Function at 0x415410
Capabilities:
Get common file path

Disassembly:
mov eax, 0x39a8
call fcn.00438a20
sub rsp, rax
mov qword [rsp + 0x140], 0xfffffffffffffffe
mov qword [rsp + 0x39b8], rbx
mov qword [rsp + 0x39c0], rbp
mov qword [rsp + 0x39c8], rsi
mov qword [rsp + 0x39a0], rdi
mov qword [rsp + 0x3998], r12
mov qword [rsp + 0x3990], r13
mov qword [rsp + 0x3988], r14
mov qword [rsp + 0x3980], r15
mov rax, qword [0x0044e3d8]
xor rax, rsp
mov qword [rsp + 0x3978], rax
xor r12d, r12d
mov dword [rsp + 0x30], r12d
mov r8d, 0x400
lea rdx, [rsp + 0x1170]
mov rcx, qword [rcx + 0xa0]
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rdx, [rsp + 0x1170]
lea rcx, str.installShell_GetModuleFileName:__s__n
call fcn.0040e790
lea rcx, [rsp + 0x2170]
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x3170]
lea r8, [rsp + 0x2970]
lea rdx, [rsp + 0x1970]
lea rcx, [rsp + 0x1170]
call fcn.0041d6a0
lea rdx, [0x00400000]
lea rax, [rdx + 0x52ca8]
mov qword [rsp + 0x40], rax
lea rax, [rdx + 0x52cb0]
mov qword [rsp + 0x50], rax
lea rax, [0x00442490]
mov qword [rsp + 0xd8], rax
mov dword [rsp + 0x30], 1
movsxd rax, dword [0x00452cac]
lea rcx, [0x00442520]
mov qword [rsp + rax + 0x40], rcx
mov qword [rsp + 0x48], r12
mov rax, qword [rsp + 0x40]
movsxd rcx, dword [rax + 4]
lea rcx, [rsp + rcx + 0x40]
xor r8d, r8d
lea rdx, [rsp + 0x58]
call fcn.0040b170
nop
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x50]
movsxd rcx, dword [rax + 4]
lea r15, [0x00442530]
mov qword [rsp + rcx + 0x50], r15
mov rax, qword [rsp + 0x50]
movsxd rcx, dword [rax + 4]
lea rcx, [rsp + rcx + 0x50]
xor r8d, r8d
lea rdx, [rsp + 0x58]
call fcn.0040b170
mov rax, qword [rsp + 0x40]
movsxd rcx, dword [rax + 4]
lea r14, [0x00442540]
mov qword [rsp + rcx + 0x40], r14
mov rax, qword [rsp + 0x40]
movsxd rcx, dword [rax + 4]
lea r13, [0x004425d0]
mov qword [rsp + rcx + 0x40], r13
lea rcx, [rsp + 0x58]
call fcn.00408340
nop
lea rax, [0x00442558]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0xc8], r12
mov dword [rsp + 0xd0], r12d
lea rdx, [rsp + 0x1970]
lea rcx, [rsp + 0x50]
call fcn.0040bae0
mov rcx, rax
lea rdx, [rsp + 0x2970]
call fcn.0040bae0
lea rdx, [rsp + 0x148]
lea rcx, [rsp + 0x40]
call fcn.00405b60
nop
lea r9, [r12 - 1]
xor r8d, r8d
mov rdx, rax
lea rcx, [0x00452b38]
call fcn.00406ad0
nop
cmp qword [rsp + 0x168], 8
jb 0x41563e
mov rcx, qword [rsp + 0x150]
call fcn.0041bee0
lea rdx, [0x00452b40]
cmp qword [0x00452b58], 8
cmovae rdx, qword [0x00452b40]
lea rcx, str.installShell_g_SrcDir:__s__n
call fcn.0040e790
mov edx, 0x400
lea rcx, [rsp + 0x170]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
xor eax, eax
mov rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x170]
repne scasw ax, word [rdi]
not rcx
lea rbx, [rcx - 1]
lea rsi, [0x00452b68]
mov rax, rsi
mov rdi, qword [0x00452b68]
mov rdx, qword [0x00452b80]
cmp rdx, 8
cmovae rax, rdi
lea rcx, [rsp + 0x170]
movabs rbp, 0x7ffffffffffffffe
mov r8, qword [0x00452b78]
cmp rcx, rax
jb 0x41572b
mov rax, rsi
cmp rdx, 8
cmovae rax, rdi
lea rax, [rax + r8*2]
lea rcx, [rsp + 0x170]
cmp rax, rcx
jbe 0x41572b
mov rax, rsi
cmp rdx, 8
cmovae rax, rdi
lea r8, [rsp + 0x170]
sub r8, rax
sar r8, 1
mov r9, rbx
lea rdx, [0x00452b60]
lea rcx, [0x00452b60]
call fcn.00406ad0
mov rdx, qword [0x00452b80]
mov rdi, qword [0x00452b68]
jmp 0x4157ed
cmp rbx, rbp
jbe 0x41574a
call fcn.0041ad00
mov rdx, qword [0x00452b80]
mov r8, qword [0x00452b78]
mov rdi, qword [0x00452b68]
cmp rdx, rbx
jae 0x41576e
mov rdx, rbx
lea rcx, [0x00452b60]
call fcn.0040b310
mov rdx, qword [0x00452b80]
mov rdi, qword [0x00452b68]
jmp 0x415798
test rbx, rbx
jne 0x415798
mov qword [0x00452b78], r12
mov rax, rsi
cmp rdx, 8
cmovae rax, rdi
mov word [rax], bx
mov rdx, qword [0x00452b80]
mov rdi, qword [0x00452b68]
jmp 0x4157ed
test rbx, rbx
je 0x4157ed
mov rcx, rsi
cmp rdx, 8
cmovae rcx, rdi
lea rdi, [rbx + rbx]
add rdx, rdx
mov r9, rdi
lea r8, [rsp + 0x170]
call fcn.0041bef0
mov qword [0x00452b78], rbx
mov rax, rsi
cmp qword [0x00452b80], 8
cmovae rax, qword [0x00452b68]
mov word [rdi + rax], 0
mov rdx, qword [0x00452b80]
mov rdi, qword [0x00452b68]
cmp rdx, 8
cmovae rsi, rdi
mov rdx, rsi
lea rcx, str.installShell_g_WinDir:__s__n
call fcn.0040e790
mov edx, 0x400
lea rcx, [rsp + 0x970]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xor eax, eax
mov rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x970]
repne scasw ax, word [rdi]
not rcx
lea rbx, [rcx - 1]
lea rsi, [0x00452b90]
mov rax, rsi
mov rdi, qword [0x00452b90]
mov rdx, qword [0x00452ba8]
cmp rdx, 8
cmovae rax, rdi
lea rcx, [rsp + 0x970]
mov r8, qword [0x00452ba0]
cmp rcx, rax
jb 0x4158c4
mov rax, rsi
cmp rdx, 8
cmovae rax, rdi
lea rax, [rax + r8*2]
lea rcx, [rsp + 0x970]
cmp rax, rcx
jbe 0x4158c4
mov rax, rsi
cmp rdx, 8
cmovae rax, rdi
lea r8, [rsp + 0x970]
sub r8, rax
sar r8, 1
mov r9, rbx
lea rdx, [0x00452b88]
lea rcx, [0x00452b88]
call fcn.00406ad0
mov rdx, qword [0x00452ba8]
mov rdi, qword [0x00452b90]
jmp 0x415986
cmp rbx, rbp
jbe 0x4158e3
call fcn.0041ad00
mov rdx, qword [0x00452ba8]
mov r8, qword [0x00452ba0]
mov rdi, qword [0x00452b90]
cmp rdx, rbx
jae 0x415907
mov rdx, rbx
lea rcx, [0x00452b88]
call fcn.0040b310
mov rdx, qword [0x00452ba8]
mov rdi, qword [0x00452b90]
jmp 0x415931
test rbx, rbx
jne 0x415931
mov qword [0x00452ba0], r12
mov rax, rsi
cmp rdx, 8
cmovae rax, rdi
mov word [rax], bx
mov rdx, qword [0x00452ba8]
mov rdi, qword [0x00452b90]
jmp 0x415986
test rbx, rbx
je 0x415986
mov rcx, rsi
cmp rdx, 8
cmovae rcx, rdi
lea rdi, [rbx + rbx]
add rdx, rdx
mov r9, rdi
lea r8, [rsp + 0x970]
call fcn.0041bef0
mov qword [0x00452ba0], rbx
mov rax, rsi
cmp qword [0x00452ba8], 8
cmovae rax, qword [0x00452b90]
mov word [rdi + rax], 0
mov rdx, qword [0x00452ba8]
mov rdi, qword [0x00452b90]
cmp rdx, 8
cmovae rsi, rdi
mov rdx, rsi
lea rcx, str.installShell_g_SystemDir:__s__n
call fcn.0040e790
nop
lea rax, [rsp + 0xd8]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x40]
movsxd rcx, dword [rax + 4]
mov qword [rsp + rcx + 0x40], r13
lea rcx, [rsp + 0x58]
call fcn.00405be0
nop
mov rax, qword [rsp + 0x40]
movsxd rcx, dword [rax + 4]
mov qword [rsp + rcx + 0x40], r14
mov rax, qword [rsp + 0x50]
movsxd rcx, dword [rax + 4]
mov qword [rsp + rcx + 0x50], r15
mov rax, qword [rsp + 0x40]
movsxd rcx, dword [rax + 4]
lea rax, [0x00442520]
mov qword [rsp + rcx + 0x40], rax
lea rax, [0x00442480]
mov qword [rsp + 0xd8], rax
lea rcx, [rsp + 0xd8]
call fcn.0041a340
mov rcx, qword [rsp + 0x3978]
xor rcx, rsp
call fcn.0041b870
mov rbx, qword [rsp + 0x39b8]
mov rbp, qword [rsp + 0x39c0]
mov rsi, qword [rsp + 0x39c8]
mov rdi, qword [rsp + 0x39a0]
mov r12, qword [rsp + 0x3998]
mov r13, qword [rsp + 0x3990]
mov r14, qword [rsp + 0x3988]
mov r15, qword [rsp + 0x3980]
add rsp, 0x39a8
ret