Function at 0x45c9c0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x4af6f0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.ole32.dll_CoCreateGuid]
test eax, eax
jne 0x45ca03
movdqu xmm0, xmmword [ebp - 0x14]
push 0x104
push 0x4c73e8
sub esp, 0x10
mov eax, esp
movdqu xmmword [eax], xmm0
call fcn.0043d110
add esp, 0x18
jmp 0x45ca1a
push str.A6E044B8_6C25_48fc_806B_002A9582C81F
push 0x104
push 0x4c73e8
call fcn.0046fe12
add esp, 0xc
push 0x104
push 0x4c9020
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov esi, dword [sym.imp.SHLWAPI.dll_PathRemoveBackslashW]
test eax, eax
je 0x45ca3b
push 0x4c9020
call esi
push 0x104
push 0x4c9228
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x45ca56
push 0x4c9228
call esi
call fcn.0043d5d0
test eax, eax
je 0x45ca8e
push 0x4c9020
push str._s_system
push 0x104
push 0x4c9430
call fcn.0046ecde
push 0x4c9228
push 0x104
push 0x4c9638
call fcn.0046fe12
jmp 0x45cabb
push 0x4c9228
push 0x104
push 0x4c9430
call fcn.0046fe12
push 0x4c9020
push str._s_system32
push 0x104
push 0x4c9638
call fcn.0046ecde
add esp, 0x1c
push 0x4c9840
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x45cad9
push 0x4c9840
call esi
push 0x4c9a48
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x45caf4
push 0x4c9a48
call esi
push str.shfolder.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x45cda4
push 0x49b7d4
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x45cda4
push 0x4ca060
push 0
push 0
push 0x8023
push 0
call edi
test eax, eax
js 0x45cb3c
push 0x4ca060
call esi
push 0x4ccb08
push 0
push 0
push 0x8009
push 0
call edi
test eax, eax
js 0x45cb59
push 0x4ccb08
call esi
push 0x4ca268
push 0
push 0
push 0x8026
push 0
call edi
test eax, eax
js 0x45cb76
push 0x4ca268
call esi
push 0x4ca470
push 0
push 0
push 0x801a
push 0
call edi
test eax, eax
js 0x45cb93
push 0x4ca470
call esi
push 0x4ca678
push 0
push 0
push 0x801c
push 0
call edi
test eax, eax
js 0x45cbb0
push 0x4ca678
call esi
push 0x4ca880
push 0
push 0
push 0x8018
push 0
call edi
test eax, eax
js 0x45cbcd
push 0x4ca880
call esi
push 0x4caa88
push 0
push 0
push 0x8007
push 0
call edi
test eax, eax
js 0x45cbea
push 0x4caa88
call esi
push 0x4cac90
push 0
push 0
push 0x802e
push 0
call edi
test eax, eax
js 0x45cc07
push 0x4cac90
call esi
push 0x4cae98
push 0
push 0
push 0x8005
push 0
call edi
test eax, eax
js 0x45cc24
push 0x4cae98
call esi
push 0x4cb0a0
push 0
push 0
push 0x8019
push 0
call edi
test eax, eax
js 0x45cc41
push 0x4cb0a0
call esi
push 0x4cb2a8
push 0
push 0
push 0x8010
push 0
call edi
test eax, eax
js 0x45cc5e
push 0x4cb2a8
call esi
push 0x4cb4b0
push 0
push 0
push 0x802b
push 0
call edi
test eax, eax
js 0x45cc7b
push 0x4cb4b0
call esi
push 0x4cb6b8
push 0
push 0
push 0x8016
push 0
call edi
test eax, eax
js 0x45cc98
push 0x4cb6b8
call esi
push 0x4cb8c0
push 0
push 0
push 0x800b
push 0
call edi
test eax, eax
js 0x45ccb5
push 0x4cb8c0
call esi
push 0x4cbac8
push 0
push 0
push 0x8017
push 0
call edi
test eax, eax
js 0x45ccd2
push 0x4cbac8
call esi
push 0x4cbcd0
push 0
push 0
push 0x8002
push 0
call edi
test eax, eax
js 0x45ccef
push 0x4cbcd0
call esi
push 0x4cbed8
push 0
push 0
push 0x8037
push 0
call edi
test eax, eax
js 0x45cd0c
push 0x4cbed8
call esi
push 0x4cc0e0
push 0
push 0
push 0x800e
push 0
call edi
test eax, eax
js 0x45cd29
push 0x4cc0e0
call esi
push 0x4cc2e8
push 0
push 0
push 0x8035
push 0
call edi
test eax, eax
js 0x45cd46
push 0x4cc2e8
call esi
push 0x4cc4f0
push 0
push 0
push 0x800d
push 0
call edi
test eax, eax
js 0x45cd63
push 0x4cc4f0
call esi
push 0x4c9c50
push 0
push 0
push 0x8036
push 0
call edi
test eax, eax
js 0x45cd80
push 0x4c9c50
call esi
push 0x4c9e58
push 0
push 0
push 0x8027
push 0
call edi
test eax, eax
js 0x45cd9d
push 0x4c9e58
call esi
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push str.shell32
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
test edi, edi
je 0x45ce46
push str.SHGetKnownFolderPath
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
test ebx, ebx
je 0x45ce46
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 0
push eax
push 0
push 0xd000
push 0x49e744
call ebx
test eax, eax
js 0x45ce04
push dword [ebp - 0x18]
push 0x104
push 0x4cc900
call fcn.0046fe12
add esp, 0xc
push 0x4cc900
call esi
lea eax, [ebp - 0x18]
push eax
push 0
push 0xd000
push 0x49e734
call ebx
test eax, eax
js 0x45ce36
push dword [ebp - 0x18]
push 0x104
push 0x4cc6f8
call fcn.0046fe12
add esp, 0xc
push 0x4cc6f8
call esi
push dword [ebp - 0x18]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp word [0x4cc900], 0
jne 0x45ce69
push 0xffffffffffffffff
push 0x4cb0a0
push 0x104
push 0x4cc900
call fcn.004703d1
add esp, 0x10
cmp word [0x4cc6f8], 0
jne 0x45ce8c
push 0xffffffffffffffff
push 0x4cb2a8
push 0x104
push 0x4cc6f8
call fcn.004703d1
add esp, 0x10
push 0x104
push 0x4ccd10
push dword [0x4b550c]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x45cf17
push 0xffffffffffffffff
push 0x4ccd10
push 0x104
push 0x4cd120
call fcn.004703d1
add esp, 0x10
push 0x4cd120
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push 0xffffffffffffffff
push 0x4ccd10
push 0x104
push 0x4ccf18
call fcn.004703d1
add esp, 0x10
push 0x4ccf18
call dword [sym.imp.SHLWAPI.dll_PathStripPathW]
push 0xffffffffffffffff
push 0x4ccd10
push 0x104
push 0x4cd328
call fcn.004703d1
add esp, 0x10
push str..cfg
push 0x4cd328
call dword [sym.imp.SHLWAPI.dll_PathRenameExtensionW]
push 0x4c9020
push str.InitPathVar_____WINDOWS__:__s
call fcn.00469390
push 0x4c9228
push str.InitPathVar_____WINSYS__:__s
call fcn.00469390
push 0x4c9840
push str.InitPathVar_____CURRENTDIR__:__s
call fcn.00469390
push 0x4c9a48
push str.InitPathVar_____TEMP__:__s
call fcn.00469390
push 0x4ccb08
push str.InitPathVar_____SENDTO__:__s
call fcn.00469390
push 0x4ca268
push str.InitPathVar_____PROGRAMFILES__:__s
call fcn.00469390
push 0x4cb4b0
push str.InitPathVar_____PROGRAM_FILES_COMMON__:__s
call fcn.00469390
push 0x4cc0e0
push str.InitPathVar_____VIDEO_USER__:__s
call fcn.00469390
add esp, 0x40
push 0x4cbed8
push str.InitPathVar_____VIDEO_ALLUSERS__:__s
call fcn.00469390
push 0x4cc4f0
push str.InitPathVar_____MUSIC_USER__:__s
call fcn.00469390
push 0x4cc2e8
push str.InitPathVar_____MUSIC_ALLUSERS__:__s
call fcn.00469390
push 0x4c9e58
push str.InitPathVar_____PICTURES_USER__:__s
call fcn.00469390
push 0x4c9c50
push str.InitPathVar_____PICTURES_ALLUSERS__:__s
call fcn.00469390
push 0x4cbcd0
push str.InitPathVar_____PROGRAMS_USER__:__s
call fcn.00469390
push 0x4cbac8
push str.InitPathVar_____PROGRAMS_ALLUSERS__:__s
call fcn.00469390
push 0x4cb8c0
push str.InitPathVar_____STARTMENU_USER__:__s
call fcn.00469390
add esp, 0x40
push 0x4cb6b8
push str.InitPathVar_____STARTMENU_ALLUSERS__:__s
call fcn.00469390
push 0x4caa88
push str.InitPathVar_____STARTUP_USER__:__s
call fcn.00469390
push 0x4ca880
push str.InitPathVar_____STARTUP_ALLUSERS__:__s
call fcn.00469390
push 0x4ca470
push str.InitPathVar_____APPDATA__:__s
call fcn.00469390
push 0x4ca060
push str.InitPathVar_____COMMON_APPDATA__:__s
call fcn.00469390
push 0x4ca678
push str.InitPathVar_____LOCAL_APPDATA__:__s
call fcn.00469390
push 0x4cae98
push str.InitPathVar_____DOCUMENTS_USER__:__s
call fcn.00469390
push 0x4cac90
push str.InitPathVar_____DOCUMENTS_ALLUSERS__:__s
call fcn.00469390
add esp, 0x40
push 0x4cb2a8
push str.InitPathVar_____DESKTOP_USER__:__s
call fcn.00469390
push 0x4cb0a0
push str.InitPathVar_____DESKTOP_ALLUSERS__:__s
call fcn.00469390
push 0x4cc6f8
push str.InitPathVar_____DOWNLOAD_USER__:__s
call fcn.00469390
push 0x4cc900
push str.InitPathVar_____DOWNLOAD_ALLUSERS__:__s
call fcn.00469390
push 0x4ccd10
push str.InitPathVar____ModuleFile:__s
call fcn.00469390
push 0x4cd120
push str.InitPathVar____ModulePath:__s
call fcn.00469390
push 0x4ccf18
push str.InitPathVar____ModuleFileName:__s
call fcn.00469390
push 0x4cd328
push str.InitPathVar____ConfigFile:__s
call fcn.00469390
add esp, 0x40
push 0x4c73e8
push str.InitPathVar____NewGuid:__s
call fcn.00469390
mov ecx, dword [ebp - 4]
add esp, 8
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.0046ecfa
mov esp, ebp
pop ebp
ret