Function at 0x421500
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push ecx
mov esi, edx
mov ebx, ecx
push 4
push str.Path
mov ecx, esi
mov dword [ebp - 8], ebx
call fcn.00438387
test eax, eax
jne 0x42152b
mov eax, 0x80004005
jmp 0x42168e
mov edx, dword [eax + 4]
push edi
xor edi, edi
test edx, edx
je 0x42153a
mov eax, dword [eax + 0xc]
jmp 0x42153c
mov eax, edi
test edx, edx
jne 0x421545
mov edx, 0x491414
push eax
lea ecx, [ebp - 4]
call fcn.0044b14d
push 5
push str.Csidl
mov ecx, esi
call fcn.00438387
mov esi, dword [ebp - 4]
test eax, eax
jne 0x421574
mov ecx, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
call fcn.0043b599
jmp 0x421683
mov eax, dword [eax + 4]
test eax, eax
jne 0x421580
mov eax, 0x491414
push 0xa
push edi
push eax
call dword [sym.imp.msvcrt.dll_strtol]
mov ebx, dword [ebx + 0x14]
add esp, 0xc
mov edx, eax
mov dword [ebp - 4], edx
mov ecx, dword [ebx + 0x148]
cmp dword [ecx + 0x14], edi
je 0x421604
mov ebx, dword [ebp + 8]
mov ecx, ebx
push edi
push edx
push 0x104
call fcn.0043c822
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jne 0x4215f9
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
lea eax, [ebp + 8]
push edi
push dword [ebp - 4]
push str.SHGetSpecialFolderPath__d
push eax
call fcn.00449eea
add esp, 0x10
push dword [eax]
push str.WSUS
push 1
call dword [sym.imp.CBSHost.dll_DismWriteLog]
mov ecx, dword [ebp + 8]
lea ecx, [ecx - 0x10]
call fcn.0043c924
jmp 0x421683
push 0xffffffffffffffff
mov ecx, ebx
call fcn.0043c8bf
jmp 0x42167a
cmp edx, 0x29
jg 0x4216fc
je 0x4216dd
mov eax, edx
sub eax, 0x14
je 0x4216d3
sub eax, 0x10
je 0x421694
sub eax, 1
je 0x4216f2
sub eax, 1
jne 0x42170d
push str.Program_Files_
mov eax, dword [ebx + 0x14c]
add eax, 0x870
lea ecx, [ebp - 4]
push eax
call fcn.0043b487
mov edx, eax
lea ecx, [ebp - 8]
call fcn.0043ab55
mov ebx, dword [ebp + 8]
pop ecx
push eax
mov ecx, ebx
call fcn.0043b599
mov ecx, dword [ebp - 8]
lea ecx, [ecx - 0x10]
call fcn.0043c924
mov ecx, dword [ebp - 4]
lea ecx, [ecx - 0x10]
call fcn.0043c924
mov edx, esi
mov ecx, ebx
call fcn.0044b36a
lea ecx, [esi - 0x10]
call fcn.0043c924
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 4
mov eax, dword [ebx + 0x14c]
lea ecx, [ebp - 8]
push str.Windows_
add eax, 0x870
push eax
call fcn.0043b487
mov edx, eax
lea ecx, [ebp - 4]
call fcn.0043ab55
mov ebx, dword [ebp + 8]
pop ecx
push eax
mov ecx, ebx
call fcn.0043b599
mov ecx, dword [ebp - 4]
lea ecx, [ecx - 0x10]
call fcn.0043c924
mov ecx, dword [ebp - 8]
jmp 0x421672
push str.WindowsFonts_
jmp 0x42163a
mov eax, dword [ebx + 0x14c]
cmp dword [eax + 4], edi
je 0x4216f2
push str.WindowsSysWOW64_
jmp 0x421640
push str.WindowsSystem32_
jmp 0x42163a
mov eax, edx
sub eax, 0x2a
je 0x421768
sub eax, 1
je 0x42175e
sub eax, 1
je 0x421749
mov eax, dword [ebp - 8]
push dword [eax + 0x18]
lea eax, [ebp + 8]
push edx
push str.WuaGetFolderPath
push eax
call fcn.00449eea
add esp, 0x10
push dword [eax]
push str.WSUS
push 1
call dword [sym.imp.CBSHost.dll_DismWriteLog]
mov ecx, dword [ebp + 8]
lea ecx, [ecx - 0x10]
call fcn.0043c924
mov edi, 0x80004002
jmp 0x421683
mov eax, dword [ebx + 0x14c]
cmp dword [eax + 4], edi
je 0x42175e
push str.Program_Files__x86_Common_
jmp 0x421640
push str.Program_FilesCommon_
jmp 0x42163a
mov eax, dword [ebx + 0x14c]
cmp dword [eax + 4], edi
je 0x421635
push str.Program_Files__x86__
jmp 0x421640