Function at 0x4b3220
Capabilities:
Get common file path
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x55c55c
mov eax, dword fs:[0]
push eax
sub esp, 0x634
mov eax, dword [0x5cf024]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov bl, dl
mov edi, ecx
mov esi, dword [edi]
mov ecx, str.ProgramFiles64Folder
mov eax, esi
nop dword [eax + eax]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4b3286
test dx, dx
je 0x4b3282
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4b3286
add eax, 4
add ecx, 4
test dx, dx
jne 0x4b3260
xor eax, eax
jmp 0x4b328b
sbb eax, eax
or eax, 1
test eax, eax
jne 0x4b3361
lea ecx, [esi - 0x10]
call fcn.00408ad0
add eax, 0x10
mov dword [ebp - 0x630], eax
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x630]
push str.ProgramW6432
call fcn.004928e0
test eax, eax
je 0x4b333c
lea eax, [ebp - 0x630]
mov ecx, edi
push eax
call fcn.00477830
mov edx, dword [edi]
mov ecx, dword [edx - 0xc]
test ecx, ecx
jle 0x4b32f9
lea eax, [ecx - 1]
test eax, eax
js 0x4b3cca
cmp eax, ecx
jg 0x4b3cca
cmp word [edx + eax*2], 0x5c
je 0x4b32f9
push 0x5c
mov ecx, edi
call fcn.0048fc70
mov dword [ebp - 4], 0xffffffff
or eax, 0xffffffff
mov edx, dword [ebp - 0x630]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4b331e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0051dacc
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 0xffffffff
or eax, 0xffffffff
mov edx, dword [ebp - 0x630]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4b3361
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 0x629], 1
call fcn.004092a0
test eax, eax
je 0x4b3cc0
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [ebp - 0x630], eax
mov dword [ebp - 4], 4
mov eax, str.SystemFolder
lea ecx, [ebp - 0x630]
test eax, 0xffff0000
jne 0x4b33a9
movzx eax, ax
push eax
call fcn.00415230
jmp 0x4b33b5
push 0xc
push str.SystemFolder
call fcn.00408e30
mov dword [ebp - 4], 5
mov eax, dword [ebp - 0x630]
test eax, eax
je 0x4b3cc0
mov ecx, dword [edi]
mov edx, eax
nop
mov si, word [ecx]
cmp si, word [edx]
jne 0x4b33f6
test si, si
je 0x4b33f2
mov si, word [ecx + 2]
cmp si, word [edx + 2]
jne 0x4b33f6
add ecx, 4
add edx, 4
test si, si
jne 0x4b33d0
xor esi, esi
jmp 0x4b33fb
sbb esi, esi
or esi, 1
mov dword [ebp - 4], 0xffffffff
lea edx, [eax - 0x10]
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4b341a
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test esi, esi
jne 0x4b349a
lea eax, [ebp - 0x218]
push eax
movzx eax, bl
xor eax, 1
push esi
push esi
lea eax, [eax*4 + 0x25]
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4b3445
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
mov ecx, edi
call fcn.00408e30
mov edx, dword [edi]
mov ecx, dword [edx - 0xc]
test ecx, ecx
jle 0x4b348f
lea eax, [ecx - 1]
test eax, eax
js 0x4b3cca
cmp eax, ecx
jg 0x4b3cca
cmp word [edx + eax*2], 0x5c
je 0x4b348f
push 0x5c
mov ecx, edi
call fcn.0048fc70
mov al, byte [ebp - 0x629]
jmp 0x4b3320
call fcn.004092a0
test eax, eax
je 0x4b3cc0
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [ebp - 0x630], eax
mov dword [ebp - 4], 7
mov eax, str.System32Folder
lea ecx, [ebp - 0x630]
test eax, 0xffff0000
jne 0x4b34db
movzx eax, ax
push eax
call fcn.00415230
jmp 0x4b34e7
push 0xe
push str.System32Folder
call fcn.00408e30
mov dword [ebp - 4], 8
mov eax, dword [ebp - 0x630]
test eax, eax
je 0x4b3cc0
mov ecx, dword [edi]
mov edx, eax
mov si, word [ecx]
cmp si, word [edx]
jne 0x4b3526
test si, si
je 0x4b3522
mov si, word [ecx + 2]
cmp si, word [edx + 2]
jne 0x4b3526
add ecx, 4
add edx, 4
test si, si
jne 0x4b3500
xor esi, esi
jmp 0x4b352b
sbb esi, esi
or esi, 1
mov dword [ebp - 4], 0xffffffff
or ebx, 0xffffffff
lea edx, [eax - 0x10]
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4b354c
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test esi, esi
jne 0x4b35bd
push 0x104
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov ecx, 0x5c
mov word [ebp + eax*2 - 0x218], cx
lea eax, [eax*2 + 2]
cmp eax, 0x208
jae 0x4b3cd4
xor ecx, ecx
mov word [ebp + eax - 0x218], cx
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4b3594
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
mov ecx, edi
call fcn.00408e30
mov al, byte [ebp - 0x629]
jmp 0x4b3320
call fcn.004092a0
test eax, eax
je 0x4b3cc0
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [ebp - 0x630], eax
mov dword [ebp - 4], 0xa
mov eax, str.WindowsFolder
lea ecx, [ebp - 0x630]
test eax, 0xffff0000
jne 0x4b35fe
movzx eax, ax
push eax
call fcn.00415230
jmp 0x4b360a
push 0xd
push str.WindowsFolder
call fcn.00408e30
mov dword [ebp - 4], 0xb
mov eax, dword [ebp - 0x630]
test eax, eax
je 0x4b3cc0
mov ecx, dword [edi]
mov edx, eax
mov si, word [ecx]
cmp si, word [edx]
jne 0x4b3649
test si, si
je 0x4b3645
mov si, word [ecx + 2]
cmp si, word [edx + 2]
jne 0x4b3649
add ecx, 4
add edx, 4
test si, si
jne 0x4b3623
xor esi, esi
jmp 0x4b364e
sbb esi, esi
or esi, 1
mov dword [ebp - 4], 0xffffffff
lea edx, [eax - 0x10]
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4b366c
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test esi, esi
jne 0x4b36c4
push 0x104
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov ecx, 0x5c
mov word [ebp + eax*2 - 0x218], cx
lea eax, [eax*2 + 2]
cmp eax, 0x208
jae 0x4b3cd4
xor ecx, ecx
mov word [ebp + eax - 0x218], cx
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4b36b4
jmp 0x4b359f
call fcn.004092a0
test eax, eax
je 0x4b3cc0
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [ebp - 0x630], eax
mov dword [ebp - 4], 0xd
mov eax, str.WindowsVolume
lea ecx, [ebp - 0x630]
test eax, 0xffff0000
jne 0x4b3705
movzx eax, ax
push eax
call fcn.00415230
jmp 0x4b3711
push 0xd
push str.WindowsVolume
call fcn.00408e30
mov dword [ebp - 4], 0xe
mov eax, dword [ebp - 0x630]
test eax, eax
je 0x4b3cc0
mov ecx, dword [edi]
mov edx, eax
nop word [eax + eax]
mov si, word [ecx]
cmp si, word [edx]
jne 0x4b3756
test si, si
je 0x4b3752
mov si, word [ecx + 2]
cmp si, word [edx + 2]
jne 0x4b3756
add ecx, 4
add edx, 4
test si, si
jne 0x4b3730
xor esi, esi
jmp 0x4b375b
sbb esi, esi
or esi, 1
mov dword [ebp - 4], 0xffffffff
lea edx, [eax - 0x10]
lock xadd dword [edx + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x4b3777
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test esi, esi
jne 0x4b37b0
push 0x104
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
xor eax, eax
lea ecx, [ebp - 0x218]
mov word [ebp - 0x212], ax
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4b37a0
jmp 0x4b359f
mov ecx, dword [edi]
mov edx, str.TempFolder
mov eax, ecx
nop dword [eax]
mov si, word [eax]
cmp si, word [edx]
jne 0x4b37e6
test si, si
je 0x4b37e2
mov si, word [eax + 2]
cmp si, word [edx + 2]
jne 0x4b37e6
add eax, 4
add edx, 4
test si, si
jne 0x4b37c0
xor eax, eax
jmp 0x4b37eb
sbb eax, eax
or eax, 1
test eax, eax
jne 0x4b3831
lea eax, [ebp - 0x218]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
add eax, eax
cmp eax, 0x208
jae 0x4b3cd4
xor ecx, ecx
mov word [ebp + eax - 0x218], cx
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4b3821
jmp 0x4b359f
mov eax, str.SETUPEXEDIR
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x4b385c
test dx, dx
je 0x4b3858
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x4b385c
add ecx, 4
add eax, 4
test dx, dx
jne 0x4b3836
xor eax, eax
jmp 0x4b3861
sbb eax, eax
or eax, 1
test eax, eax
jne 0x4b38fd
mov eax, dword [0x5d558c]
cmp dword [eax - 0xc], 0
jne 0x4b38e6
push 0x104
lea eax, [ebp - 0x218]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
sub eax, 1
je 0x4b38a0
nop dword [eax]
cmp word [ebp + eax*2 - 0x218], 0x5c
je 0x4b38a0
sub eax, 1
jne 0x4b3890
lea eax, [eax*2 + 2]
cmp eax, 0x208
jae 0x4b3cd4
xor ecx, ecx
mov word [ebp + eax - 0x218], cx
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4b38c5
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
mov ecx, 0x5d558c
call fcn.00408e30
push 0x5d558c
mov ecx, edi
call fcn.00477830
mov al, byte [ebp - 0x629]
jmp 0x4b3320
xor esi, esi
nop
mov edx, dword [esi*4 + 0x58d738]
mov ecx, edi
call fcn.0040d0a0
test al, al
jne 0x4b391f
inc esi
cmp esi, 0xe
jb 0x4b3900
xor al, al
jmp 0x4b3320
lea eax, [ebp - 0x638]
push eax
push dword [esi*4 + 0x58d700]
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
je 0x4b3c5c
mov eax, dword fs:[0x2c]
mov ebx, dword [esi*4 + 0x58d700]
mov ecx, dword [eax]
mov eax, dword [0x5d59a8]
cmp eax, dword [ecx + 4]
jle 0x4b39ab
push 0x5d59a8
call fcn.0051dec2
add esp, 4
cmp dword [0x5d59a8], 0xffffffff
jne 0x4b39ab
mov dword [ebp - 4], 0x10
push 0x570390
mov dword [0x5d59ac], 0x5839b4
mov dword [0x5d59b0], 0
call fcn.0051dd7a
add esp, 4
mov dword [ebp - 4], 0xffffffff
push 0x5d59a8
call fcn.0051de78
add esp, 4
cmp dword [0x5d59b0], 0
jne 0x4b3a03
push str.shfolder.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ecx, dword [0x5d59b0]
mov esi, eax
cmp esi, ecx
je 0x4b39e1
mov edx, dword [0x5d59ac]
mov ecx, 0x5d59ac
call dword [edx + 4]
mov ecx, esi
mov dword [0x5d59b0], ecx
test ecx, ecx
je 0x4b3a82
push 0x58d6c0
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x5d566c], eax
test eax, eax
jne 0x4b3a0c
jmp 0x4b3a82
mov eax, dword [0x5d566c]
test eax, eax
je 0x4b3a82
lea ecx, [ebp - 0x628]
push ecx
push 0
push 0
push ebx
push 0
call eax
mov esi, eax
test esi, esi
jne 0x4b3a82
lea ecx, [ebp - 0x628]
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4b3a30
sub ecx, edx
lea eax, [ebp - 0x628]
sar ecx, 1
push ecx
push eax
mov ecx, edi
call fcn.00408e30
mov edx, dword [edi]
mov ecx, dword [edx - 0xc]
test ecx, ecx
jle 0x4b3a7a
lea eax, [ecx - 1]
test eax, eax
js 0x4b3cca
cmp eax, ecx
jg 0x4b3cca
cmp word [edx + eax*2], 0x5c
je 0x4b3a7a
push 0x5c
mov ecx, edi
call fcn.0048fc70
test esi, esi
je 0x4b348f
mov eax, dword [0x5d3454]
cmp eax, 0xffffffff
jne 0x4b3b03
lea eax, [ebp - 0x63c]
mov dword [0x5d3454], 0
push eax
lea edx, [ebp - 0x630]
mov ecx, str.Shlwapi.dll
call fcn.004cc4c0
add esp, 4
test al, al
je 0x4b3abf
cmp dword [ebp - 0x630], 5
ja 0x4b3af2
je 0x4b3af2
mov eax, dword [0x5d3454]
cmp eax, 1
je 0x4b3b06
lea eax, [ebp - 0x63c]
mov ecx, 0x58dfac
push eax
lea edx, [ebp - 0x630]
call fcn.004cc4c0
add esp, 4
test al, al
je 0x4b3afe
cmp dword [ebp - 0x630], 5
ja 0x4b3af2
jne 0x4b3afe
mov eax, 1
mov dword [0x5d3454], eax
jmp 0x4b3b03
mov eax, dword [0x5d3454]
cmp eax, 1
sete al
test al, al
jne 0x4b3918
mov eax, dword [edi]
mov ecx, str.ProgramFilesFolder
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4b3b3e
test dx, dx
je 0x4b3b3a
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4b3b3e
add eax, 4
add ecx, 4
test dx, dx
jne 0x4b3b18
xor eax, eax
jmp 0x4b3b43
sbb eax, eax
or eax, 1
test eax, eax
je 0x4b3b93
mov edx, str.ProgramFiles
mov ecx, edi
call fcn.004b3ce0
test al, al
jne 0x4b3b93
mov eax, dword [edi]
mov ecx, str.AppDataFolder
nop
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4b3b86
test dx, dx
je 0x4b3b82
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4b3b86
add eax, 4
add ecx, 4
test dx, dx
jne 0x4b3b60
xor eax, eax
jmp 0x4b3b8b
sbb eax, eax
or eax, 1
test eax, eax
jne 0x4b3918
mov eax, dword [edi]
mov ecx, str.AppDataFolder
nop word [eax + eax]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4b3bc6
test dx, dx
je 0x4b3bc2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4b3bc6
add eax, 4
add ecx, 4
test dx, dx
jne 0x4b3ba0
xor ecx, ecx
jmp 0x4b3bcb
sbb ecx, ecx
or ecx, 1
xor eax, eax
mov edx, str.PROGRAMFILES
mov word [ebp - 0x420], ax
test ecx, ecx
push 0x104
lea eax, [ebp - 0x420]
push eax
mov eax, str.APPDATA
cmovne eax, edx
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov esi, eax
test esi, esi
je 0x4b3c0a
mov eax, 0x5c
mov word [ebp + esi*2 - 0x420], ax
inc esi
lea eax, [esi + esi]
cmp eax, 0x208
jae 0x4b3cd4
xor ecx, ecx
mov word [ebp + eax - 0x420], cx
cmp word [ebp - 0x420], cx
je 0x4b3c52
lea ecx, [ebp - 0x420]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4b3c34
sub ecx, edx
lea eax, [ebp - 0x420]
sar ecx, 1
push ecx
push eax
mov ecx, edi
call fcn.00408e30
test esi, esi
setne al
jmp 0x4b3320
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x638]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
mov esi, eax
mov dword [ebp - 0x634], 0
lea eax, [ebp - 0x634]
push eax
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
mov ecx, dword [ebp - 0x634]
push dword [ebp - 0x638]
push ecx
mov edx, dword [ecx]
call dword [edx + 0x14]
test esi, esi
je 0x4b3918
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4b3cb0
jmp 0x4b3450
push 0x80004005
call fcn.00408f80
push 0x80070057
call fcn.00408f80
call fcn.0051e0ba
int3