Function at 0x48952c
Capabilities:
Get common file path
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4f4ad9
mov eax, dword fs:[0]
push eax
sub esp, 0x198
mov eax, dword [0x5466b0]
xor eax, esp
mov dword [esp + 0x190], eax
push ebx
push esi
push edi
mov eax, dword [0x5466b0]
xor eax, esp
push eax
lea eax, [esp + 0x1a8]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
xor ebx, ebx
mov dword [esp + 0x18], eax
mov eax, dword [ebp + 8]
inc ebx
xor esi, esi
mov dword [esp + 0x14], esi
mov dword [esp + 0x28], ebx
cmp eax, ebx
jne 0x4895e5
push 0x64
lea eax, [esp + 0x30]
push esi
push eax
call fcn.004d7710
add esp, 0xc
lea eax, [esp + 0x2c]
push eax
lea ebx, [esp + 0x18]
mov dword [esp + 0x18], esi
call fcn.00489298
test eax, eax
je 0x489988
push 0x54cfe0
push 0x10
call fcn.004cba2a
pop ecx
mov edi, eax
pop ecx
mov dword [esp + 0x1c], edi
mov dword [esp + 0x1b0], esi
cmp edi, esi
je 0x4895df
lea ebx, [esp + 0x2c]
mov eax, edi
mov dword [edi], esi
call fcn.0040c040
mov esi, edi
push esi
jmp 0x489971
push 2
pop edi
cmp eax, edi
jne 0x489668
push str.IsWow64Process
push str.kernel32
mov dword [esp + 0x1c], esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x54e74c], eax
cmp eax, esi
je 0x489622
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [0x54e74c]
push 0x54cfe0
push 0x10
call fcn.004cba2a
pop ecx
mov dword [esp + 0x20], eax
pop ecx
cmp dword [esp + 0x14], esi
je 0x489651
mov dword [esp + 0x1b0], ebx
cmp eax, esi
je 0x48996e
push esi
push 0x40
jmp 0x4897ab
mov dword [esp + 0x1b0], edi
cmp eax, esi
je 0x48996e
push esi
push 0x20
jmp 0x4897ab
push 3
pop edi
cmp eax, edi
jne 0x4896ec
push str.IsWow64Process2
push str.kernelbase.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x54ec0c], eax
cmp eax, esi
je 0x4896c0
call fcn.00489ab7
cmp eax, esi
je 0x4896c0
push 0x54cfe0
push 0x10
call fcn.004cba2a
pop ecx
pop ecx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x1b0], edi
cmp eax, esi
je 0x48996e
push esi
push ebx
jmp 0x4897ab
push 0x54cfe0
push 0x10
call fcn.004cba2a
pop ecx
pop ecx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x1b0], 4
cmp eax, esi
je 0x48996e
push esi
push esi
jmp 0x4897ab
cmp eax, 4
jne 0x48973f
push 0x64
lea eax, [esp + 0x30]
push esi
push eax
call fcn.004d7710
add esp, 0xc
lea eax, [esp + 0x2c]
push eax
lea ebx, [esp + 0x18]
mov dword [esp + 0x18], esi
call fcn.00489298
push 0x54cfe0
push 0x10
call fcn.004cba2a
pop ecx
pop ecx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x1b0], 5
cmp eax, esi
je 0x48996e
push esi
push dword [esp + 0x18]
jmp 0x4897ab
cmp eax, 5
jne 0x489771
push 0x54cfe0
push 0x10
call fcn.004cba2a
pop ecx
pop ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x1b0], 6
cmp eax, esi
je 0x48996e
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
jmp 0x4897a1
cmp eax, 6
jne 0x4897b5
push 0x54cfe0
push 0x10
call fcn.004cba2a
pop ecx
pop ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x1b0], 7
cmp eax, esi
je 0x48996e
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
movzx eax, ax
cdq
push edx
push eax
mov eax, dword [esp + 0x1c]
call fcn.00431050
jmp 0x489970
cmp eax, 7
jne 0x489840
push 0x54cfe0
push 0x10
call fcn.004cba2a
pop ecx
pop ecx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x1b0], 8
cmp eax, esi
je 0x489811
push esi
mov dword [esp + 0x28], esi
call dword [sym.imp.USER32.dll_GetDC]
mov dword [esp + 0x20], eax
push 0x58
mov byte [esp + 0x1b4], 9
push eax
mov dword [esp + 0x1c], ebx
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
cdq
push edx
push eax
mov eax, dword [esp + 0x24]
call fcn.00431050
jmp 0x489813
xor eax, eax
mov ecx, dword [esp + 0x18]
push eax
mov dword [esp + 0x1b4], 0xa
call fcn.0040ed50
test byte [esp + 0x14], bl
je 0x489988
lea esi, [esp + 0x20]
call fcn.0040b0c0
jmp 0x489988
push 8
pop ecx
cmp eax, ecx
jne 0x4898a3
push 0x105
lea eax, [esp + 0x98]
push esi
push eax
call fcn.004d7710
add esp, 0xc
push 0x104
lea eax, [esp + 0x98]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0x54cfe0
push 0x10
call fcn.004cba2a
pop ecx
mov edi, eax
pop ecx
mov dword [esp + 0x1c], edi
mov dword [esp + 0x1b0], 0xb
cmp edi, esi
je 0x4895df
lea ebx, [esp + 0x94]
jmp 0x4895d4
cmp eax, 9
jne 0x4898f2
push 0x105
lea eax, [esp + 0x98]
push esi
push eax
call fcn.004d7710
add esp, 0xc
push 0x104
lea eax, [esp + 0x98]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x54cfe0
push 0x10
call fcn.004cba2a
pop ecx
mov edi, eax
pop ecx
mov dword [esp + 0x1c], edi
mov dword [esp + 0x1b0], 0xc
jmp 0x48988f
cmp eax, 0xa
jne 0x489937
xor eax, eax
lea edi, [esp + 0x20]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [esp + 0x20]
push eax
mov dword [esp + 0x24], ecx
call dword [sym.imp.USER32.dll_GetLastInputInfo]
push 0x54cfe0
push 0x10
call fcn.004cba2a
pop ecx
pop ecx
mov ecx, eax
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x1b0], 0xd
cmp ecx, esi
je 0x48996e
mov eax, dword [esp + 0x24]
jmp 0x489967
cmp eax, 0xb
jne 0x489984
push 0x54cfe0
push 0x10
call fcn.004cba2a
pop ecx
pop ecx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x1b0], 0xe
cmp eax, esi
je 0x48996e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esp + 0x1c]
call fcn.0041a730
jmp 0x489970
xor eax, eax
push eax
mov ecx, dword [esp + 0x1c]
or dword [esp + 0x1b4], 0xffffffff
call fcn.0040ed50
jmp 0x489988
mov dword [esp + 0x28], esi
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x1a8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x190]
xor ecx, esp
call fcn.004cb38b
mov esp, ebp
pop ebp
ret 8