Function at 0x4107fd
Capabilities:
Get common file path

Disassembly:
push 0x21c
mov eax, 0x433797
call fcn.0041e986
mov byte [ebp - 0x219], dl
mov edi, ecx
push str.ProgramFiles64Folder
call fcn.00403621
xor esi, esi
test eax, eax
jne 0x41088a
mov ecx, dword [edi]
sub ecx, 0x10
call fcn.00404554
add eax, 0x10
mov dword [ebp - 0x220], eax
push str.ProgramW6432
lea ecx, [ebp - 0x220]
mov dword [ebp - 4], esi
call fcn.004075e5
test eax, eax
je 0x410878
lea eax, [ebp - 0x220]
mov ecx, edi
push eax
call fcn.00403643
mov ecx, edi
call fcn.004067be
mov ecx, dword [ebp - 0x220]
lea ecx, [ecx - 0x10]
call fcn.004045ed
mov al, 1
jmp 0x410b81
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x220]
lea ecx, [ecx - 0x10]
call fcn.004045ed
push str.SystemFolder
lea ecx, [ebp - 0x224]
call fcn.00404200
mov dword [ebp - 4], 1
mov ecx, edi
push dword [eax]
call fcn.00403621
mov ebx, eax
neg ebx
sbb bl, bl
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x224]
add ecx, 0xfffffff0
call fcn.004045ed
add bl, 1
je 0x410905
cmp byte [ebp - 0x219], 0
lea eax, [ebp - 0x218]
push eax
push esi
push esi
push 0x29
pop eax
push 0x25
pop ecx
cmovne eax, ecx
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea eax, [ebp - 0x218]
mov ecx, edi
push eax
call fcn.004041d8
mov ecx, edi
call fcn.004067be
xor eax, eax
inc eax
jmp 0x410b81
push str.System32Folder
lea ecx, [ebp - 0x224]
call fcn.00404200
mov dword [ebp - 4], 2
mov ecx, edi
push dword [eax]
call fcn.00403621
mov ebx, eax
neg ebx
sbb bl, bl
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x224]
add ecx, 0xfffffff0
call fcn.004045ed
add bl, 1
je 0x41095b
push 0x104
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
jmp 0x4109aa
call fcn.0041e5ae
push str.WindowsFolder
lea ecx, [ebp - 0x224]
call fcn.00404200
mov dword [ebp - 4], 3
mov ecx, edi
push dword [eax]
call fcn.00403621
mov ebx, eax
neg ebx
sbb bl, bl
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x224]
add ecx, 0xfffffff0
call fcn.004045ed
add bl, 1
je 0x4109be
push 0x104
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push 0x5c
pop ecx
mov word [ebp + eax*2 - 0x218], cx
lea eax, [eax*2 + 2]
jmp 0x410a3c
push str.WindowsVolume
lea ecx, [ebp - 0x224]
call fcn.00404200
mov dword [ebp - 4], 4
mov ecx, edi
push dword [eax]
call fcn.00403621
mov ebx, eax
neg ebx
sbb bl, bl
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x224]
add ecx, 0xfffffff0
call fcn.004045ed
add bl, 1
je 0x410a18
push 0x104
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
xor eax, eax
mov word [ebp - 0x212], ax
jmp 0x410a51
push str.TempFolder
mov ecx, edi
call fcn.00403621
test eax, eax
jne 0x410a64
lea eax, [ebp - 0x218]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
add eax, eax
cmp eax, 0x208
jae 0x410956
xor ecx, ecx
mov word [ebp + eax - 0x218], cx
lea eax, [ebp - 0x218]
mov ecx, edi
push eax
call fcn.004041d8
jmp 0x4108fd
push str.SETUPEXEDIR
mov ecx, edi
call fcn.00403621
test eax, eax
jne 0x410ae4
mov eax, dword [0x44be10]
mov ebx, 0x44be10
cmp dword [eax - 0xc], esi
jne 0x410ad7
push 0x104
lea eax, [ebp - 0x218]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
sub eax, 1
je 0x410aad
push 0x5c
pop ecx
cmp word [ebp + eax*2 - 0x218], cx
je 0x410aad
sub eax, 1
jne 0x410a9e
lea eax, [eax*2 + 2]
cmp eax, 0x208
jae 0x410956
xor ecx, ecx
mov word [ebp + eax - 0x218], cx
lea eax, [ebp - 0x218]
push eax
mov ecx, ebx
call fcn.004041d8
push ebx
mov ecx, edi
call fcn.00403643
jmp 0x4108fd
xor esi, esi
push dword [esi*4 + 0x442a6c]
mov ecx, edi
call fcn.00403621
test eax, eax
je 0x410afe
inc esi
cmp esi, 0xe
jb 0x410ae6
cmp esi, 0xe
jae 0x410b7f
lea eax, [ebp - 0x228]
push eax
push dword [esi*4 + 0x442a34]
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
je 0x410b3c
mov ecx, dword [esi*4 + 0x442a34]
mov edx, edi
call fcn.00410b87
test al, al
jne 0x4108fd
mov ecx, edi
call fcn.00410c88
jmp 0x410b81
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x228]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
and dword [ebp - 0x220], 0
mov esi, eax
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
mov ecx, dword [ebp - 0x220]
push dword [ebp - 0x228]
push ecx
mov edx, dword [ecx]
call dword [edx + 0x14]
test esi, esi
jne 0x4108e8
xor al, al
call fcn.0041e941
ret