Function at 0x404b00
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x4285ac
mov eax, dword fs:[0]
push eax
sub esp, 0x5bc
mov eax, dword [0x438860]
xor eax, esp
mov dword [esp + 0x5b8], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x438860]
xor eax, esp
push eax
lea eax, [esp + 0x5d0]
mov dword fs:[0], eax
mov eax, dword [esp + 0x5e4]
mov ebp, dword [esp + 0x5e0]
lea edi, [esp + 0x13c]
mov dword [esp + 0x14], eax
call fcn.00402c90
mov ebx, 0x105
mov dword [esp + 0x5d8], 0
mov ecx, ebx
lea esi, [esp + 0x144]
mov dword [esp + 0x25c], ebx
call fcn.00403480
cmp byte [esp + 0x258], 0
lea eax, [esp + 0x148]
jne 0x404b96
mov eax, dword [esp + 0x144]
mov edi, dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
add eax, 4
push eax
push 0
push 0
push 0x1a
push 0
call edi
test eax, eax
je 0x404c97
xor eax, eax
cmp dword [esp + 0x25c], eax
je 0x404bc4
mov dword [esp + 0x25c], eax
mov ecx, 1
lea esi, [esp + 0x144]
mov dword [esp + 0x140], eax
call fcn.00403480
cmp byte [esp + 0x258], 0
lea eax, [esp + 0x148]
jne 0x404bf4
mov eax, dword [esp + 0x144]
xor ecx, ecx
mov word [eax + 4], cx
mov ecx, ebx
lea esi, [esp + 0x144]
mov dword [esp + 0x25c], ebx
call fcn.00403480
cmp byte [esp + 0x258], 0
lea eax, [esp + 0x148]
jne 0x404c27
mov eax, dword [esp + 0x144]
add eax, 4
push eax
push 1
push 0
push 0x1a
push 0
call edi
test eax, eax
je 0x404c97
lea eax, [esp + 0x13c]
call fcn.00402ee0
mov eax, ebp
call fcn.00402980
push 0x433004
push 0x43210c
mov edx, eax
call fcn.004031f0
add esp, 8
cmp byte [esp + 0x258], 0
mov dword [esp + method.t_str.virtual_0], vtable.t_str.0
jne 0x404c90
mov eax, dword [esp + 0x144]
lea edx, [esp + 0x148]
cmp eax, edx
je 0x404c90
push eax
call fcn.00411ae3
add esp, 4
xor al, al
jmp 0x404ee9
lea edi, [esp + 0x13c]
call fcn.00403080
cmp byte [esp + 0x258], 0
lea eax, [esp + 0x148]
jne 0x404cbb
mov eax, dword [esp + 0x144]
push 0
push 0
push 0
push 0
push 0
add eax, 4
push eax
lea ecx, [esp + 0x278]
call fcn.00403810
mov byte [esp + 0x5d8], 1
call fcn.004049c0
mov edi, vtable.t_str.0
test al, al
je 0x404e6b
cmp byte [esp + 0x37c], 0
lea eax, [esp + 0x26c]
jne 0x404d07
mov eax, dword [esp + 0x268]
add eax, 4
push 0x5c
push eax
call fcn.004140c6
add esp, 8
test eax, eax
jne 0x404d35
cmp byte [esp + 0x37c], al
lea eax, [esp + 0x26c]
jne 0x404d30
mov eax, dword [esp + 0x268]
add eax, 4
jmp 0x404d38
add eax, 2
push eax
lea ecx, [esp + 0x388]
call fcn.00402e00
mov ecx, str.Application_Data
lea eax, [esp + 0x384]
mov byte [esp + 0x5d8], 2
call fcn.00402f90
test al, al
je 0x404e3f
mov eax, str.AppDataRoaming
lea edx, [esp + 0x384]
call fcn.00402f30
lea eax, [esp + 0x4a8]
call fcn.004037b0
lea ebx, [esp + 0x4a8]
lea eax, [esp + 0x260]
mov byte [esp + 0x5d8], 3
call fcn.00404380
cmp byte [esp + 0x4a0], 0
lea eax, [esp + 0x390]
jne 0x404db6
mov eax, dword [esp + 0x38c]
push 0
push 0
push 0
push 0
push 0
add eax, 4
push eax
lea ecx, [esp + 0x30]
call fcn.00403810
lea eax, [esp + 0x18]
lea esi, [esp + 0x4a8]
call fcn.00403b30
cmp byte [esp + 0x134], 0
mov dword [esp + 0x18], edi
jne 0x404e00
mov eax, dword [esp + 0x20]
lea ecx, [esp + 0x24]
cmp eax, ecx
je 0x404e00
push eax
call fcn.00411ae3
add esp, 4
lea eax, [esp + 0x4a8]
lea ecx, [esp + 0x260]
call fcn.00403b80
cmp byte [esp + 0x5c4], 0
mov dword [esp + 0x4a8], edi
jne 0x404e3f
mov eax, dword [esp + 0x4b0]
lea edx, [esp + 0x4b4]
cmp eax, edx
je 0x404e3f
push eax
call fcn.00411ae3
add esp, 4
cmp byte [esp + 0x4a0], 0
mov dword [esp + 0x384], edi
jne 0x404e6b
mov eax, dword [esp + 0x38c]
lea ecx, [esp + 0x390]
cmp eax, ecx
je 0x404e6b
push eax
call fcn.00411ae3
add esp, 4
cmp byte [esp + 0x37c], 0
lea eax, [esp + 0x26c]
jne 0x404e83
mov eax, dword [esp + 0x268]
mov edx, dword [esp + 0x14]
add eax, 4
call fcn.00402f30
cmp byte [esp + 0x37c], 0
mov dword [esp + 0x260], edi
jne 0x404ebb
mov eax, dword [esp + 0x268]
lea edx, [esp + 0x26c]
cmp eax, edx
je 0x404ebb
push eax
call fcn.00411ae3
add esp, 4
cmp byte [esp + 0x258], 0
mov dword [esp + 0x13c], edi
jne 0x404ee7
mov eax, dword [esp + 0x144]
lea ecx, [esp + 0x148]
cmp eax, ecx
je 0x404ee7
push eax
call fcn.00411ae3
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x5d0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x5b8]
xor ecx, esp
call fcn.00411e9c
add esp, 0x5c8
ret