Function at 0x48b689
Capabilities:
Get common file path

Disassembly:
push 0x21c
mov eax, 0x5080b0
call fcn.004cc2a7
mov byte [ebp - 0x221], dl
mov edi, ecx
push str.ProgramFiles64Folder
call fcn.00447dcd
xor esi, esi
test eax, eax
jne 0x48b70d
push edi
lea ecx, [ebp - 0x228]
call fcn.00407175
push str.ProgramW6432
lea ecx, [ebp - 0x228]
mov dword [ebp - 4], esi
call fcn.00475c10
test eax, eax
je 0x48b6fe
lea eax, [ebp - 0x228]
mov ecx, edi
push eax
call fcn.00446083
mov ecx, edi
call fcn.00473210
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x228]
call fcn.004068bc
mov al, 1
jmp 0x48ba22
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x228]
call fcn.004068bc
push str.SystemFolder
lea ecx, [ebp - 0x220]
call fcn.00409a3c
mov dword [ebp - 4], 1
mov ecx, edi
push dword [eax]
call fcn.00447dcd
mov ebx, eax
lea ecx, [ebp - 0x220]
neg ebx
sbb bl, bl
or dword [ebp - 4], 0xffffffff
call fcn.004068bc
add bl, 1
je 0x48b793
cmp byte [ebp - 0x221], 0
lea eax, [ebp - 0x21c]
push eax
push esi
push esi
push 0x29
pop eax
push 0x25
pop ecx
cmovne eax, ecx
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea eax, [ebp - 0x21c]
push eax
call fcn.004d163d
pop ecx
push eax
lea eax, [ebp - 0x21c]
mov ecx, edi
push eax
call fcn.004099a1
mov ecx, edi
call fcn.00473210
xor eax, eax
inc eax
jmp 0x48ba22
push str.System32Folder
lea ecx, [ebp - 0x220]
call fcn.00409a3c
mov dword [ebp - 4], 2
mov ecx, edi
push dword [eax]
call fcn.00447dcd
mov ebx, eax
lea ecx, [ebp - 0x220]
neg ebx
sbb bl, bl
or dword [ebp - 4], 0xffffffff
call fcn.004068bc
add bl, 1
je 0x48b7e6
push 0x104
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
jmp 0x48b832
call fcn.004cbef6
push str.WindowsFolder
lea ecx, [ebp - 0x220]
call fcn.00409a3c
mov dword [ebp - 4], 3
mov ecx, edi
push dword [eax]
call fcn.00447dcd
mov ebx, eax
lea ecx, [ebp - 0x220]
neg ebx
sbb bl, bl
or dword [ebp - 4], 0xffffffff
call fcn.004068bc
add bl, 1
je 0x48b846
push 0x104
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push 0x5c
pop ecx
mov word [ebp + eax*2 - 0x21c], cx
lea eax, [eax*2 + 2]
jmp 0x48b8c1
push str.WindowsVolume
lea ecx, [ebp - 0x220]
call fcn.00409a3c
mov dword [ebp - 4], 4
mov ecx, edi
push dword [eax]
call fcn.00447dcd
mov ebx, eax
lea ecx, [ebp - 0x220]
neg ebx
sbb bl, bl
or dword [ebp - 4], 0xffffffff
call fcn.004068bc
add bl, 1
je 0x48b89d
push 0x104
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
xor eax, eax
mov word [ebp - 0x216], ax
jmp 0x48b8d6
push str.TempFolder
mov ecx, edi
call fcn.00447dcd
test eax, eax
jne 0x48b8f7
lea eax, [ebp - 0x21c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
add eax, eax
cmp eax, 0x208
jae 0x48b7e1
xor ecx, ecx
mov word [ebp + eax - 0x21c], cx
lea eax, [ebp - 0x21c]
push eax
call fcn.004d163d
pop ecx
push eax
lea eax, [ebp - 0x21c]
mov ecx, edi
push eax
call fcn.004099a1
jmp 0x48b78b
push str.SETUPEXEDIR
mov ecx, edi
call fcn.00447dcd
test eax, eax
jne 0x48b985
mov eax, dword [0x56f630]
mov ebx, 0x56f630
cmp dword [eax - 0xc], esi
jne 0x48b978
push 0x104
lea eax, [ebp - 0x21c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
sub eax, 1
je 0x48b940
push 0x5c
pop ecx
cmp word [ebp + eax*2 - 0x21c], cx
je 0x48b940
sub eax, 1
jne 0x48b931
lea eax, [eax*2 + 2]
cmp eax, 0x208
jae 0x48b7e1
xor ecx, ecx
mov word [ebp + eax - 0x21c], cx
lea eax, [ebp - 0x21c]
push eax
call fcn.004d163d
pop ecx
push eax
lea eax, [ebp - 0x21c]
mov ecx, ebx
push eax
call fcn.004099a1
push ebx
mov ecx, edi
call fcn.00446083
jmp 0x48b78b
xor esi, esi
push dword [esi*4 + 0x530650]
mov ecx, edi
call fcn.00447dcd
test eax, eax
je 0x48b99f
inc esi
cmp esi, 0xe
jb 0x48b987
cmp esi, 0xe
jae 0x48ba20
lea eax, [ebp - 0x220]
push eax
push dword [esi*4 + 0x530610]
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
je 0x48b9dd
mov ecx, dword [esi*4 + 0x530610]
mov edx, edi
call fcn.0048ba28
test al, al
jne 0x48b78b
mov ecx, edi
call fcn.0048bb1b
jmp 0x48ba22
lea eax, [ebp - 0x21c]
push eax
push dword [ebp - 0x220]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
and dword [ebp - 0x228], 0
mov esi, eax
lea eax, [ebp - 0x228]
push eax
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
mov ecx, dword [ebp - 0x228]
push dword [ebp - 0x220]
push ecx
mov edx, dword [ecx]
call dword [edx + 0x14]
test esi, esi
jne 0x48b768
xor al, al
call fcn.004cc251
ret