Function at 0x40649e
Capabilities:
Get common file path
Get program files directory

Disassembly:
mov eax, 0x41e6cd
call fcn.0040c864
sub esp, 0x120
mov eax, dword [0x42005c]
push ebx
push esi
mov dword [ebp - 0x10], eax
movzx eax, byte [ebp + 0xc]
push edi
push 0xa
mov ebx, ecx
pop ecx
cdq
idiv ecx
mov eax, dword [ebp + 8]
mov dword [ebx + 0x14], eax
xor esi, esi
lea eax, [ebp - 0x114]
push eax
push esi
push esi
push 2
mov dword [ebx + 0x32c], esi
push esi
mov byte [ebp - 0x11c], 0x2a
mov byte [ebp - 0x11a], 0
mov dword [0x420ae0], esi
add dl, 0x30
mov byte [ebp - 0x11b], dl
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
lea eax, [ebp - 0x114]
push eax
call fcn.00403f61
mov ecx, dword [ebx + 0x1c]
push 0x12
call fcn.00403f93
mov dword [ebp - 0x118], eax
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x406521
sub eax, edi
mov dword [ebp + 0xc], eax
je 0x406572
mov eax, dword [ebp - 0x118]
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x406537
lea edi, [ebp - 0x114]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x406547
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [ebp - 0x114]
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebx + 0x18]
push eax
call fcn.00407101
xor esi, esi
jmp 0x406581
mov ecx, dword [ebx + 0x18]
lea eax, [ebp - 0x114]
push eax
call fcn.0040717e
push dword [ebp - 0x118]
call fcn.0040c06d
pop ecx
mov ecx, dword [ebp + 8]
call fcn.00406bd3
test eax, eax
je 0x4065b3
mov ecx, dword [0x420b04]
push 0x3f1
push 0x2c7
call fcn.00407f9f
jmp 0x40671c
push ebx
push esi
push 0x40648c
push esi
push 0x401c49
lea eax, [ebp - 0x11c]
push eax
push dword [ebx]
call fcn.0041a684
mov ecx, dword [0x420b04]
add esp, 0x1c
cmp eax, esi
mov dword [ebp + 8], eax
jne 0x4065ea
push 0x3f2
push 0x322
jmp 0x4065a9
push esi
push esi
push esi
call fcn.00409067
cmp dword [ebx + 0x32c], esi
jne 0x4066e3
mov ecx, dword [ebx + 0x14]
call fcn.00406be1
lea ecx, [ebp - 0x12c]
mov dword [ebp - 0x118], eax
call fcn.004153f7
mov edi, dword [ebp - 0x118]
lea eax, [ebp - 0x118]
push eax
mov dword [ebp - 4], esi
call fcn.004147f7
push edi
lea ecx, [ebp - 0x12c]
call fcn.004155d5
call fcn.00414e1d
lea ecx, [ebp - 0x12c]
push eax
call fcn.004151d7
test eax, eax
je 0x4066c4
mov edi, dword [ebp - 0x118]
lea eax, [ebp - 0x118]
push eax
call fcn.004147f7
push edi
call fcn.00407f29
test eax, eax
je 0x4066c4
mov edi, dword [ebp - 0x118]
lea eax, [ebp - 0x118]
push eax
call fcn.004147f7
push 0x401d38
push edi
call fcn.0040bf8a
test eax, eax
pop ecx
pop ecx
je 0x406720
push 0x401d2c
push edi
call fcn.0040bf8a
test eax, eax
pop ecx
pop ecx
je 0x406720
push 0x401d18
push edi
call fcn.0040bf8a
test eax, eax
pop ecx
pop ecx
je 0x406720
push dword [ebp - 0x118]
mov ecx, ebx
push edi
call fcn.00405f2c
test eax, eax
je 0x40670d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x12c]
call fcn.004152d6
mov ecx, dword [ebx + 0x14]
call fcn.00406c1e
test eax, eax
je 0x4065fe
mov ecx, dword [0x420b04]
push esi
push esi
push esi
call fcn.00409067
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop ebx
call fcn.0040bf1b
leave
ret 8
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x12c]
call fcn.004152d6
xor eax, eax
jmp 0x4066f4
mov ecx, dword [0x420b04]
push 0x3f3
push 0x2c7
call fcn.00407f9f
jmp 0x40670d