Function at 0x4370b0
Capabilities:
Get common file path
Move file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1178
call fcn.00447c60
mov eax, dword [0x4b1120]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov word [ebp - 0x628], ax
push 0x206
push 0
lea ecx, [ebp - 0x626]
push ecx
call fcn.00447660
add esp, 0xc
xor edx, edx
mov word [ebp - 0x420], dx
push 0x206
push 0
lea eax, [ebp - 0x41e]
push eax
call fcn.00447660
add esp, 0xc
xor ecx, ecx
mov word [ebp - 0x210], cx
push 0x206
push 0
lea edx, [ebp - 0x20e]
push edx
call fcn.00447660
add esp, 0xc
xor eax, eax
mov word [ebp - 0x830], ax
push 0x206
push 0
lea ecx, [ebp - 0x82e]
push ecx
call fcn.00447660
add esp, 0xc
mov dword [ebp - 0x954], 4
push 0x11c
push 0
lea edx, [ebp - 0x950]
push edx
call fcn.00447660
add esp, 0xc
mov dword [ebp - 0x950], 0x11c
lea eax, [ebp - 0x950]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0
jne 0x4371b8
push str.ReadLockedFiles____OSVERSIONINFOEX_failed
call fcn.00437da0
add esp, 4
mov dword [ebp - 0x950], 0x114
lea ecx, [ebp - 0x950]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x4371b8
xor eax, eax
jmp 0x437448
cmp dword [ebp + 0xc], 0
je 0x437277
mov edx, dword [ebp + 8]
push edx
push 0x104
lea eax, [ebp - 0x420]
push eax
call fcn.0044a00d
add esp, 0xc
lea ecx, [ebp - 0x420]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathStripPathW]
push 3
lea edx, [ebp - 0x420]
push edx
push 0x104
lea eax, [ebp - 0x830]
push eax
call fcn.0044a53a
add esp, 0x10
mov ecx, dword [ebp + 0xc]
push ecx
push 0x104
lea edx, [ebp - 0x628]
push edx
call fcn.0044a00d
add esp, 0xc
lea eax, [ebp - 0x628]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea ecx, [ebp - 0x210]
push ecx
push 0
lea edx, [ebp - 0x830]
push edx
lea eax, [ebp - 0x628]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
push 0
lea ecx, [ebp - 0x210]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00436880
add esp, 0xc
test eax, eax
jne 0x437266
xor eax, eax
jmp 0x437448
mov eax, dword [ebp - 0x954]
or eax, 1
mov dword [ebp - 0x954], eax
jmp 0x43728f
mov ecx, dword [ebp + 8]
push ecx
push 0x104
lea edx, [ebp - 0x210]
push edx
call fcn.0044a00d
add esp, 0xc
cmp dword [ebp - 0x940], 2
jne 0x4372da
mov eax, dword [ebp - 0x954]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov dword [ebp - 0x958], eax
mov eax, dword [ebp - 0x958]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x210]
push edx
push str.MoveFileEx__s___s___d
call fcn.00437970
add esp, 0x10
jmp 0x437446
xor eax, eax
mov word [ebp - 0xb60], ax
push 0x206
push 0
lea ecx, [ebp - 0xb5e]
push ecx
call fcn.00447660
add esp, 0xc
xor edx, edx
mov word [ebp - 0xd68], dx
push 0x206
push 0
lea eax, [ebp - 0xd66]
push eax
call fcn.00447660
add esp, 0xc
lea ecx, [ebp - 0xd68]
push ecx
push 0
push 0
push 0x24
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea edx, [ebp - 0xd68]
push edx
push 0x104
lea eax, [ebp - 0xb60]
push eax
call fcn.0044a00d
add esp, 0xc
push str.WinInit.ini
lea ecx, [ebp - 0xb60]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
xor edx, edx
mov word [ebp - 0xf70], dx
push 0x206
push 0
lea eax, [ebp - 0xf6e]
push eax
call fcn.00447660
add esp, 0xc
push 0x208
lea ecx, [ebp - 0xf70]
push ecx
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
xor eax, eax
mov word [ebp - 0x1178], ax
push 0x206
push 0
lea ecx, [ebp - 0x1176]
push ecx
call fcn.00447660
add esp, 0xc
cmp dword [ebp + 0xc], 0
je 0x4373cf
push 0x208
lea edx, [ebp - 0x1178]
push edx
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
jmp 0x4373e8
push 0x4988ec
push 0x104
lea ecx, [ebp - 0x1178]
push ecx
call fcn.0044a00d
add esp, 0xc
lea edx, [ebp - 0xb60]
push edx
lea eax, [ebp - 0xf70]
push eax
lea ecx, [ebp - 0x1178]
push ecx
push str.rename
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
lea edx, [ebp - 0xb60]
push edx
push 0x498904
push 0x498908
push 0x49890c
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
lea eax, [ebp - 0xb60]
push eax
lea ecx, [ebp - 0xf70]
push ecx
lea edx, [ebp - 0x1178]
push edx
push str.ReadLockedFiles____WritePrivateProfileString_rename___s___s___s_
call fcn.00437970
add esp, 0x10
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00447645
mov esp, ebp
pop ebp
ret