Function at 0x417950
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1454
call fcn.0042c290
mov eax, dword [0x4546e0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, 0x206
xor ebx, ebx
push edi
lea eax, [ebp - 0x1452]
push ebx
push eax
mov word [ebp - 0x1454], bx
call fcn.0042b8b0
mov esi, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
add esp, 0xc
push ebx
push 0x10
lea eax, [ebp - 0x1454]
push eax
push ebx
call esi
push edi
lea eax, [ebp - 0xa2a]
push ebx
push eax
mov word [ebp - 0xa2c], bx
call fcn.0042b8b0
add esp, 0xc
push 1
push 2
lea eax, [ebp - 0xa2c]
push eax
push ebx
call esi
push edi
lea eax, [ebp - 0xc32]
push ebx
push eax
mov word [ebp - 0xc34], bx
call fcn.0042b8b0
add esp, 0xc
mov esi, 0x104
push esi
lea eax, [ebp - 0xc34]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x4471bc
push 2
lea eax, [ebp - 0xc34]
push 0x5c
push eax
call fcn.0042e95d
pop ecx
pop ecx
push eax
call fcn.0042b9b3
push edi
lea eax, [ebp - 0x822]
push ebx
push eax
mov word [ebp - 0x824], bx
call fcn.0042b8b0
lea eax, [ebp - 0xc34]
push eax
lea eax, [ebp - 0x824]
push esi
push eax
call fcn.0042b9b3
push str.kwsmain.exe
lea eax, [ebp - 0x824]
push esi
push eax
call fcn.0042b939
push edi
lea eax, [ebp - 0x124a]
push ebx
push eax
mov word [ebp - 0x124c], bx
call fcn.0042b8b0
lea eax, [ebp - 0xc34]
push eax
push esi
lea eax, [ebp - 0x124c]
push eax
call fcn.0042b9b3
add esp, 0x48
push str.KWSUpd.exe
lea eax, [ebp - 0x124c]
push esi
push eax
call fcn.0042b939
push edi
lea eax, [ebp - 0x1042]
push ebx
push eax
mov word [ebp - 0x1044], bx
call fcn.0042b8b0
lea eax, [ebp - 0xc34]
push eax
lea eax, [ebp - 0x1044]
push esi
push eax
call fcn.0042b9b3
push str.kwsinst.exe
lea eax, [ebp - 0x1044]
push esi
push eax
call fcn.0042b939
add esp, 0x30
call fcn.0041a3b3
test eax, eax
push edi
push ebx
je 0x417b67
lea eax, [ebp - 0x61a]
push eax
mov word [ebp - 0x61c], bx
call fcn.0042b8b0
add esp, 0xc
push esi
lea eax, [ebp - 0x61c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push edi
lea eax, [ebp - 0x412]
push ebx
push eax
mov word [ebp - 0x414], bx
call fcn.0042b8b0
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push esi
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x61c]
push eax
call fcn.004310d1
push str.UsersPublicDesktop
lea eax, [ebp - 0x414]
push esi
push eax
call fcn.0042b939
push edi
lea eax, [ebp - 0x20a]
push ebx
push eax
mov word [ebp - 0x20c], bx
call fcn.0042b8b0
add esp, 0x48
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.0042b9b3
add esp, 0xc
jmp 0x417b91
lea eax, [ebp - 0x20a]
push eax
mov word [ebp - 0x20c], bx
call fcn.0042b8b0
lea eax, [ebp - 0x1454]
push eax
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.0042b9b3
add esp, 0x18
cmp dword [ebp + 8], 6
lea eax, [ebp - 0x20c]
jne 0x417bae
push 0x44993c
push esi
push eax
call fcn.0042b939
add esp, 0xc
jmp 0x417bd8
push 0x449928
push esi
push eax
call fcn.0042b939
push ebx
lea eax, [ebp - 0x824]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x824]
push eax
call fcn.0041789e
add esp, 0x1c
cmp dword [0x455b00], ebx
jne 0x417d80
push edi
lea eax, [ebp - 0x20a]
push ebx
push eax
mov word [ebp - 0x20c], bx
call fcn.0042b8b0
lea eax, [ebp - 0xa2c]
push eax
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.0042b9b3
add esp, 0x18
cmp dword [ebp + 8], 6
lea eax, [ebp - 0x20c]
jne 0x417c23
push 0x449914
jmp 0x417c28
push 0x449904
push esi
push eax
call fcn.0042b939
lea eax, [ebp - 0x20c]
add esp, 0xc
push eax
call fcn.0040b2bf
push edi
lea eax, [ebp - 0xe3a]
push ebx
push eax
mov word [ebp - 0xe3c], bx
call fcn.0042b8b0
lea eax, [ebp - 0xa2c]
push eax
lea eax, [ebp - 0xe3c]
push esi
push eax
call fcn.0042b9b3
add esp, 0x1c
cmp dword [ebp + 8], 6
lea eax, [ebp - 0xe3c]
jne 0x417c7d
push 0x4498dc
jmp 0x417c82
push 0x4498bc
push esi
push eax
call fcn.0042b939
add esp, 0xc
push ebx
lea eax, [ebp - 0x824]
push eax
lea eax, [ebp - 0xe3c]
push eax
lea eax, [ebp - 0x824]
push eax
call fcn.0041789e
push edi
lea eax, [ebp - 0x61a]
push ebx
push eax
mov word [ebp - 0x61c], bx
call fcn.0042b8b0
lea eax, [ebp - 0xa2c]
push eax
lea eax, [ebp - 0x61c]
push esi
push eax
call fcn.0042b9b3
add esp, 0x28
cmp dword [ebp + 8], 6
lea eax, [ebp - 0x61c]
jne 0x417ce6
push 0x449898
jmp 0x417ceb
push 0x449878
push esi
push eax
call fcn.0042b939
add esp, 0xc
push ebx
lea eax, [ebp - 0x124c]
push eax
lea eax, [ebp - 0x61c]
push eax
lea eax, [ebp - 0x124c]
push eax
call fcn.0041789e
push edi
lea eax, [ebp - 0x412]
push ebx
push eax
mov word [ebp - 0x414], bx
call fcn.0042b8b0
lea eax, [ebp - 0xa2c]
push eax
lea eax, [ebp - 0x414]
push esi
push eax
call fcn.0042b9b3
add esp, 0x28
cmp dword [ebp + 8], 6
lea eax, [ebp - 0x414]
jne 0x417d4f
push 0x449854
jmp 0x417d54
push 0x449834
push esi
push eax
call fcn.0042b939
add esp, 0xc
push str._u__uc
lea eax, [ebp - 0x1044]
push eax
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x1044]
push eax
call fcn.0041789e
add esp, 0x10
mov ecx, dword [ebp - 4]
pop edi
xor eax, eax
pop esi
xor ecx, ebp
inc eax
pop ebx
call fcn.0042b92a
leave
ret