Function at 0x496a20
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x488
mov eax, dword [0x579aa4]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0
je 0x496a43
mov eax, dword [ebp + 8]
movzx ecx, word [eax]
test ecx, ecx
jne 0x496a60
mov dword [ebp - 0x470], 0
lea ecx, [ebp + 0xc]
call fcn.00406190
mov eax, dword [ebp - 0x470]
jmp 0x496d89
push 0x208
push 0
lea edx, [ebp - 0x210]
push edx
call fcn.0050c770
add esp, 0xc
push 0x25
mov eax, dword [ebp + 8]
push eax
call fcn.0050c739
add esp, 8
test eax, eax
jne 0x496ab1
lea ecx, [ebp + 0xc]
push ecx
mov ecx, dword [ebp + 0x10]
call fcn.00404a40
mov dword [ebp - 0x474], 1
lea ecx, [ebp + 0xc]
call fcn.00406190
mov eax, dword [ebp - 0x474]
jmp 0x496d89
push 9
push str._install_
mov edx, dword [ebp + 8]
push edx
call fcn.0050c679
add esp, 0xc
test eax, eax
jne 0x496b13
mov eax, dword [ebp + 8]
add eax, 0x12
push eax
lea ecx, [ebp + 0xc]
push ecx
lea edx, [ebp - 0x478]
push edx
call fcn.00404ee0
add esp, 0xc
push eax
mov ecx, dword [ebp + 0x10]
call fcn.00404a40
lea ecx, [ebp - 0x478]
call fcn.00406190
mov dword [ebp - 0x47c], 1
lea ecx, [ebp + 0xc]
call fcn.00406190
mov eax, dword [ebp - 0x47c]
jmp 0x496d89
push 0xe
push str._Common_Files_
mov eax, dword [ebp + 8]
push eax
call fcn.0050c679
add esp, 0xc
test eax, eax
jne 0x496ba1
push 0x208
push 0
lea ecx, [ebp - 0x420]
push ecx
call fcn.0050c770
add esp, 0xc
lea edx, [ebp - 0x420]
push edx
push 0
push 0
push 0x26
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x496ba1
lea eax, [ebp - 0x420]
push eax
mov ecx, dword [ebp + 0x10]
call fcn.004057e0
push str.Common_Files
mov ecx, dword [ebp + 0x10]
call fcn.00405a70
mov ecx, dword [ebp + 8]
add ecx, 0x1c
push ecx
mov ecx, dword [ebp + 0x10]
call fcn.00405a70
mov dword [ebp - 0x480], 1
lea ecx, [ebp + 0xc]
call fcn.00406190
mov eax, dword [ebp - 0x480]
jmp 0x496d89
push 0x25
mov edx, dword [ebp + 8]
push edx
call fcn.0050c7ea
add esp, 8
mov dword [ebp - 0x214], eax
movzx eax, word [ebp - 0x210]
test eax, eax
jne 0x496d50
mov dword [ebp - 0x444], str._COMMON_DESKTOP_
mov dword [ebp - 0x440], str._COMMON_APPDATA_
mov dword [ebp - 0x43c], str._COMMON_STARTMENU_
mov dword [ebp - 0x438], str._COMMON_PROGRAMS_
mov dword [ebp - 0x434], str._USER_DESKTOP_
mov dword [ebp - 0x430], str._USER_APPDATA_
mov dword [ebp - 0x42c], str._USER_STARTMENU_
mov dword [ebp - 0x428], str._USER_PROGRAMS_
mov dword [ebp - 0x46c], 0x19
mov dword [ebp - 0x468], 0x23
mov dword [ebp - 0x464], 0x16
mov dword [ebp - 0x460], 0x17
mov dword [ebp - 0x45c], 0x10
mov dword [ebp - 0x458], 0x1a
mov dword [ebp - 0x454], 0xb
mov dword [ebp - 0x450], 2
mov dword [ebp - 0x44c], 0xffffffff
mov dword [ebp - 0x448], 0
mov dword [ebp - 0x424], 0
jmp 0x496c93
mov ecx, dword [ebp - 0x424]
add ecx, 1
mov dword [ebp - 0x424], ecx
cmp dword [ebp - 0x424], 8
jae 0x496ce1
mov edx, dword [ebp - 0x424]
mov eax, dword [ebp + edx*4 - 0x444]
push eax
call fcn.0050c71f
add esp, 4
push eax
mov ecx, dword [ebp - 0x424]
mov edx, dword [ebp + ecx*4 - 0x444]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.0050c679
add esp, 0xc
test eax, eax
jne 0x496cdf
mov ecx, dword [ebp - 0x424]
mov dword [ebp - 0x44c], ecx
jmp 0x496ce1
jmp 0x496c84
cmp dword [ebp - 0x44c], 0xffffffff
je 0x496d22
cmp dword [ebp - 0x44c], 8
jae 0x496d22
lea edx, [ebp - 0x210]
push edx
push 0
push 0
mov eax, dword [ebp - 0x44c]
mov ecx, dword [ebp + eax*4 - 0x46c]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x496d22
mov dword [ebp - 0x448], 1
cmp dword [ebp - 0x448], 0
je 0x496d36
movzx edx, word [ebp - 0x210]
test edx, edx
jne 0x496d50
mov dword [ebp - 0x484], 0
lea ecx, [ebp + 0xc]
call fcn.00406190
mov eax, dword [ebp - 0x484]
jmp 0x496d89
lea eax, [ebp - 0x210]
push eax
mov ecx, dword [ebp + 0x10]
call fcn.004057e0
mov ecx, dword [ebp - 0x214]
add ecx, 2
push ecx
mov ecx, dword [ebp + 0x10]
call fcn.00405a70
mov dword [ebp - 0x488], 1
lea ecx, [ebp + 0xc]
call fcn.00406190
mov eax, dword [ebp - 0x488]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0050c75f
mov esp, ebp
pop ebp
ret