Function at 0x40d930
Capabilities:
Get common file path
Get program files directory

Disassembly:
push 0xffffffffffffffff
push 0x43dd5b
mov eax, dword fs:[0]
push eax
sub esp, 0x430
mov eax, dword [0x44a2b8]
xor eax, esp
mov dword [esp + 0x42c], eax
push ebx
push esi
mov eax, dword [0x44a2b8]
xor eax, esp
push eax
lea eax, [esp + 0x43c]
mov dword fs:[0], eax
xor ebx, ebx
push 0x206
lea eax, [esp + 0x2e]
push ebx
push eax
mov word [esp + 0x34], bx
call fcn.00429d70
push 0x206
lea ecx, [esp + 0x242]
push ebx
push ecx
mov word [esp + 0x248], bx
call fcn.00429d70
add esp, 0x18
push ebx
push 0x441b18
lea esi, [esp + 0x14]
mov dword [esp + 0x2c], 7
mov dword [esp + 0x28], ebx
mov word [esp + 0x18], bx
call fcn.00401d00
cmp dword [esp + 0x44c], 1
mov dword [esp + 0x444], ebx
jne 0x40da6d
push 1
push 0x26
lea edx, [esp + 0x30]
push edx
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x40da44
lea eax, [esp + 0x28]
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x40d9f0
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0x2c]
push eax
lea esi, [esp + 0x14]
call fcn.00401d00
mov eax, dword [esp + 0x20]
lea esi, [eax - 1]
cmp esi, eax
jbe 0x40da1e
call fcn.0042588d
cmp dword [esp + 0x24], 8
mov eax, dword [esp + 0x10]
jae 0x40da2d
lea eax, [esp + 0x10]
cmp word [eax + esi*2], 0x5c
je 0x40da44
push 1
push 0x4420e8
lea ecx, [esp + 0x14]
call fcn.0040ff40
cmp dword [esp + 0x24], 8
mov ecx, dword [esp + 0x10]
jae 0x40da53
lea ecx, [esp + 0x10]
lea edx, [esp + 0x28]
movzx eax, word [ecx]
mov word [edx], ax
add ecx, 2
add edx, 2
cmp ax, bx
jne 0x40da57
jmp 0x40dbae
mov eax, dword [esp + 0x44c]
cmp eax, 2
jne 0x40db1d
push 1
push 0x24
lea ecx, [esp + 0x30]
push ecx
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x40daf4
lea eax, [esp + 0x28]
lea edx, [eax + 2]
jmp 0x40daa0
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x40daa0
sub eax, edx
sar eax, 1
push eax
lea edx, [esp + 0x2c]
push edx
lea esi, [esp + 0x14]
call fcn.00401d00
mov eax, dword [esp + 0x20]
lea esi, [eax - 1]
cmp esi, eax
jbe 0x40dace
call fcn.0042588d
cmp dword [esp + 0x24], 8
mov eax, dword [esp + 0x10]
jae 0x40dadd
lea eax, [esp + 0x10]
cmp word [eax + esi*2], 0x5c
je 0x40daf4
push 1
push 0x4420e8
lea ecx, [esp + 0x14]
call fcn.0040ff40
cmp dword [esp + 0x24], 8
mov ecx, dword [esp + 0x10]
jae 0x40db03
lea ecx, [esp + 0x10]
lea edx, [esp + 0x28]
movzx eax, word [ecx]
mov word [edx], ax
add ecx, 2
add edx, 2
cmp ax, bx
jne 0x40db07
jmp 0x40dbae
cmp eax, ebx
jne 0x40dbae
mov ecx, 0x441b18
mov eax, edi
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40db56
cmp dx, bx
je 0x40db52
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40db56
add eax, 4
add ecx, 4
cmp dx, bx
jne 0x40db30
xor eax, eax
jmp 0x40db5b
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
je 0x40dbae
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x40db64
sub eax, edx
sar eax, 1
cmp word [edi + eax*2 - 2], 0x5c
push edi
je 0x40db92
push 0x44210c
push 0x208
push 0x104
lea eax, [esp + 0x38]
push eax
jmp 0x40dba6
push 0x441d18
push 0x208
push 0x104
lea ecx, [esp + 0x38]
push ecx
call fcn.00425032
add esp, 0x14
mov eax, 0x44f220
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x40dbb6
sub eax, edx
sar eax, 1
cmp word [eax*2 + 0x44f21e], 0x5c
push 0x44f220
je 0x40dbee
push 0x44210c
push 0x208
push 0x104
lea edx, [esp + 0x240]
push edx
jmp 0x40dc05
push 0x441d18
push 0x208
push 0x104
lea eax, [esp + 0x240]
push eax
call fcn.00425032
add esp, 0x14
mov ecx, 0x441b18
lea eax, [esp + 0x28]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40dc3c
cmp dx, bx
je 0x40dc38
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40dc3c
add eax, 4
add ecx, 4
cmp dx, bx
jne 0x40dc16
xor eax, eax
jmp 0x40dc41
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
je 0x40dcea
lea eax, [esp + 0x28]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x40dc50
sub eax, edx
sar eax, 1
mov edx, eax
lea eax, [esp + 0x230]
lea esi, [eax + 2]
jmp 0x40dc70
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x40dc70
sub eax, esi
sar eax, 1
cmp edx, eax
jbe 0x40dc91
cmp dword [esp + 0x24], 8
jb 0x40dcfe
mov ecx, dword [esp + 0x10]
push ecx
jmp 0x40dcf6
jne 0x40dca7
cmp dword [esp + 0x44c], ebx
jne 0x40dca7
lea esi, [esp + 0xc]
call fcn.00401cd0
jmp 0x40dcfe
push edx
lea edx, [esp + 0x234]
push edx
lea eax, [esp + 0x30]
push eax
call fcn.0042572e
add esp, 0xc
test eax, eax
jne 0x40dcdc
cmp dword [esp + 0x24], 8
jb 0x40dcd5
mov ecx, dword [esp + 0x10]
push ecx
call fcn.004250ac
add esp, 4
mov eax, 1
jmp 0x40dd00
cmp dword [esp + 0x24], 8
jb 0x40dcfe
mov edx, dword [esp + 0x10]
push edx
jmp 0x40dcf6
cmp dword [esp + 0x24], 8
jb 0x40dcfe
mov eax, dword [esp + 0x10]
push eax
call fcn.004250ac
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x43c]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x42c]
xor ecx, esp
call fcn.00424e88
add esp, 0x43c
ret