Function at 0x450b20
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4688c5
mov eax, dword fs:[0]
push eax
sub esp, 0x460
mov eax, dword [0x481288]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov word [ebp - 0x444], 0
push 0x206
push 0
lea eax, [ebp - 0x442]
push eax
call fcn.00415680
add esp, 0xc
mov word [ebp - 0x21c], 0
push 0x206
push 0
lea ecx, [ebp - 0x21a]
push ecx
call fcn.00415680
add esp, 0xc
push 0x4786f4
lea ecx, [ebp - 0x238]
call fcn.004011c0
mov dword [ebp - 4], 0
cmp dword [ebp + 8], 1
jne 0x450c2c
push 1
push 0x26
lea edx, [ebp - 0x444]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x450c11
lea eax, [ebp - 0x444]
push eax
lea ecx, [ebp - 0x238]
call fcn.00403bf0
lea ecx, [ebp - 0x238]
call fcn.00402490
mov dword [ebp - 0x448], eax
mov ecx, dword [ebp - 0x448]
sub ecx, 1
push ecx
lea ecx, [ebp - 0x238]
call fcn.00403c70
movzx edx, word [eax]
cmp edx, 0x5c
je 0x450c11
push 0x4786f8
lea ecx, [ebp - 0x238]
call fcn.00403c10
lea ecx, [ebp - 0x238]
call fcn.00401220
push eax
lea eax, [ebp - 0x444]
push eax
call fcn.00414f38
add esp, 8
cmp dword [ebp + 8], 2
jne 0x450cb8
push 1
push 0x24
lea ecx, [ebp - 0x444]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x450c9d
lea edx, [ebp - 0x444]
push edx
lea ecx, [ebp - 0x238]
call fcn.00403bf0
lea ecx, [ebp - 0x238]
call fcn.00402490
mov dword [ebp - 0x44c], eax
mov eax, dword [ebp - 0x44c]
sub eax, 1
push eax
lea ecx, [ebp - 0x238]
call fcn.00403c70
movzx ecx, word [eax]
cmp ecx, 0x5c
je 0x450c9d
push 0x4786fc
lea ecx, [ebp - 0x238]
call fcn.00403c10
lea ecx, [ebp - 0x238]
call fcn.00401220
push eax
lea edx, [ebp - 0x444]
push edx
call fcn.00414f38
add esp, 8
cmp dword [ebp + 8], 0
jne 0x450d42
push 0x478700
mov eax, dword [ebp + 0xc]
push eax
call fcn.004160f0
add esp, 8
test eax, eax
je 0x450d42
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.00414d31
add esp, 4
mov dword [ebp - 0x450], eax
mov edx, dword [ebp - 0x450]
mov eax, dword [ebp + 0xc]
movzx ecx, word [eax + edx*2 - 2]
cmp ecx, 0x5c
je 0x450d20
mov edx, dword [ebp + 0xc]
push edx
push 0x478704
push 0x208
push 0x104
lea eax, [ebp - 0x444]
push eax
call fcn.004157ac
add esp, 0x14
jmp 0x450d42
mov ecx, dword [ebp + 0xc]
push ecx
push 0x47870c
push 0x208
push 0x104
lea edx, [ebp - 0x444]
push edx
call fcn.004157ac
add esp, 0x14
mov eax, dword [ebp + 0x10]
push eax
call fcn.00414d31
add esp, 4
mov dword [ebp - 0x23c], eax
mov ecx, dword [ebp - 0x23c]
mov edx, dword [ebp + 0x10]
movzx eax, word [edx + ecx*2 - 2]
cmp eax, 0x5c
je 0x450d8b
mov ecx, dword [ebp + 0x10]
push ecx
push 0x478714
push 0x208
push 0x104
lea edx, [ebp - 0x21c]
push edx
call fcn.004157ac
add esp, 0x14
jmp 0x450dad
mov eax, dword [ebp + 0x10]
push eax
push 0x47871c
push 0x208
push 0x104
lea ecx, [ebp - 0x21c]
push ecx
call fcn.004157ac
add esp, 0x14
push 0x478724
lea edx, [ebp - 0x444]
push edx
call fcn.004160f0
add esp, 8
test eax, eax
je 0x450ed3
lea eax, [ebp - 0x444]
push eax
call fcn.00414d31
add esp, 4
mov dword [ebp - 0x458], eax
lea ecx, [ebp - 0x21c]
push ecx
call fcn.00414d31
add esp, 4
mov dword [ebp - 0x454], eax
mov edx, dword [ebp - 0x458]
cmp edx, dword [ebp - 0x454]
jbe 0x450e2d
mov dword [ebp - 0x45c], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x238]
call fcn.00401200
mov eax, dword [ebp - 0x45c]
jmp 0x450ef5
mov eax, dword [ebp - 0x458]
cmp eax, dword [ebp - 0x454]
jne 0x450e68
cmp dword [ebp + 8], 0
jne 0x450e68
mov dword [ebp - 0x460], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x238]
call fcn.00401200
mov eax, dword [ebp - 0x460]
jmp 0x450ef5
mov ecx, dword [ebp - 0x458]
push ecx
lea edx, [ebp - 0x21c]
push edx
lea eax, [ebp - 0x444]
push eax
call fcn.00416366
add esp, 0xc
test eax, eax
jne 0x450eaf
mov dword [ebp - 0x464], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x238]
call fcn.00401200
mov eax, dword [ebp - 0x464]
jmp 0x450ef5
mov dword [ebp - 0x468], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x238]
call fcn.00401200
mov eax, dword [ebp - 0x468]
jmp 0x450ef5
mov dword [ebp - 0x46c], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x238]
call fcn.00401200
mov eax, dword [ebp - 0x46c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004151d0
mov esp, ebp
pop ebp
ret