Function at 0x481f8d
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c4
push edi
mov dword [ebp - 0x4c4], ecx
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x108], eax
mov ecx, dword [ebp - 0x108]
call fcn.00414d35
mov dword [ebp - 0x220], eax
mov dword [ebp - 0x10c], 0
mov byte [ebp - 0x218], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x217]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x104], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x103]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x104
lea ecx, [ebp - 0x218]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea edx, [ebp + eax - 0x218]
mov dword [ebp - 0x110], edx
push 0x104
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea ecx, [ebp + eax - 0x104]
mov dword [ebp - 0x114], ecx
mov dword [ebp - 0x21c], 0
jmp 0x48204c
mov edx, dword [ebp - 0x21c]
add edx, 1
mov dword [ebp - 0x21c], edx
cmp dword [ebp - 0x21c], 0x12
jae 0x48230b
mov byte [ebp - 0x324], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x323]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [ebp - 0x21c]
cmp dword [eax*8 + 0x535ad8], 1
jne 0x4820bb
mov ecx, dword [ebp - 0x21c]
mov edx, dword [ecx*8 + 0x535adc]
push edx
push 0x104
mov eax, dword [ebp - 0x110]
push eax
call fcn.00415330
lea ecx, [ebp - 0x218]
push ecx
push 0x104
lea edx, [ebp - 0x324]
push edx
call fcn.00415330
jmp 0x482102
mov eax, dword [ebp - 0x21c]
cmp dword [eax*8 + 0x535ad8], 2
jne 0x482102
mov ecx, dword [ebp - 0x21c]
mov edx, dword [ecx*8 + 0x535adc]
push edx
push 0x104
mov eax, dword [ebp - 0x114]
push eax
call fcn.00415330
lea ecx, [ebp - 0x104]
push ecx
push 0x104
lea edx, [ebp - 0x324]
push edx
call fcn.00415330
mov dword [ebp - 0x328], 0
lea eax, [ebp - 0x324]
push eax
call fcn.0042b4af
add esp, 4
test eax, eax
jne 0x48212e
mov dword [ebp - 0x328], 1
jmp 0x48229b
lea ecx, [ebp - 0x324]
push ecx
call fcn.00453370
mov ecx, eax
call fcn.00453794
test eax, eax
jne 0x48229b
mov dword [ebp - 0x32c], 0xffffffff
push 0
push 0
push 3
push 0
push 7
push 0x120089
lea edx, [ebp - 0x324]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x32c], eax
cmp dword [ebp - 0x32c], 0xffffffff
jne 0x4821c1
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x20
jne 0x4821bc
mov dword [ebp - 0x328], 1
mov eax, dword [ebp + 0xc]
push eax
push 0x44c
lea ecx, [ebp - 0x324]
push ecx
mov edx, dword [ebp - 0x4c4]
push edx
call dword [ebp + 8]
mov eax, dword [ebp - 0x10c]
add eax, 1
mov dword [ebp - 0x10c], eax
jmp 0x48226f
mov ecx, dword [ebp - 0x32c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edx, [ebp - 0x324]
push edx
call fcn.0042dc9d
add esp, 4
mov dword [ebp - 0x330], eax
cmp dword [ebp - 0x220], 2
je 0x482233
cmp dword [ebp - 0x330], 1
je 0x482231
cmp dword [ebp - 0x330], 2
je 0x482231
mov dword [ebp - 0x328], 1
mov eax, dword [ebp + 0xc]
push eax
push 0x44c
lea ecx, [ebp - 0x324]
push ecx
mov edx, dword [ebp - 0x4c4]
push edx
call dword [ebp + 8]
mov eax, dword [ebp - 0x10c]
add eax, 1
mov dword [ebp - 0x10c], eax
jmp 0x48226f
cmp dword [ebp - 0x330], 1
je 0x48226f
mov dword [ebp - 0x328], 1
mov ecx, dword [ebp + 0xc]
push ecx
push 0x44c
lea edx, [ebp - 0x324]
push edx
mov eax, dword [ebp - 0x4c4]
push eax
call dword [ebp + 8]
mov ecx, dword [ebp - 0x10c]
add ecx, 1
mov dword [ebp - 0x10c], ecx
cmp dword [ebp - 0x328], 0
je 0x48229b
cmp dword [ebp - 0x21c], 0
jne 0x48229b
push str.CFTMON.exe
call fcn.004395af
add esp, 4
push str.iexpe.exe
call fcn.004395af
add esp, 4
cmp dword [ebp - 0x328], 0
je 0x482306
mov dword [ebp - 0x34c], 0
mov dword [ebp - 0x354], 2
mov dword [ebp - 0x340], 0
mov dword [ebp - 0x338], 0
lea edx, [ebp - 0x324]
push edx
push 0x104
lea eax, [ebp - 0x4bc]
push eax
call fcn.00415330
mov dword [ebp - 0x4c0], 0
lea ecx, [ebp - 0x4c0]
push ecx
lea edx, [ebp - 0x4bc]
push edx
mov ecx, 0x555c48
call fcn.00416dd0
jmp 0x48203d
mov eax, dword [ebp - 0x10c]
pop edi
mov esp, ebp
pop ebp
ret 8