Function at 0x47eecc
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe88
mov eax, 0x4c3eac
push ebx
lea ebx, [ebp - 0x74]
push esi
call fcn.004aad94
mov dword [ebx + 0x1c], 1
lea edx, [ebp + 0xc]
lea eax, [ebp + 0xc]
call fcn.004b4e10
inc dword [ebx + 0x1c]
xor edx, edx
mov word [ebx + 0x10], 8
mov word [ebx + 0x10], 0x14
mov dword [ebp - 4], edx
lea edx, [ebp - 4]
inc dword [ebx + 0x1c]
lea eax, [ebp + 0xc]
call fcn.004b524c
mov word [ebx + 0x10], 8
mov word [ebx + 0x10], 0x20
mov edx, str._WINDIR_
lea eax, [ebp - 8]
call fcn.004b4dd8
inc dword [ebx + 0x1c]
lea edx, [ebp - 8]
lea eax, [ebp - 4]
call fcn.004b5490
mov esi, eax
dec dword [ebx + 0x1c]
lea eax, [ebp - 8]
mov edx, 2
call fcn.004b4f38
test esi, esi
jle 0x47f076
mov word [ebx + 0x10], 0x2c
xor ecx, ecx
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], ecx
push eax
inc dword [ebx + 0x1c]
lea eax, [ebp + 0xc]
lea ecx, [esi - 1]
mov edx, 1
call fcn.004b535c
lea ecx, [ebp - 0xc]
push ecx
xor eax, eax
mov dword [ebp - 0x10], eax
lea edx, [ebp - 0x10]
push edx
inc dword [ebx + 0x1c]
call fcn.004098a0
pop ecx
xor eax, eax
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x14]
inc dword [ebx + 0x1c]
lea edx, [ebp - 0x10]
pop eax
call fcn.004b4f90
lea edx, [ebp - 0x14]
add esi, 8
push edx
push esi
mov eax, dword [ebp + 0xc]
xor edx, edx
push eax
mov dword [ebp - 0x18], edx
lea ecx, [ebp - 0x18]
push ecx
inc dword [ebx + 0x1c]
call fcn.004099c0
xor eax, eax
add esp, 0xc
mov dword [ebp - 0x1c], eax
lea edx, [ebp - 0x18]
inc dword [ebx + 0x1c]
lea ecx, [ebp - 0x1c]
pop eax
call fcn.004b4f90
lea edx, [ebp - 0x1c]
mov eax, dword [ebp + 8]
call fcn.004b4f68
mov eax, dword [ebp + 8]
mov edx, 2
mov word [ebx + 0x10], 0x38
push eax
lea eax, [ebp - 0x1c]
dec dword [ebx + 0x1c]
call fcn.004b4f38
dec dword [ebx + 0x1c]
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.004b4f38
dec dword [ebx + 0x1c]
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.004b4f38
dec dword [ebx + 0x1c]
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.004b4f38
dec dword [ebx + 0x1c]
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.004b4f38
dec dword [ebx + 0x1c]
lea eax, [ebp - 4]
mov edx, 2
call fcn.004b4f38
dec dword [ebx + 0x1c]
lea eax, [ebp + 0xc]
mov edx, 2
call fcn.004b4f38
pop eax
mov word [ebx + 0x10], 0x2c
inc dword [ebx + 0x1c]
mov edx, dword [ebx]
mov dword fs:[0], edx
jmp 0x47f3b1
mov word [ebx + 0x10], 0x44
mov edx, str._SYSPART_
lea eax, [ebp - 0x20]
call fcn.004b4dd8
inc dword [ebx + 0x1c]
lea edx, [ebp - 0x20]
lea eax, [ebp - 4]
call fcn.004b5490
mov esi, eax
dec dword [ebx + 0x1c]
lea eax, [ebp - 0x20]
mov edx, 2
call fcn.004b4f38
test esi, esi
jle 0x47f1fc
mov word [ebx + 0x10], 0x50
xor ecx, ecx
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], ecx
push eax
inc dword [ebx + 0x1c]
xor edx, edx
mov dword [ebp - 0x28], edx
lea ecx, [ebp - 0x28]
push ecx
inc dword [ebx + 0x1c]
call fcn.004098a0
pop ecx
lea eax, [ebp - 0x28]
mov ecx, 2
mov edx, 1
call fcn.004b535c
lea eax, [ebp - 0x2c]
xor edx, edx
push eax
mov dword [ebp - 0x24], edx
lea ecx, [ebp - 0x24]
mov edx, 1
push ecx
lea ecx, [esi - 1]
inc dword [ebx + 0x1c]
lea eax, [ebp + 0xc]
call fcn.004b535c
lea eax, [ebp - 0x24]
xor edx, edx
mov dword [ebp - 0x30], edx
lea ecx, [ebp - 0x30]
inc dword [ebx + 0x1c]
pop edx
call fcn.004b4f90
lea eax, [ebp - 0x30]
add esi, 9
push eax
push esi
mov eax, dword [ebp + 0xc]
xor edx, edx
push eax
mov dword [ebp - 0x34], edx
lea ecx, [ebp - 0x34]
push ecx
inc dword [ebx + 0x1c]
call fcn.004099c0
xor eax, eax
add esp, 0xc
mov dword [ebp - 0x38], eax
lea edx, [ebp - 0x34]
inc dword [ebx + 0x1c]
lea ecx, [ebp - 0x38]
pop eax
call fcn.004b4f90
lea edx, [ebp - 0x38]
mov eax, dword [ebp + 8]
call fcn.004b4f68
mov eax, dword [ebp + 8]
mov edx, 2
mov word [ebx + 0x10], 0x5c
push eax
lea eax, [ebp - 0x38]
dec dword [ebx + 0x1c]
call fcn.004b4f38
dec dword [ebx + 0x1c]
lea eax, [ebp - 0x34]
mov edx, 2
call fcn.004b4f38
dec dword [ebx + 0x1c]
lea eax, [ebp - 0x30]
mov edx, 2
call fcn.004b4f38
dec dword [ebx + 0x1c]
lea eax, [ebp - 0x2c]
mov edx, 2
call fcn.004b4f38
dec dword [ebx + 0x1c]
lea eax, [ebp - 0x28]
mov edx, 2
call fcn.004b4f38
dec dword [ebx + 0x1c]
lea eax, [ebp - 0x24]
mov edx, 2
call fcn.004b4f38
dec dword [ebx + 0x1c]
lea eax, [ebp - 4]
mov edx, 2
call fcn.004b4f38
dec dword [ebx + 0x1c]
lea eax, [ebp + 0xc]
mov edx, 2
call fcn.004b4f38
pop eax
mov word [ebx + 0x10], 0x50
inc dword [ebx + 0x1c]
mov edx, dword [ebx]
mov dword fs:[0], edx
jmp 0x47f3b1
mov word [ebx + 0x10], 0x68
mov edx, str._PROGRAMFILES_
lea eax, [ebp - 0x3c]
call fcn.004b4dd8
inc dword [ebx + 0x1c]
lea edx, [ebp - 0x3c]
lea eax, [ebp - 4]
call fcn.004b5490
mov esi, eax
dec dword [ebx + 0x1c]
lea eax, [ebp - 0x3c]
mov edx, 2
call fcn.004b4f38
test esi, esi
jle 0x47f363
lea ecx, [ebp - 0x178]
push ecx
push 0
push 0
push 0x26
push 0
call sub.SHFOLDER.DLL_SHGetFolderPathA
mov word [ebx + 0x10], 0x74
xor eax, eax
lea edx, [ebp - 0x40]
mov dword [ebp - 0x40], eax
push edx
inc dword [ebx + 0x1c]
mov edx, 1
lea eax, [ebp + 0xc]
lea ecx, [esi - 1]
call fcn.004b535c
lea ecx, [ebp - 0x40]
push ecx
lea edx, [ebp - 0x178]
lea eax, [ebp - 0x44]
call fcn.004b4dd8
mov edx, eax
inc dword [ebx + 0x1c]
xor eax, eax
mov dword [ebp - 0x48], eax
lea ecx, [ebp - 0x48]
inc dword [ebx + 0x1c]
pop eax
call fcn.004b4f90
lea edx, [ebp - 0x48]
add esi, 0xe
push edx
push esi
mov eax, dword [ebp + 0xc]
xor edx, edx
push eax
mov dword [ebp - 0x4c], edx
lea ecx, [ebp - 0x4c]
push ecx
inc dword [ebx + 0x1c]
call fcn.004099c0
xor eax, eax
add esp, 0xc
mov dword [ebp - 0x50], eax
lea edx, [ebp - 0x4c]
inc dword [ebx + 0x1c]
lea ecx, [ebp - 0x50]
pop eax
call fcn.004b4f90
lea edx, [ebp - 0x50]
mov eax, dword [ebp + 8]
call fcn.004b4f68
mov eax, dword [ebp + 8]
mov edx, 2
mov word [ebx + 0x10], 0x80
push eax
lea eax, [ebp - 0x50]
dec dword [ebx + 0x1c]
call fcn.004b4f38
dec dword [ebx + 0x1c]
lea eax, [ebp - 0x4c]
mov edx, 2
call fcn.004b4f38
dec dword [ebx + 0x1c]
lea eax, [ebp - 0x48]
mov edx, 2
call fcn.004b4f38
dec dword [ebx + 0x1c]
lea eax, [ebp - 0x44]
mov edx, 2
call fcn.004b4f38
dec dword [ebx + 0x1c]
lea eax, [ebp - 0x40]
mov edx, 2
call fcn.004b4f38
dec dword [ebx + 0x1c]
lea eax, [ebp - 4]
mov edx, 2
call fcn.004b4f38
dec dword [ebx + 0x1c]
lea eax, [ebp + 0xc]
mov edx, 2
call fcn.004b4f38
pop eax
mov word [ebx + 0x10], 0x74
inc dword [ebx + 0x1c]
mov edx, dword [ebx]
mov dword fs:[0], edx
jmp 0x47f3b1
mov word [ebx + 0x10], 0x8c
lea edx, [ebp + 0xc]
mov eax, dword [ebp + 8]
call fcn.004b4f68
mov eax, dword [ebp + 8]
mov edx, 2
mov word [ebx + 0x10], 0x98
push eax
lea eax, [ebp - 4]
dec dword [ebx + 0x1c]
call fcn.004b4f38
dec dword [ebx + 0x1c]
lea eax, [ebp + 0xc]
mov edx, 2
call fcn.004b4f38
pop eax
mov word [ebx + 0x10], 0x8c
inc dword [ebx + 0x1c]
mov edx, dword [ebx]
mov dword fs:[0], edx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret