Function at 0x4bfcb0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x40], ebx
mov dword [ebp - 8], ecx
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404100
xor eax, eax
push ebp
push 0x4c001c
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x44], 1
mov byte [ebp - 9], 0
mov eax, esi
call fcn.0041f350
and eax, 0x7f
cmp eax, 8
ja case.default.0x4bfd08
jmp dword [eax*4 + 0x4bfd0f]
mov edi, 0x18
jmp 0x4bfd77
mov edi, 1
jmp 0x4bfd77
mov edi, 4
jmp 0x4bfd77
mov edi, 8
jmp 0x4bfd77
mov edi, 0x10
jmp 0x4bfd77
mov edi, 0x10
jmp 0x4bfd77
mov edi, 0x18
jmp 0x4bfd77
mov edi, 0x20
jmp 0x4bfd77
mov edi, 0x18
jmp 0x4bfd77
mov edi, 0x18
push 2
push 0
mov eax, dword [0x529820]
mov eax, dword [eax]
call eax
xor eax, eax
push ebp
push 0x4bffc7
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x34]
push eax
call sub.shell32.dll_SHGetDesktopFolder
call fcn.0040e11c
test al, al
je 0x4bfdae
call fcn.004037b8
jmp 0x4bffce
lea edx, [ebp - 0x3c]
mov eax, dword [ebp - 4]
call fcn.00409124
lea edx, [ebp - 0x40]
mov eax, dword [ebp - 4]
call fcn.00409214
cmp dword [ebp - 0x40], 0
jne 0x4bfdf7
lea eax, [ebp - 0x30]
push eax
push 0x11
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
call fcn.0040e11c
test al, al
je 0x4bfdea
call fcn.004037b8
jmp 0x4bffce
lea eax, [ebp - 0x40]
mov edx, dword [ebp - 0x3c]
call fcn.00403d64
jmp 0x4bfe2e
mov eax, dword [ebp - 0x3c]
call fcn.00404b08
mov ebx, eax
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x44]
push eax
push ebx
push 0
push 0
mov eax, dword [ebp - 0x34]
push eax
mov eax, dword [eax]
call dword [eax + 0xc]
call fcn.0040e11c
test al, al
je 0x4bfe2e
call fcn.004037b8
jmp 0x4bffce
cmp dword [ebp - 0x3c], 0
jne 0x4bfe50
lea eax, [ebp - 0x38]
push eax
call sub.shell32.dll_SHGetDesktopFolder
call fcn.0040e11c
test al, al
je 0x4bfeb7
call fcn.004037b8
jmp 0x4bffce
lea eax, [ebp - 0x38]
push eax
mov eax, dword [0x529a6c]
push eax
push 0
mov eax, dword [ebp - 0x30]
push eax
mov eax, dword [ebp - 0x34]
push eax
mov eax, dword [eax]
call dword [eax + 0x14]
mov ebx, eax
mov eax, ebx
call fcn.0040e11c
test al, al
je 0x4bfe80
call fcn.004037b8
jmp 0x4bffce
mov eax, dword [ebp - 0x40]
call fcn.00404b08
mov ebx, eax
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x44]
push eax
push ebx
push 0
push 0
mov eax, dword [ebp - 0x38]
push eax
mov eax, dword [eax]
call dword [eax + 0xc]
call fcn.0040e11c
test al, al
je 0x4bfeb7
call fcn.004037b8
jmp 0x4bffce
lea eax, [ebp - 0x10]
push eax
push 0
push 0x527628
lea eax, [ebp - 0x30]
push eax
push 1
push 0
mov eax, dword [ebp - 0x38]
push eax
mov eax, dword [eax]
call dword [eax + 0x28]
mov ebx, eax
mov eax, ebx
call fcn.0040e11c
test al, al
je 0x4bfeea
call fcn.004037b8
jmp 0x4bffce
mov eax, dword [ebp - 4]
call fcn.00404b08
mov ebx, eax
xor eax, eax
push ebp
push 0x4bffaa
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 0x10]
mov ecx, 0x4c0030
call fcn.00405c0c
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 0x10]
mov ecx, 0x4c0040
call fcn.00405c0c
xor eax, eax
mov dword [ebp - 0x1c], eax
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x2c]
mov dword [ebp - 0x24], eax
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x20]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x28], eax
push 0
push ebx
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [eax]
call dword [eax + 0x14]
lea eax, [ebp - 0x28]
push eax
push edi
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 4]
call fcn.00403f4c
push eax
push ebx
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [eax]
call dword [eax + 0xc]
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [eax]
call dword [eax + 0x10]
call fcn.0040e11c
test al, al
je 0x4bff92
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
call fcn.004037b8
jmp 0x4bffce
mov edx, dword [ebp - 0x2c]
mov eax, esi
call fcn.0041fdec
mov byte [ebp - 9], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4bffb4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bffce
call sub.ole32.dll_CoUninitialize
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c0023
lea eax, [ebp - 0x40]
mov edx, 2
call fcn.00403cf0
lea eax, [ebp - 0x38]
mov edx, dword [0x44043c]
mov ecx, 2
call fcn.004045e0
lea eax, [ebp - 0x18]
call fcn.00405bd8
lea eax, [ebp - 0x14]
call fcn.00405bd8
lea eax, [ebp - 0x10]
call fcn.00405bd8
lea eax, [ebp - 4]
call fcn.00403ccc
ret