
add esp, 0x10
push 0x4ccf18
call dword [sym.imp.SHLWAPI.dll_PathStripPathW]
push 0xffffffffffffffff
push 0x4ccd10
push 0x104
push 0x4cd328
call fcn.004702d1
add esp, 0x10
push str..cfg
push 0x4cd328
call dword [sym.imp.SHLWAPI.dll_PathRenameExtensionW]
push 0x4c9020
push str.InitPathVar_____WINDOWS__:__s
call fcn.00469290
push 0x4c9228
push str.InitPathVar_____WINSYS__:__s
call fcn.00469290
push 0x4c9840
push str.InitPathVar_____CURRENTDIR__:__s
call fcn.00469290
push 0x4c9a48
push str.InitPathVar_____TEMP__:__s
call fcn.00469290
push 0x4ccb08
push str.InitPathVar_____SENDTO__:__s
call fcn.00469290
push 0x4ca268
push str.InitPathVar_____PROGRAMFILES__:__s
call fcn.00469290
push 0x4cb4b0
push str.InitPathVar_____PROGRAM_FILES_COMMON__:__s
call fcn.00469290
push 0x4cc0e0
push str.InitPathVar_____VIDEO_USER__:__s
call fcn.00469290
add esp, 0x40
push 0x4cbed8
push str.InitPathVar_____VIDEO_ALLUSERS__:__s
call fcn.00469290
push 0x4cc4f0
push str.InitPathVar_____MUSIC_USER__:__s
call fcn.00469290
push 0x4cc2e8
push str.InitPathVar_____MUSIC_ALLUSERS__:__s
call fcn.00469290
push 0x4c9e58
push str.InitPathVar_____PICTURES_USER__:__s
call fcn.00469290
push 0x4c9c50
push str.InitPathVar_____PICTURES_ALLUSERS__:__s
call fcn.00469290
push 0x4cbcd0
push str.InitPathVar_____PROGRAMS_USER__:__s
call fcn.00469290
push 0x4cbac8
push str.InitPathVar_____PROGRAMS_ALLUSERS__:__s
call fcn.00469290
push 0x4cb8c0
push str.InitPathVar_____STARTMENU_USER__:__s
call fcn.00469290
add esp, 0x40
push 0x4cb6b8
push str.InitPathVar_____STARTMENU_ALLUSERS__:__s
call fcn.00469290
push 0x4caa88
push str.InitPathVar_____STARTUP_USER__:__s
call fcn.00469290
push 0x4ca880
push str.InitPathVar_____STARTUP_ALLUSERS__:__s
call fcn.00469290
push 0x4ca470
push str.InitPathVar_____APPDATA__:__s
call fcn.00469290
push 0x4ca060
push str.InitPathVar_____COMMON_APPDATA__:__s
call fcn.00469290
push 0x4ca678
push str.InitPathVar_____LOCAL_APPDATA__:__s
call fcn.00469290
push 0x4cae98
push str.InitPathVar_____DOCUMENTS_USER__:__s
call fcn.00469290
push 0x4cac90
push str.InitPathVar_____DOCUMENTS_ALLUSERS__:__s
call fcn.00469290
add esp, 0x40
push 0x4cb2a8
push str.InitPathVar_____DESKTOP_USER__:__s
call fcn.00469290
push 0x4cb0a0
push str.InitPathVar_____DESKTOP_ALLUSERS__:__s
call fcn.00469290
push 0x4cc6f8
push str.InitPathVar_____DOWNLOAD_USER__:__s
call fcn.00469290
push 0x4cc900
push str.InitPathVar_____DOWNLOAD_ALLUSERS__:__s
call fcn.00469290
push 0x4ccd10
push str.InitPathVar____ModuleFile:__s
call fcn.00469290
push 0x4cd120
push str.InitPathVar____ModulePath:__s
call fcn.00469290
push 0x4ccf18
push str.InitPathVar____ModuleFileName:__s
call fcn.00469290
push 0x4cd328
push str.InitPathVar____ConfigFile:__s
call fcn.00469290
add esp, 0x40
push 0x4c73e8
push str.InitPathVar____NewGuid:__s
call fcn.00469290
mov ecx, dword [ebp - 4]
add esp, 8
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.0046ebfa
mov esp, ebp
pop ebp
ret