Function at 0x40ee76
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x1a0]
sub esp, 0x220
mov eax, dword [0x42a060]
push ebx
xor eax, ebp
push edi
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpA]
mov ebx, ecx
mov dword [ebp + 0x19c], eax
mov eax, dword [ebx]
push str.ProgramFiles64Folder
push eax
mov dword [ebp - 0x80], ebx
call edi
test eax, eax
jne 0x40eefb
mov eax, dword [ebx]
sub eax, 0x10
call fcn.00401773
add eax, 0x10
mov dword [ebp - 0x7c], eax
push str.ProgramW6432
lea eax, [ebp - 0x7c]
call fcn.0040f2e8
test eax, eax
je 0x40eef0
lea eax, [ebp - 0x7c]
mov edi, ebx
call fcn.0040158b
mov eax, ebx
call fcn.0040d33b
mov eax, dword [ebp - 0x7c]
add eax, 0xfffffff0
call fcn.0040175b
mov al, 1
jmp 0x40f141
mov eax, dword [ebp - 0x7c]
add eax, 0xfffffff0
call fcn.0040175b
push esi
push str.SystemFolder
lea esi, [ebp - 0x78]
mov byte [ebp - 0x71], 1
call fcn.00401cf3
mov eax, dword [eax]
mov ebx, dword [ebx]
push eax
push ebx
call edi
mov ebx, eax
mov eax, dword [ebp - 0x78]
neg ebx
sbb bl, bl
add eax, 0xfffffff0
inc bl
call fcn.0040175b
test bl, bl
je 0x40ef62
push 0x104
lea eax, [ebp + 0x98]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov byte [ebp + eax + 0x98], 0x5c
mov byte [ebp + eax + 0x99], 0
lea eax, [ebp + 0x98]
push eax
push dword [ebp - 0x80]
call fcn.00401d22
jmp 0x40f13d
push str.WindowsFolder
lea esi, [ebp - 0x78]
call fcn.00401cf3
mov eax, dword [eax]
mov esi, dword [ebp - 0x80]
mov ecx, dword [esi]
push eax
push ecx
call edi
mov ebx, eax
mov eax, dword [ebp - 0x78]
neg ebx
sbb bl, bl
add eax, 0xfffffff0
inc bl
call fcn.0040175b
test bl, bl
je 0x40efbd
push 0x104
lea eax, [ebp + 0x98]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov byte [ebp + eax + 0x98], 0x5c
mov byte [ebp + eax + 0x99], 0
lea eax, [ebp + 0x98]
push eax
push esi
jmp 0x40ef58
push str.WindowsVolume
lea esi, [ebp - 0x78]
call fcn.00401cf3
mov eax, dword [eax]
mov ecx, dword [ebp - 0x80]
mov ecx, dword [ecx]
push eax
push ecx
call edi
mov ebx, eax
mov eax, dword [ebp - 0x78]
neg ebx
sbb bl, bl
add eax, 0xfffffff0
inc bl
call fcn.0040175b
test bl, bl
je 0x40f00a
push 0x104
lea eax, [ebp + 0x98]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov byte [ebp + 0x9b], 0
jmp 0x40ef4e
mov ebx, dword [ebp - 0x80]
mov eax, dword [ebx]
push str.TempFolder
push eax
call edi
test eax, eax
jne 0x40f042
lea eax, [ebp + 0x98]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov byte [ebp + eax + 0x98], 0
lea eax, [ebp + 0x98]
push eax
push ebx
jmp 0x40ef58
mov eax, dword [ebx]
push str.SETUPEXEDIR
push eax
call edi
test eax, eax
jne 0x40f0a3
mov eax, dword [0x42a758]
cmp dword [eax - 0xc], 0
mov esi, 0x42a758
jne 0x40f095
push 0x105
lea eax, [ebp - 0x70]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
jmp 0x40f07a
cmp byte [ebp + eax - 0x70], 0x5c
je 0x40f07d
dec eax
jne 0x40f073
lea ecx, [ebp - 0x70]
mov byte [ebp + eax - 0x6f], 0
call fcn.00401d3c
push eax
lea eax, [ebp - 0x70]
push eax
push esi
call fcn.004017cb
mov eax, esi
mov edi, ebx
call fcn.0040158b
jmp 0x40f13d
xor esi, esi
mov eax, dword [esi*4 + 0x42a414]
mov ecx, dword [ebx]
push eax
push ecx
call edi
test eax, eax
je 0x40f0bc
inc esi
cmp esi, 0xd
jb 0x40f0a5
cmp esi, 0xd
jae 0x40f139
lea eax, [ebp - 0x78]
push eax
lea esi, [esi*4 + 0x425e80]
push dword [esi]
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
je 0x40f0f3
push dword [esi]
call fcn.0040f158
test al, al
pop ecx
jne 0x40f13d
mov edi, dword [ebp - 0x80]
call fcn.0040f21b
mov byte [ebp - 0x71], al
jmp 0x40f13d
lea eax, [ebp + 0x98]
push eax
push dword [ebp - 0x78]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
and dword [ebp - 0x7c], 0
mov esi, eax
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
mov eax, dword [ebp - 0x7c]
push dword [ebp - 0x78]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
test esi, esi
je 0x40f139
lea eax, [ebp + 0x98]
push eax
push ebx
call fcn.00401d22
mov eax, ebx
call fcn.0040d33b
jmp 0x40f13d
mov byte [ebp - 0x71], 0
mov al, byte [ebp - 0x71]
pop esi
mov ecx, dword [ebp + 0x19c]
pop edi
xor ecx, ebp
pop ebx
call fcn.00423ac2
add ebp, 0x1a0
leave
ret