Function at 0x456862
Capabilities:
Get common file path

Disassembly:
push 0x2e4
mov eax, 0x611965
call fcn.00429868
mov dword [ebp - 0x2d8], ecx
mov ebx, dword [ebp + 8]
xor edi, edi
call fcn.00455982
cmp dword [ebx + 0x10], edi
je 0x456cae
push str.Uninstall
lea ecx, [ebp - 0x2b4]
call fcn.0040ad69
lea eax, [ebp - 0x2d4]
mov dword [ebp - 4], edi
push eax
push edi
push edi
push 0x67f544
mov dword [ebp - 0x2d4], edi
call sub.SHELL32.dll_SHGetKnownFolderPath
mov esi, eax
test esi, esi
js 0x45698b
push dword [ebp - 0x2d4]
lea ecx, [ebp - 0x2f0]
call fcn.0040ad69
push 0x63ee84
mov ecx, eax
mov byte [ebp - 4], 1
call fcn.00411c2b
push eax
lea ecx, [ebp - 0x2cc]
call fcn.00413889
lea ecx, [ebp - 0x2f0]
mov byte [ebp - 4], 3
call fcn.00413b5a
push ebx
lea ecx, [ebp - 0x284]
call fcn.00411a2e
push edi
push dword [ebp - 0x2d4]
lea ecx, [ebp - 0x284]
mov byte [ebp - 4], 4
call fcn.00457b9f
push dword [ebp - 0x2d4]
mov edi, eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
cmp edi, 0xffffffff
je 0x45694a
mov ecx, dword [ebp - 0x2bc]
push 0x682614
inc ecx
push ecx
push edi
lea ecx, [ebp - 0x284]
call 0x457c38
cmp dword [ebp - 0x270], 8
lea eax, [ebp - 0x284]
push dword [ebp - 0x274]
cmovae eax, dword [ebp - 0x284]
lea ecx, [ebp - 0x2b4]
push eax
call fcn.00411d08
lea ecx, [ebp - 0x284]
call fcn.00413b5a
lea ecx, [ebp - 0x2cc]
call fcn.00413b5a
jmp 0x456a4e
push 0x4e
lea eax, [ebp - 0x60]
push edi
push eax
call fcn.0042a970
xor eax, eax
lea edi, [ebp - 0x27c]
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x27c]
push eax
call dword [sym.imp.ole32.dll_CoCreateGuid]
mov esi, eax
test esi, esi
js 0x456a3f
movzx eax, byte [ebp - 0x26d]
push eax
movzx eax, byte [ebp - 0x26e]
push eax
movzx eax, byte [ebp - 0x26f]
push eax
movzx eax, byte [ebp - 0x270]
push eax
movzx eax, byte [ebp - 0x271]
push eax
movzx eax, byte [ebp - 0x272]
push eax
movzx eax, byte [ebp - 0x273]
push eax
movzx eax, byte [ebp - 0x274]
push eax
movzx eax, word [ebp - 0x276]
push eax
movzx eax, word [ebp - 0x278]
push eax
push dword [ebp - 0x27c]
lea eax, [ebp - 0x60]
push str._08X_04X_04X_02X_02X_02X_02X_02X_02X_02X_02X
push 0x27
push eax
call fcn.00413a92
add esp, 0x38
test eax, eax
jns 0x456a3f
push eax
push str.ScheduleDirectoryRemovalOnNextLogon_StringCchPrintf___failed._hr0x_08X
push 0x63e990
push 1
call fcn.0044ffa7
add esp, 0x10
lea eax, [ebp - 0x60]
push eax
lea ecx, [ebp - 0x2b4]
call fcn.00411c2b
xor edi, edi
xor ecx, ecx
push 7
pop eax
mov dword [ebp - 0x29c], edi
mov dword [ebp - 0x28c], edi
mov dword [ebp - 0x288], eax
mov word [ebp - 0x29c], cx
mov byte [ebp - 4], 5
test esi, esi
js 0x456c32
push 0x208
lea eax, [ebp - 0x268]
push edi
push eax
call fcn.0042a970
add esp, 0xc
lea eax, [ebp - 0x268]
push eax
push edi
push edi
push 0x25
push edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov esi, eax
test esi, esi
js 0x456c2c
push edi
push str.cmd.exe
push 0x104
lea eax, [ebp - 0x268]
push eax
call fcn.0044e8ad
mov esi, eax
mov dword [ebp - 0x26c], esi
test esi, esi
js 0x456c2c
lea eax, [ebp - 0x268]
push eax
lea ecx, [ebp - 0x29c]
call fcn.00411bb5
push str.__q__c_rmdir__s__q__
lea ecx, [ebp - 0x29c]
call fcn.00411c2b
cmp dword [ebx + 0x14], 8
mov eax, ebx
jb 0x456afe
mov eax, dword [ebx]
push eax
lea ecx, [ebp - 0x29c]
call fcn.00411c2b
push 0x6843e8
lea ecx, [ebp - 0x29c]
call fcn.00411c2b
cmp dword [ebx + 0x18], edi
je 0x456c2c
cmp dword [ebx + 0x14], 8
mov edi, dword [0x6c2c3c]
mov eax, dword [edi]
mov ecx, dword [eax + 8]
mov eax, ebx
mov dword [ebp - 0x2d0], ecx
jb 0x456b3e
mov eax, dword [ebx]
push eax
call dword [0x6317ac]
mov ecx, edi
call dword [ebp - 0x2d0]
test eax, eax
je 0x456c2c
cmp dword [ebx + 0x14], 8
mov esi, dword [0x6c2c3c]
mov eax, dword [esi]
mov edi, dword [eax + 0xc]
mov eax, ebx
jb 0x456b6a
mov eax, dword [ebx]
push eax
mov ecx, edi
call dword [0x6317ac]
mov ecx, esi
call edi
test eax, eax
jne 0x456ba5
cmp dword [ebx + 0x14], 8
mov esi, dword [0x6c2c3c]
mov eax, dword [esi]
mov edi, dword [eax + 0xc]
mov eax, ebx
jb 0x456b90
mov eax, dword [ebx]
push eax
mov ecx, edi
call dword [0x6317ac]
mov ecx, esi
call edi
test eax, eax
je 0x456cae
mov edi, dword [0x6c2c3c]
lea ecx, [ebp - 0x29c]
cmp dword [ebp - 0x288], 8
cmovae ecx, dword [ebp - 0x29c]
mov eax, dword [edi]
cmp dword [ebp - 0x2a0], 8
mov esi, dword [eax + 4]
mov eax, dword [ebp - 0x28c]
lea edx, [eax + eax]
push edx
push ecx
push 1
lea eax, [ebp - 0x2b4]
mov ecx, esi
cmovae eax, dword [ebp - 0x2b4]
push eax
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnce
push dword [ebx + 0x18]
call dword [0x6317ac]
mov ecx, edi
call esi
test eax, eax
je 0x456c12
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
js 0x456c2c
jmp 0x456c18
mov esi, dword [ebp - 0x26c]
cmp dword [ebx + 0x14], 8
jb 0x456c20
mov ebx, dword [ebx]
mov ecx, dword [ebp - 0x2d8]
push ebx
call fcn.00453b0e
mov eax, dword [ebp - 0x288]
cmp eax, 8
jb 0x456c7f
mov ecx, dword [ebp - 0x29c]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x26c], eax
mov dword [ebp - 0x2d0], ecx
cmp eax, 0x1000
jb 0x456c76
lea eax, [ebp - 0x26c]
push eax
lea eax, [ebp - 0x2d0]
push eax
call fcn.00413cba
mov eax, dword [ebp - 0x26c]
mov ecx, dword [ebp - 0x2d0]
push eax
push ecx
call fcn.00429588
pop ecx
pop ecx
and dword [ebp - 0x28c], 0
lea ecx, [ebp - 0x2b4]
xor eax, eax
mov dword [ebp - 0x288], 7
mov word [ebp - 0x29c], ax
call fcn.00413b5a
mov eax, esi
call fcn.00429817
ret 4
push 0x80004005
call fcn.00413b3a
int3