Function at 0x48a969
Capabilities:
Get common file path

Disassembly:
push 0x21c
mov eax, 0x50c069
call fcn.004d0d27
mov edi, ecx
push str.ProgramFiles64Folder
call fcn.004453c8
or esi, 0xffffffff
test eax, eax
jne 0x48a9e9
push edi
lea ecx, [ebp - 0x228]
call fcn.004073ac
push str.ProgramW6432
lea ecx, [ebp - 0x228]
call fcn.00472640
test eax, eax
je 0x48a9d8
lea eax, [ebp - 0x228]
mov ecx, edi
push eax
call fcn.0044369a
mov ecx, edi
call fcn.0046fb70
or dword [ebp - 4], esi
mov ecx, dword [ebp - 0x228]
lea ecx, [ecx - 0x10]
call fcn.00406dd3
mov al, 1
jmp 0x48ac88
mov dword [ebp - 4], esi
mov ecx, dword [ebp - 0x228]
lea ecx, [ecx - 0x10]
call fcn.00406dd3
push str.SystemFolder
lea ecx, [ebp - 0x224]
mov byte [ebp - 0x21d], 1
call fcn.004093f6
mov ecx, edi
push dword [eax]
call fcn.004453c8
mov ebx, eax
neg ebx
sbb bl, bl
mov dword [ebp - 4], esi
mov ecx, dword [ebp - 0x224]
add ecx, 0xfffffff0
call fcn.00406dd3
add bl, 1
je 0x48aa3e
push 0x104
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
jmp 0x48aa85
call fcn.004d096b
push str.WindowsFolder
lea ecx, [ebp - 0x224]
call fcn.004093f6
mov ecx, edi
push dword [eax]
call fcn.004453c8
mov ebx, eax
neg ebx
sbb bl, bl
mov dword [ebp - 4], esi
mov ecx, dword [ebp - 0x224]
add ecx, 0xfffffff0
call fcn.00406dd3
add bl, 1
je 0x48aa99
push 0x104
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push 0x5c
pop ecx
mov word [ebp + eax*2 - 0x21c], cx
lea eax, [eax*2 + 2]
jmp 0x48ab0f
push str.WindowsVolume
lea ecx, [ebp - 0x224]
call fcn.004093f6
mov ecx, edi
push dword [eax]
call fcn.004453c8
mov ebx, eax
neg ebx
sbb bl, bl
mov dword [ebp - 4], esi
mov ecx, dword [ebp - 0x224]
add ecx, 0xfffffff0
call fcn.00406dd3
add bl, 1
je 0x48aaeb
push 0x104
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
xor eax, eax
mov word [ebp - 0x216], ax
jmp 0x48ab24
push str.TempFolder
mov ecx, edi
call fcn.004453c8
test eax, eax
jne 0x48ab3d
lea eax, [ebp - 0x21c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
add eax, eax
cmp eax, 0x208
jae 0x48aa39
xor ecx, ecx
mov word [ebp + eax - 0x21c], cx
lea eax, [ebp - 0x21c]
mov ecx, edi
push eax
call fcn.004093ce
mov al, byte [ebp - 0x21d]
jmp 0x48ac88
push str.SETUPEXEDIR
mov ecx, edi
call fcn.004453c8
test eax, eax
jne 0x48abd1
mov eax, dword [0x5706d0]
mov esi, 0x5706d0
cmp dword [eax - 0xc], 0
jne 0x48abc4
push 0x104
lea eax, [ebp - 0x21c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
sub eax, 1
je 0x48ab8c
push 0x5c
pop ecx
cmp word [ebp + eax*2 - 0x21c], cx
je 0x48ab8c
sub eax, 1
jne 0x48ab7d
lea eax, [eax*2 + 2]
cmp eax, 0x208
jae 0x48aa39
xor ecx, ecx
mov word [ebp + eax - 0x21c], cx
lea eax, [ebp - 0x21c]
push eax
call fcn.004d635d
pop ecx
push eax
lea eax, [ebp - 0x21c]
mov ecx, esi
push eax
call fcn.0040935b
push esi
mov ecx, edi
call fcn.0044369a
jmp 0x48ab32
xor esi, esi
push dword [esi*4 + 0x533680]
mov ecx, edi
call fcn.004453c8
test eax, eax
je 0x48abeb
inc esi
cmp esi, 0xe
jb 0x48abd3
cmp esi, 0xe
jae 0x48ac86
lea eax, [ebp - 0x224]
push eax
push dword [esi*4 + 0x5336b8]
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
je 0x48ac2d
mov ecx, dword [esi*4 + 0x5336b8]
mov edx, edi
call fcn.0048ac8e
test al, al
jne 0x48ab32
mov ecx, edi
call fcn.0048ad8e
jmp 0x48ac88
lea eax, [ebp - 0x21c]
push eax
push dword [ebp - 0x224]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
and dword [ebp - 0x228], 0
mov esi, eax
lea eax, [ebp - 0x228]
push eax
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
mov ecx, dword [ebp - 0x228]
push dword [ebp - 0x224]
push ecx
mov edx, dword [ecx]
call dword [edx + 0x14]
test esi, esi
je 0x48ac86
lea eax, [ebp - 0x21c]
mov ecx, edi
push eax
call fcn.004093ce
mov ecx, edi
call fcn.0046fb70
jmp 0x48ab32
xor al, al
call fcn.004d0cd1
ret