Function at 0x47f1b0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x524
mov eax, dword [0x4c32cc]
xor eax, esp
mov dword [esp + 0x520], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
xor edi, edi
mov ebx, ecx
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], edi
mov dword [esp + 0x14], edi
cmp dword [0x4d2afc], edi
je 0x47f21f
lea ecx, [esp + 0x1c]
push str.KERNEL32.DLL
mov dword [esp + 0x14], ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
cmp esi, edi
je 0x47f21f
push str.Wow64DisableWow64FsRedirection
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, edi
je 0x47f218
lea edx, [esp + 0x10]
push edx
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 0x400
push edi
push 0x4d2660
call fcn.004a3190
push 0x400
lea eax, [esp + 0x30]
push edi
push eax
call fcn.004a3190
add esp, 0x18
mov edx, str.SYSTEMROOT
mov ecx, ebx
call fcn.0047dee0
test eax, eax
je 0x47f2a5
push 0x104
lea ecx, [esp + 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov eax, 0x104
lea ecx, [esp + 0x20]
jmp 0x47f270
cmp byte [ecx], 0
je 0x47f27e
inc ecx
dec eax
jne 0x47f270
jmp 0x47f42b
cmp eax, edi
je 0x47f42b
mov ecx, 0x104
sub ecx, eax
mov eax, 0x104
add ebx, 0xc
sub eax, ecx
lea ecx, [esp + ecx + 0x20]
mov edx, 0x7fffffff
jmp 0x47f425
mov edx, str._WINDIR_
mov ecx, ebx
call fcn.0047dee0
test eax, eax
je 0x47f305
push 0x104
lea edx, [esp + 0x24]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov eax, 0x104
lea ecx, [esp + 0x20]
mov edi, edi
cmp byte [ecx], 0
je 0x47f2de
inc ecx
dec eax
jne 0x47f2d0
jmp 0x47f42b
cmp eax, edi
je 0x47f42b
mov ecx, 0x104
sub ecx, eax
mov eax, 0x104
add ebx, 8
sub eax, ecx
lea ecx, [esp + ecx + 0x20]
mov edx, 0x7fffffff
jmp 0x47f425
mov edx, str._PROGRAMFILES_
mov ecx, ebx
call fcn.0047dee0
test eax, eax
je 0x47f395
push 0x104
push str.ProgramFilesDir
push str.SOFTWAREMicrosoftWindowsCurrentVersion
lea ecx, [esp + 0x2c]
mov edx, 0x80000002
call fcn.0048e050
add esp, 0xc
test eax, eax
jne 0x47f355
push str.C:Program_Files
mov edx, 0x7ffffffe
mov eax, 0x104
lea ecx, [esp + 0x24]
call fcn.00401000
mov eax, 0x104
lea ecx, [esp + 0x20]
mov edi, edi
cmp byte [ecx], 0
je 0x47f36e
inc ecx
dec eax
jne 0x47f360
jmp 0x47f42b
cmp eax, edi
je 0x47f42b
mov ecx, 0x104
sub ecx, eax
mov eax, 0x104
add ebx, 0xe
sub eax, ecx
lea ecx, [esp + ecx + 0x20]
mov edx, 0x7fffffff
jmp 0x47f425
mov edx, str._PROGRAMFILES_X86__
mov ecx, ebx
call fcn.0047dee0
lea ecx, [esp + 0x20]
test eax, eax
je 0x47f41b
push 0x104
push str.ProgramFilesDir__x86_
push str.SOFTWAREMicrosoftWindowsCurrentVersion
mov edx, 0x80000002
call fcn.0048e050
add esp, 0xc
test eax, eax
jne 0x47f3e1
push str.C:Program_Files__x86_
mov edx, 0x7ffffffe
mov eax, 0x104
lea ecx, [esp + 0x24]
call fcn.00401000
mov eax, 0x104
lea ecx, [esp + 0x20]
lea ebx, [ebx]
cmp byte [ecx], 0
je 0x47f3fb
inc ecx
dec eax
jne 0x47f3f0
jmp 0x47f42b
cmp eax, edi
je 0x47f42b
mov ecx, 0x104
sub ecx, eax
mov eax, 0x104
add ebx, 0x13
sub eax, ecx
lea ecx, [esp + ecx + 0x20]
mov edx, 0x7fffffff
jmp 0x47f425
mov edx, 0x7ffffffe
mov eax, 0x104
push ebx
call fcn.00401000
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [esp + 0x20]
push eax
xor ebx, ebx
xor esi, esi
call edi
test eax, eax
jle 0x47f4e0
cmp byte [esp + esi + 0x20], 0x2e
jne 0x47f478
movsx ecx, byte [esp + esi + 0x22]
push ecx
call fcn.004a1d97
add esp, 4
cmp eax, 0x58
je 0x47f4b6
cmp byte [esp + esi + 0x20], 0x2e
jne 0x47f478
movsx edx, byte [esp + esi + 0x22]
push edx
call fcn.004a1d97
add esp, 4
cmp eax, 0x4c
je 0x47f4b6
movsx eax, byte [esp + esi + 0x20]
push eax
call fcn.004a1d97
mov byte [ebx + 0x4d2660], al
add esp, 4
inc ebx
cmp byte [esp + esi + 0x20], 0x3a
jne 0x47f4a8
lea ecx, [esi - 1]
mov dword [esp + 0x14], ecx
cmp esi, 1
jge 0x47f4a8
mov dword [esp + 0x14], 0
lea edx, [esp + 0x20]
push edx
inc esi
call edi
cmp esi, eax
jl 0x47f444
jmp 0x47f4e0
xor edi, edi
lea esi, [esp + esi + 0x20]
lea esp, [esp]
movsx eax, byte [esi + edi]
push eax
call fcn.004a1d97
mov byte [ebx + 0x4d2660], al
inc edi
add esp, 4
inc ebx
cmp edi, 4
jl 0x47f4c0
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
mov eax, dword [esp + 0x18]
mov byte [ebx + 0x4d2660], 0
mov ebx, dword [esp + 0x14]
lea ebx, [ebx + 0x4d2660]
mov edx, ebx
mov esi, 0x104
sub edx, eax
mov edi, edi
lea ecx, [esi + 0x7ffffefa]
test ecx, ecx
je 0x47f519
mov cl, byte [eax + edx]
test cl, cl
je 0x47f519
mov byte [eax], cl
inc eax
dec esi
jne 0x47f500
jmp 0x47f51d
test esi, esi
jne 0x47f51e
dec eax
cmp dword [0x4d2afc], 0
mov byte [eax], 0
je 0x47f61b
lea edx, [esp + 0x1c]
push str.KERNEL32.DLL
mov dword [esp + 0x14], edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x47f565
push str.Wow64RevertWow64FsRedirection
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x47f55e
lea ecx, [esp + 0x10]
push ecx
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov esi, dword [esp + 0x18]
push esi
call edi
test eax, eax
jle 0x47f61b
mov ecx, esi
call fcn.0047d280
test eax, eax
jne 0x47f61b
mov edx, str.Program_Files__x86_
mov ecx, esi
call fcn.0047dee0
test eax, eax
je 0x47f61b
push str.C:Program_Files_
mov edx, 0x7ffffffe
mov eax, 0x104
lea ecx, [esp + 0x424]
call fcn.00401000
mov eax, 0x104
lea ecx, [esp + 0x420]
mov edi, edi
cmp byte [ecx], 0
je 0x47f5cb
inc ecx
dec eax
jne 0x47f5c0
jmp 0x47f5f2
test eax, eax
je 0x47f5f2
mov ecx, 0x104
sub ecx, eax
lea edx, [esi + 0x17]
mov eax, 0x104
push edx
sub eax, ecx
lea ecx, [esp + ecx + 0x424]
mov edx, 0x7fffffff
call fcn.00401000
lea ecx, [esp + 0x420]
call fcn.0047d280
test eax, eax
je 0x47f61b
lea eax, [esp + 0x420]
push eax
mov edx, 0x7ffffffe
mov eax, 0x104
mov ecx, esi
call fcn.00401000
push ebx
call edi
mov ecx, dword [esp + 0x52c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004a01d6
mov esp, ebp
pop ebp
ret