Function at 0x4c1cb0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 0x131
push 0
push 0
dec ecx
jne 0x4c1cb9
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404be8
mov eax, dword [ebp - 8]
call fcn.00404be8
mov eax, dword [ebp - 0xc]
call fcn.00404be8
mov eax, dword [ebp + 0x1c]
call fcn.00404be8
mov eax, dword [ebp + 0x18]
call fcn.00404be8
mov eax, dword [ebp + 0x14]
call fcn.00404be8
xor eax, eax
push ebp
push 0x4c230b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
call fcn.00404738
xor eax, eax
push ebp
push 0x4c2274
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x10]
mov eax, dword [0x4ce7d4]
call fcn.004737fc
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 0x10]
mov ecx, 0x4c231c
call fcn.004062a0
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 0x10]
mov ecx, 0x4c232c
call fcn.004062a0
mov edx, dword [ebp + 0x18]
mov eax, 0x4c2344
call fcn.00404d3c
test eax, eax
jle 0x4c1d69
lea eax, [ebp - 0x24]
call fcn.004c2620
mov eax, dword [ebp + 0x18]
mov edx, 0x4c2350
call fcn.00404b44
jne 0x4c1e27
lea eax, [ebp - 0x20]
push eax
push 2
mov eax, dword [0x4cead8]
mov eax, dword [eax]
mov eax, dword [eax + 0x44]
call fcn.004544a0
push eax
call sub.shell32.dll_SHGetSpecialFolderLocation
lea eax, [ebp - 0x928]
push eax
mov eax, dword [ebp - 0x20]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
mov eax, dword [ebp - 0x20]
push eax
call sub.ole32.dll_CoTaskMemFree
lea eax, [ebp - 0x930]
lea edx, [ebp - 0x928]
mov ecx, pe_nt_image_headers32
call fcn.004049a8
push dword [ebp - 0x930]
push 0x4c2360
push dword [ebp + 0x1c]
push 0x4c236c
lea eax, [ebp - 0x92c]
mov edx, 4
call fcn.00404ab8
mov edx, dword [ebp - 0x92c]
lea eax, [ebp - 0x1c]
call fcn.00404f90
cmp byte [ebp + 0xc], 0
jne 0x4c1e27
lea eax, [ebp - 0x938]
mov edx, dword [ebp - 0x1c]
call fcn.004049c0
mov eax, dword [ebp - 0x938]
lea edx, [ebp - 0x934]
call fcn.00409804
mov eax, dword [ebp - 0x934]
call fcn.00497c54
mov eax, dword [ebp + 0x18]
mov edx, 0x4c237c
call fcn.00404b44
jne 0x4c1ea2
lea eax, [ebp - 0x940]
call fcn.004c26ac
push dword [ebp - 0x940]
push 0x4c2360
push dword [ebp + 0x1c]
push 0x4c236c
lea eax, [ebp - 0x93c]
mov edx, 4
call fcn.00404ab8
mov edx, dword [ebp - 0x93c]
lea eax, [ebp - 0x1c]
call fcn.00404f90
cmp byte [ebp + 0xc], 0
jne 0x4c1ea2
lea eax, [ebp - 0x948]
mov edx, dword [ebp - 0x1c]
call fcn.004049c0
mov eax, dword [ebp - 0x948]
lea edx, [ebp - 0x944]
call fcn.00409804
mov eax, dword [ebp - 0x944]
call fcn.00497c54
mov eax, dword [ebp + 0x18]
mov edx, 0x4c2390
call fcn.00404b44
jne 0x4c1eed
lea eax, [ebp - 0x950]
call fcn.004c1c58
push dword [ebp - 0x950]
push 0x4c2360
push dword [ebp + 0x1c]
push 0x4c236c
lea eax, [ebp - 0x94c]
mov edx, 4
call fcn.00404ab8
mov edx, dword [ebp - 0x94c]
lea eax, [ebp - 0x1c]
call fcn.00404f90
mov eax, dword [ebp + 0x18]
mov edx, 0x4c23a0
call fcn.00404b44
jne 0x4c1f2a
push dword [ebp - 0x24]
push 0x4c23b4
push dword [ebp + 0x1c]
push 0x4c236c
lea eax, [ebp - 0x954]
mov edx, 4
call fcn.00404ab8
mov edx, dword [ebp - 0x954]
lea eax, [ebp - 0x1c]
call fcn.00404f90
mov eax, dword [ebp + 0x18]
mov edx, 0x4c23c8
call fcn.00404b44
jne 0x4c1f75
lea eax, [ebp - 0x95c]
call fcn.004c17c0
push dword [ebp - 0x95c]
push 0x4c2360
push dword [ebp + 0x1c]
push 0x4c236c
lea eax, [ebp - 0x958]
mov edx, 4
call fcn.00404ab8
mov edx, dword [ebp - 0x958]
lea eax, [ebp - 0x1c]
call fcn.00404f90
mov eax, dword [ebp + 0x18]
mov edx, 0x4c23dc
call fcn.00404b44
jne 0x4c1fe4
lea eax, [ebp - 0x960]
call fcn.004c1b50
mov edx, dword [ebp - 0x960]
lea eax, [ebp - 0x1c]
call fcn.00404f90
mov eax, dword [ebp - 0x1c]
xor edx, edx
call fcn.00405004
jne 0x4c1fb6
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4c2290
push dword [ebp - 0x1c]
push 0x4c23ec
lea eax, [ebp - 0x964]
mov edx, dword [ebp + 0x1c]
call fcn.00404f90
push dword [ebp - 0x964]
push 0x4c23f4
lea eax, [ebp - 0x1c]
mov edx, 4
call fcn.00404fbc
mov eax, dword [ebp + 0x18]
mov edx, 0x4c2408
call fcn.00404b44
jne 0x4c2044
lea eax, [ebp - 0x968]
mov ecx, 0x4c236c
mov edx, dword [ebp + 0x1c]
call fcn.00404a44
mov edx, dword [ebp - 0x968]
lea eax, [ebp - 0x1c]
call fcn.00404f90
cmp byte [ebp + 0xc], 0
jne 0x4c2044
lea eax, [ebp - 0x970]
mov edx, dword [ebp - 0x1c]
call fcn.004049c0
mov eax, dword [ebp - 0x970]
lea edx, [ebp - 0x96c]
call fcn.00409804
mov eax, dword [ebp - 0x96c]
call fcn.00497c54
mov eax, dword [ebp + 0x18]
mov edx, 0x4c2418
call fcn.00404b44
jne 0x4c208f
lea eax, [ebp - 0x978]
call fcn.004c1c00
push dword [ebp - 0x978]
push 0x4c2360
push dword [ebp + 0x1c]
push 0x4c236c
lea eax, [ebp - 0x974]
mov edx, 4
call fcn.00404ab8
mov edx, dword [ebp - 0x974]
lea eax, [ebp - 0x1c]
call fcn.00404f90
mov eax, dword [ebp + 0x18]
mov edx, 0x4c2428
call fcn.00404b44
jne 0x4c214d
lea eax, [ebp - 0x20]
push eax
push 2
mov eax, dword [0x4cead8]
mov eax, dword [eax]
mov eax, dword [eax + 0x44]
call fcn.004544a0
push eax
call sub.shell32.dll_SHGetSpecialFolderLocation
lea eax, [ebp - 0x928]
push eax
mov eax, dword [ebp - 0x20]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
mov eax, dword [ebp - 0x20]
push eax
call sub.ole32.dll_CoTaskMemFree
lea eax, [ebp - 0x980]
lea edx, [ebp - 0x928]
mov ecx, pe_nt_image_headers32
call fcn.004049a8
push dword [ebp - 0x980]
push 0x4c2360
push dword [ebp + 0x1c]
push 0x4c236c
lea eax, [ebp - 0x97c]
mov edx, 4
call fcn.00404ab8
mov edx, dword [ebp - 0x97c]
lea eax, [ebp - 0x1c]
call fcn.00404f90
cmp byte [ebp + 0xc], 0
jne 0x4c214d
lea eax, [ebp - 0x988]
mov edx, dword [ebp - 0x1c]
call fcn.004049c0
mov eax, dword [ebp - 0x988]
lea edx, [ebp - 0x984]
call fcn.00409804
mov eax, dword [ebp - 0x984]
call fcn.00497c54
cmp byte [ebp + 0xc], 0
je 0x4c21e1
lea eax, [ebp - 0x98c]
mov edx, dword [ebp - 0x1c]
call fcn.004049c0
mov eax, dword [ebp - 0x98c]
call fcn.004093c0
test al, al
jne 0x4c226a
xor eax, eax
push ebp
push 0x4c21c0
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, dword [ebp - 0x1c]
call fcn.00404fa0
push eax
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [eax]
call dword [eax + 0x14]
test eax, eax
je 0x4c21b3
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4c2290
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4c226a
lea eax, [ebp - 0x225]
mov edx, dword [ebp - 4]
call fcn.00409c04
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [eax]
call dword [eax + 0x50]
lea eax, [ebp - 0x426]
mov edx, dword [ebp - 0xc]
call fcn.00409c04
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [eax]
call dword [eax + 0x24]
lea eax, [ebp - 0x627]
mov edx, dword [ebp - 8]
call fcn.00409c04
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [eax]
call dword [eax + 0x2c]
mov eax, dword [ebp + 0x10]
push eax
lea eax, [ebp - 0x828]
mov edx, dword [ebp + 0x14]
call fcn.00409c04
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [eax]
call dword [eax + 0x44]
push 0
mov eax, dword [ebp - 0x1c]
call fcn.00404fa0
push eax
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [eax]
call dword [eax + 0x18]
cmp eax, 0x80004005
jne 0x4c226a
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4c2290
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4c2285
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x1c]
call fcn.004049c0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c2312
lea eax, [ebp - 0x98c]
mov edx, 0xa
call fcn.0040475c
lea eax, [ebp - 0x964]
call fcn.00404e44
lea eax, [ebp - 0x960]
mov edx, 0xe
call fcn.0040475c
lea eax, [ebp - 0x24]
call fcn.00404738
lea eax, [ebp - 0x1c]
call fcn.00404e44
lea eax, [ebp - 0x18]
call fcn.0040625c
lea eax, [ebp - 0x14]
call fcn.0040625c
lea eax, [ebp - 0x10]
call fcn.0040625c
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.0040475c
lea eax, [ebp + 0x14]
mov edx, 3
call fcn.0040475c
ret