Function at 0x4821e5
Capabilities:
Get common file path

Disassembly:
mov eax, 0x598cb5
call fcn.00595190
sub esp, 0x210
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi]
mov eax, dword [eax - 0xc]
test eax, eax
je 0x4822c0
and word [ebp - 0x21c], 0
push ebx
push edi
push 0x208
lea eax, [ebp - 0x21a]
push 0
push eax
call fcn.0049bec0
add esp, 0xc
mov ebx, str._ALLUSERSPROFILE_
push ebx
xor ecx, ecx
call fcn.00401336
or edi, 0xffffffff
cmp eax, edi
jne 0x48225c
mov ebx, str._APPDATA_
push ebx
xor ecx, ecx
call fcn.00401336
cmp eax, edi
jne 0x48225c
mov ebx, str._TEMP_
push ebx
xor ecx, ecx
call fcn.00401336
cmp eax, edi
je 0x48226c
lea eax, [ebp - 0x21c]
push eax
push ebx
call fcn.0048283c
pop ecx
jmp 0x4822ea
mov ebx, str._SYSTEM_
push ebx
xor ecx, ecx
call fcn.00401336
cmp eax, edi
je 0x482291
push 0x104
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
jmp 0x4822b4
mov ebx, str._WINDOWS_
push ebx
xor ecx, ecx
call fcn.00401336
cmp eax, edi
je 0x4822cd
push 0x104
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
ja 0x482364
xor eax, eax
pop edi
pop ebx
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret
mov ebx, str._CUR_MODULE_
push ebx
xor ecx, ecx
call fcn.00401336
cmp eax, edi
je 0x4822f1
lea eax, [ebp - 0x21c]
push eax
call fcn.00482795
test eax, eax
pop ecx
je 0x4822bc
jmp 0x482364
mov ebx, str._CUR_EXE_MODULE_
push ebx
xor ecx, ecx
call fcn.00401336
cmp eax, edi
je 0x48231c
push 0x104
lea eax, [ebp - 0x21c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x4822bc
jmp 0x482357
mov ebx, str._CUR_DIR_
push ebx
xor ecx, ecx
call fcn.00401336
cmp eax, edi
je 0x482374
push 0x20a
lea eax, [ebp - 0x21c]
push 0
push eax
call fcn.0049bec0
add esp, 0xc
push 0x105
lea eax, [ebp - 0x21c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp - 0x21c]
push eax
push ebx
push esi
call fcn.0047d8ce
jmp 0x4823e4
mov ebx, str._DUBA_
push ebx
xor ecx, ecx
call fcn.00401336
cmp eax, edi
je 0x4822bc
call fcn.0044f088
test eax, eax
je 0x4822bc
lea eax, [ebp + 8]
push eax
call fcn.0044f11d
pop ecx
and dword [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.0047ff29
push dword [ebp + 8]
push ebx
push esi
call fcn.0047d8ce
lea eax, [ebp + 8]
push eax
push esi
call fcn.00482482
test eax, eax
pop ecx
pop ecx
jne 0x4823d6
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
call fcn.004011c0
jmp 0x4822bc
mov dword [ebp - 4], edi
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
call fcn.004011c0
push 0x3f
xor ecx, ecx
call fcn.004326fa
mov ebx, eax
cmp ebx, edi
je 0x482468
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.004a0404
pop ecx
jmp 0x482459
and word [ebp - 0x10], 0
xor eax, eax
lea edi, [ebp - 0xe]
stosw word es:[edi], ax
call fcn.004a0411
and eax, 0x8000000f
jns 0x48241f
dec eax
or eax, 0xfffffff0
inc eax
push eax
lea eax, [ebp - 0x10]
push 0x5f0ca4
push eax
call fcn.00483e10
movzx edi, word [ebp - 0x10]
add esp, 0xc
test ebx, ebx
jl 0x482477
mov eax, dword [esi]
mov eax, dword [eax - 0xc]
cmp ebx, eax
mov dword [ebp + 8], eax
jge 0x482477
call fcn.0044f49e
mov word [eax + ebx*2], di
mov eax, dword [ebp + 8]
mov edx, esi
call fcn.004011d8
inc ebx
mov ecx, ebx
mov eax, esi
call fcn.00483e8b
cmp ax, 0x3f
je 0x482402
mov eax, esi
call fcn.00481311
xor eax, eax
inc eax
jmp 0x4822be
push 0x80070057
call fcn.0040131e
int3