Function at 0x49a580
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59c5cc
mov eax, dword fs:[0]
push eax
sub esp, 0x180
mov eax, dword [0x616738]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14c], 0
lea ecx, [ebp - 0x124]
call fcn.004a2910
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x120]
call fcn.004a2910
mov byte [ebp - 4], 1
lea eax, [ebp - 0x128]
push eax
call fcn.0048c450
add esp, 4
mov dword [ebp - 0x150], eax
mov ecx, dword [ebp - 0x150]
mov dword [ebp - 0x154], ecx
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x154]
mov eax, dword [edx]
push eax
push str._sSoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
lea ecx, [ebp - 0x120]
push ecx
call fcn.004098b0
add esp, 0xc
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x128]
call fcn.00408330
call fcn.0049a9d0
test eax, eax
je 0x49a6f7
push 0
push ecx
mov ecx, esp
mov dword [ebp - 0x12c], esp
push 0x5b48b6
call fcn.00408ff0
mov dword [ebp - 0x158], eax
mov edx, dword [ebp - 0x158]
mov dword [ebp - 0x15c], edx
mov byte [ebp - 4], 3
push ecx
mov ecx, esp
mov dword [ebp - 0x130], esp
push str.Local_AppData
call fcn.00408ff0
mov dword [ebp - 0x160], eax
mov eax, dword [ebp - 0x160]
mov dword [ebp - 0x164], eax
mov byte [ebp - 4], 4
push ecx
mov ecx, esp
mov dword [ebp - 0x134], esp
lea edx, [ebp - 0x120]
push edx
call fcn.00408fd0
mov dword [ebp - 0x168], eax
push reloc.WS2_32.dll_closesocket
lea eax, [ebp - 0x138]
push eax
mov byte [ebp - 4], 1
call fcn.00492c20
add esp, 0x18
mov dword [ebp - 0x16c], eax
mov ecx, dword [ebp - 0x16c]
mov dword [ebp - 0x170], ecx
mov byte [ebp - 4], 5
mov edx, dword [ebp - 0x170]
push edx
lea ecx, [ebp - 0x124]
call fcn.00409070
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x138]
call fcn.00408330
jmp 0x49a7b5
push 0
push ecx
mov ecx, esp
mov dword [ebp - 0x13c], esp
push 0x5b48b7
call fcn.00408ff0
mov dword [ebp - 0x174], eax
mov eax, dword [ebp - 0x174]
mov dword [ebp - 0x178], eax
mov byte [ebp - 4], 6
push ecx
mov ecx, esp
mov dword [ebp - 0x140], esp
push str.Local_Settings
call fcn.00408ff0
mov dword [ebp - 0x17c], eax
mov ecx, dword [ebp - 0x17c]
mov dword [ebp - 0x180], ecx
mov byte [ebp - 4], 7
push ecx
mov ecx, esp
mov dword [ebp - 0x144], esp
lea edx, [ebp - 0x120]
push edx
call fcn.00408fd0
mov dword [ebp - 0x184], eax
push reloc.WS2_32.dll_closesocket
lea eax, [ebp - 0x148]
push eax
mov byte [ebp - 4], 1
call fcn.00492c20
add esp, 0x18
mov dword [ebp - 0x188], eax
mov ecx, dword [ebp - 0x188]
mov dword [ebp - 0x18c], ecx
mov byte [ebp - 4], 8
mov edx, dword [ebp - 0x18c]
push edx
lea ecx, [ebp - 0x124]
call fcn.00409070
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x148]
call fcn.00408330
lea ecx, [ebp - 0x124]
call fcn.004920f0
test eax, eax
je 0x49a81b
push str.Temp
lea ecx, [ebp - 0x124]
call fcn.00427160
lea eax, [ebp - 0x124]
push eax
mov ecx, dword [ebp + 8]
call fcn.00408fd0
mov ecx, dword [ebp - 0x14c]
or ecx, 1
mov dword [ebp - 0x14c], ecx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x120]
call fcn.00408330
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x124]
call fcn.00408330
mov eax, dword [ebp + 8]
jmp 0x49a8a7
mov byte [ebp - 0x11c], 0
push 0x103
push 0
lea edx, [ebp - 0x11b]
push edx
call fcn.0056f420
add esp, 0xc
lea eax, [ebp - 0x11c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea ecx, [ebp - 0x11c]
push ecx
push 0x5b4f14
lea edx, [ebp - 0x124]
push edx
call fcn.004098b0
add esp, 0xc
lea eax, [ebp - 0x124]
push eax
mov ecx, dword [ebp + 8]
call fcn.00408fd0
mov ecx, dword [ebp - 0x14c]
or ecx, 1
mov dword [ebp - 0x14c], ecx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x120]
call fcn.00408330
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x124]
call fcn.00408330
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0056edd3
mov esp, ebp
pop ebp
ret