Function at 0x4279f0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push 0x104
push 0x4c5f50
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x427a15
push 0x4c5f50
call dword [sym.imp.SHLWAPI.dll_PathRemoveBackslashW]
push 0x104
push 0x4c6158
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x427a34
push 0x4c6158
call dword [sym.imp.SHLWAPI.dll_PathRemoveBackslashW]
call fcn.00433a10
test eax, eax
je 0x427a72
push 0x4c5f50
push str._s_system
push 0x104
push 0x4c6360
call fcn.00447c36
add esp, 0x10
push 0x4c6158
push 0x104
push 0x4c6568
call fcn.0044a00d
add esp, 0xc
jmp 0x427aa5
push 0x4c6158
push 0x104
push 0x4c6360
call fcn.0044a00d
add esp, 0xc
push 0x4c5f50
push str._s_system32
push 0x104
push 0x4c6568
call fcn.00447c36
add esp, 0x10
push 0x4c6770
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x427ac4
push 0x4c6770
call dword [sym.imp.SHLWAPI.dll_PathRemoveBackslashW]
push 0x4c6d88
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x427ae3
push 0x4c6d88
call dword [sym.imp.SHLWAPI.dll_PathRemoveBackslashW]
mov dword [ebp - 0x10], 0
push str.shfolder.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x427b10
push 0x4943b4
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x427e10
push 0x4c8e08
push 0
push 0
push 0x8023
push 0
call dword [ebp - 0x10]
test eax, eax
jl 0x427b3c
push 0x4c8e08
call dword [sym.imp.SHLWAPI.dll_PathRemoveBackslashW]
push 0x4c5d48
push 0
push 0
push 0x8009
push 0
call dword [ebp - 0x10]
test eax, eax
jl 0x427b5e
push 0x4c5d48
call dword [sym.imp.SHLWAPI.dll_PathRemoveBackslashW]
push 0x4c6978
push 0
push 0
push 0x8026
push 0
call dword [ebp - 0x10]
test eax, eax
jl 0x427b80
push 0x4c6978
call dword [sym.imp.SHLWAPI.dll_PathRemoveBackslashW]
push 0x4c8c00
push 0
push 0
push 0x801a
push 0
call dword [ebp - 0x10]
test eax, eax
jl 0x427ba2
push 0x4c8c00
call dword [sym.imp.SHLWAPI.dll_PathRemoveBackslashW]
push 0x4c9010
push 0
push 0
push 0x801c
push 0
call dword [ebp - 0x10]
test eax, eax
jl 0x427bc4
push 0x4c9010
call dword [sym.imp.SHLWAPI.dll_PathRemoveBackslashW]
push 0x4c89f8
push 0
push 0
push 0x8018
push 0
call dword [ebp - 0x10]
test eax, eax
jl 0x427be6
push 0x4c89f8
call dword [sym.imp.SHLWAPI.dll_PathRemoveBackslashW]
push 0x4c87f0
push 0
push 0
push 0x8007
push 0
call dword [ebp - 0x10]
test eax, eax
jl 0x427c08
push 0x4c87f0
call dword [sym.imp.SHLWAPI.dll_PathRemoveBackslashW]
push 0x4c9218
push 0
push 0
push 0x802e
push 0
call dword [ebp - 0x10]
test eax, eax
jl 0x427c2a
push 0x4c9218
call dword [sym.imp.SHLWAPI.dll_PathRemoveBackslashW]
push 0x4c9420
push 0
push 0
push 0x8005
push 0
call dword [ebp - 0x10]
test eax, eax
jl 0x427c4c
push 0x4c9420
call dword [sym.imp.SHLWAPI.dll_PathRemoveBackslashW]
push 0x4c9830
push 0
push 0
push 0x8019
push 0
call dword [ebp - 0x10]
test eax, eax
jl 0x427c6e
push 0x4c9830
call dword [sym.imp.SHLWAPI.dll_PathRemoveBackslashW]
push 0x4c9628
push 0
push 0
push 0x8010
push 0
call dword [ebp - 0x10]
test eax, eax
jl 0x427c90
push 0x4c9628
call dword [sym.imp.SHLWAPI.dll_PathRemoveBackslashW]
push 0x4c6b80
push 0
push 0
push 0x802b
push 0
call dword [ebp - 0x10]
test eax, eax
jl 0x427cb2
push 0x4c6b80
call dword [sym.imp.SHLWAPI.dll_PathRemoveBackslashW]
push 0x4c85e8
push 0
push 0
push 0x8016
push 0
call dword [ebp - 0x10]
test eax, eax
jl 0x427cd4
push 0x4c85e8
call dword [sym.imp.SHLWAPI.dll_PathRemoveBackslashW]
push 0x4c83e0
push 0
push 0
push 0x800b
push 0
call dword [ebp - 0x10]
test eax, eax
jl 0x427cf6
push 0x4c83e0
call dword [sym.imp.SHLWAPI.dll_PathRemoveBackslashW]
push 0x4c81d8
push 0
push 0
push 0x8017
push 0
call dword [ebp - 0x10]
test eax, eax
jl 0x427d18
push 0x4c81d8
call dword [sym.imp.SHLWAPI.dll_PathRemoveBackslashW]
push 0x4c7fd0
push 0
push 0
push 0x8002
push 0
call dword [ebp - 0x10]
test eax, eax
jl 0x427d3a
push 0x4c7fd0
call dword [sym.imp.SHLWAPI.dll_PathRemoveBackslashW]
push 0x4c75a8
push 0
push 0
push 0x8037
push 0
call dword [ebp - 0x10]
test eax, eax
jl 0x427d5c
push 0x4c75a8
call dword [sym.imp.SHLWAPI.dll_PathRemoveBackslashW]
push 0x4c73a0
push 0
push 0
push 0x800e
push 0
call dword [ebp - 0x10]
test eax, eax
jl 0x427d7e
push 0x4c73a0
call dword [sym.imp.SHLWAPI.dll_PathRemoveBackslashW]
push 0x4c79b8
push 0
push 0
push 0x8035
push 0
call dword [ebp - 0x10]
test eax, eax
jl 0x427da0
push 0x4c79b8
call dword [sym.imp.SHLWAPI.dll_PathRemoveBackslashW]
push 0x4c77b0
push 0
push 0
push 0x800d
push 0
call dword [ebp - 0x10]
test eax, eax
jl 0x427dc2
push 0x4c77b0
call dword [sym.imp.SHLWAPI.dll_PathRemoveBackslashW]
push 0x4c7dc8
push 0
push 0
push 0x8036
push 0
call dword [ebp - 0x10]
test eax, eax
jl 0x427de4
push 0x4c7dc8
call dword [sym.imp.SHLWAPI.dll_PathRemoveBackslashW]
push 0x4c7bc0
push 0
push 0
push 0x8027
push 0
call dword [ebp - 0x10]
test eax, eax
jl 0x427e06
push 0x4c7bc0
call dword [sym.imp.SHLWAPI.dll_PathRemoveBackslashW]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [ebp - 0xc], 0
push str.shell32
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x427e3d
push str.SHGetKnownFolderPath
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x427f0a
mov dword [ebp - 0x14], 0
lea eax, [ebp - 0x14]
push eax
push 0
push 0x1000
push 0x4000
push 0x8000
call fcn.0042a820
add esp, 8
push eax
call fcn.0042a820
add esp, 8
push eax
push 0x49b8ec
call dword [ebp - 0xc]
test eax, eax
jl 0x427ea2
mov ecx, dword [ebp - 0x14]
push ecx
push 0x104
push 0x4c7198
call fcn.0044a00d
add esp, 0xc
push 0x4c7198
call dword [sym.imp.SHLWAPI.dll_PathRemoveBackslashW]
lea edx, [ebp - 0x14]
push edx
push 0
push 0x1000
push 0x4000
push 0x8000
call fcn.0042a820
add esp, 8
push eax
call fcn.0042a820
add esp, 8
push eax
push 0x49b8dc
call dword [ebp - 0xc]
test eax, eax
jl 0x427ef6
mov eax, dword [ebp - 0x14]
push eax
push 0x104
push 0x4c6f90
call fcn.0044a00d
add esp, 0xc
push 0x4c6f90
call dword [sym.imp.SHLWAPI.dll_PathRemoveBackslashW]
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
movzx eax, word [0x4c7198]
test eax, eax
jne 0x427f31
push 0x104
push 0x4c9830
push 0x104
push 0x4c7198
call fcn.0044a53a
add esp, 0x10
movzx ecx, word [0x4c6f90]
test ecx, ecx
jne 0x427f58
push 0x104
push 0x4c9628
push 0x104
push 0x4c6f90
call fcn.0044a53a
add esp, 0x10
push 0x104
push 0x4bcc08
mov edx, dword [0x4b569c]
push edx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x427fed
push 0x104
push 0x4bcc08
push 0x104
push 0x4bca00
call fcn.0044a53a
add esp, 0x10
push 0x4bca00
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push 0x104
push 0x4bcc08
push 0x104
push 0x4bce10
call fcn.0044a53a
add esp, 0x10
push 0x4bce10
call dword [sym.imp.SHLWAPI.dll_PathStripPathW]
push 0x104
push 0x4bcc08
push 0x104
push 0x4bd018
call fcn.0044a53a
add esp, 0x10
push str..cfg
push 0x4bd018
call dword [sym.imp.SHLWAPI.dll_PathRenameExtensionW]
push 0x4c5f50
push str.InitPathVar_____WINDOWS__s
call fcn.00437970
add esp, 8
push 0x4c6158
push str.InitPathVar_____WINSYS__s
call fcn.00437970
add esp, 8
push 0x4c6770
push str.InitPathVar_____CURRENTDIR__s
call fcn.00437970
add esp, 8
push 0x4c6d88
push str.InitPathVar_____TEMP__s
call fcn.00437970
add esp, 8
push 0x4c5d48
push str.InitPathVar_____SENDTO__s
call fcn.00437970
add esp, 8
push 0x4c6978
push str.InitPathVar_____PROGRAMFILES__s
call fcn.00437970
add esp, 8
push 0x4c6b80
push str.InitPathVar_____PROGRAM_FILES_COMMON__s
call fcn.00437970
add esp, 8
push 0x4c73a0
push str.InitPathVar_____VIDEO_USER__s
call fcn.00437970
add esp, 8
push 0x4c75a8
push str.InitPathVar_____VIDEO_ALLUSERS__s
call fcn.00437970
add esp, 8
push 0x4c77b0
push str.InitPathVar_____MUSIC_USER__s
call fcn.00437970
add esp, 8
push 0x4c79b8
push str.InitPathVar_____MUSIC_ALLUSERS__s
call fcn.00437970
add esp, 8
push 0x4c7bc0
push str.InitPathVar_____PICTURES_USER__s
call fcn.00437970
add esp, 8
push 0x4c7dc8
push str.InitPathVar_____PICTURES_ALLUSERS__s
call fcn.00437970
add esp, 8
push 0x4c7fd0
push str.InitPathVar_____PROGRAMS_USER__s
call fcn.00437970
add esp, 8
push 0x4c81d8
push str.InitPathVar_____PROGRAMS_ALLUSERS__s
call fcn.00437970
add esp, 8
push 0x4c83e0
push str.InitPathVar_____STARTMENU_USER__s
call fcn.00437970
add esp, 8
push 0x4c85e8
push str.InitPathVar_____STARTMENU_ALLUSERS__s
call fcn.00437970
add esp, 8
push 0x4c87f0
push str.InitPathVar_____STARTUP_USER__s
call fcn.00437970
add esp, 8
push 0x4c89f8
push str.InitPathVar_____STARTUP_ALLUSERS__s
call fcn.00437970
add esp, 8
push 0x4c8c00
push str.InitPathVar_____APPDATA__s
call fcn.00437970
add esp, 8
push 0x4c8e08
push str.InitPathVar_____COMMON_APPDATA__s
call fcn.00437970
add esp, 8
push 0x4c9010
push str.InitPathVar_____LOCAL_APPDATA__s
call fcn.00437970
add esp, 8
push 0x4c9420
push str.InitPathVar_____DOCUMENTS_USER__s
call fcn.00437970
add esp, 8
push 0x4c9218
push str.InitPathVar_____DOCUMENTS_ALLUSERS__s
call fcn.00437970
add esp, 8
push 0x4c9628
push str.InitPathVar_____DESKTOP_USER__s
call fcn.00437970
add esp, 8
push 0x4c9830
push str.InitPathVar_____DESKTOP_ALLUSERS__s
call fcn.00437970
add esp, 8
push 0x4c6f90
push str.InitPathVar_____DOWNLOAD_USER__s
call fcn.00437970
add esp, 8
push 0x4c7198
push str.InitPathVar_____DOWNLOAD_ALLUSERS__s
call fcn.00437970
add esp, 8
push 0x4bcc08
push str.InitPathVar____ModuleFile_s
call fcn.00437970
add esp, 8
push 0x4bca00
push str.InitPathVar____ModulePath_s
call fcn.00437970
add esp, 8
push 0x4bce10
push str.InitPathVar____ModuleFileName_s
call fcn.00437970
add esp, 8
push 0x4bd018
push str.InitPathVar____ConfigFile_s
call fcn.00437970
add esp, 8
mov esp, ebp
pop ebp
ret