Function at 0x406fa0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd40
push ebx
push esi
push edi
mov eax, 0x564b50
call fcn.00544234
mov byte [ebp - 0xa5], 0
mov word [ebp - 0x94], 0xc
xor edx, edx
mov dword [ebp - 0xac], edx
mov word [ebp - 0x94], 0xc
push 0xf003f
push 0
push 0
call sub.ADVAPI32.DLL_OpenSCManagerW
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 0
je 0x4075c5
xor ecx, ecx
mov dword [ebp - 0xb0], ecx
push 0xf01ff
push str.SvcMayaEC
push dword [ebp - 0xac]
call sub.ADVAPI32.DLL_OpenServiceW
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 0
je 0x4075c5
mov word [ebp - 0x94], 0x24
mov edx, 0x57dae4
lea eax, [ebp - 8]
call fcn.005527d4
inc dword [ebp - 0x88]
mov word [ebp - 0x94], 0x18
mov word [ebp - 0x94], 0x30
xor ecx, ecx
mov dword [ebp - 0xc], ecx
inc dword [ebp - 0x88]
mov word [ebp - 0x94], 0x18
mov esi, 0x563aa4
lea edi, [ebp - 0x2c0]
mov ecx, 0x82
rep movsd dword es:[edi], dword [esi]
push 0x208
lea eax, [ebp - 0x2c0]
push eax
call sub.KERNEL32.DLL_GetSystemDirectoryW
mov word [ebp - 0x94], 0x48
lea edx, [ebp - 0x2c0]
lea eax, [ebp - 0x10]
call fcn.005528c0
inc dword [ebp - 0x88]
lea edx, [ebp - 0x10]
lea eax, [ebp - 0xc]
call fcn.0055294c
dec dword [ebp - 0x88]
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00552924
lea eax, [ebp - 0xc]
call fcn.00552dd4
cmp word [eax], 0x5c
je 0x407110
mov word [ebp - 0x94], 0x54
mov edx, 0x56423c
lea eax, [ebp - 0x14]
call fcn.005528c0
inc dword [ebp - 0x88]
lea edx, [ebp - 0x14]
lea eax, [ebp - 0xc]
call fcn.00552960
dec dword [ebp - 0x88]
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00552924
mov word [ebp - 0x94], 0x60
mov edx, 0x564240
lea eax, [ebp - 0x18]
call fcn.00552794
inc dword [ebp - 0x88]
lea edx, [ebp - 0x18]
lea eax, [ebp - 0xc]
call fcn.00552960
dec dword [ebp - 0x88]
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.00552924
lea edx, [ebp - 8]
lea eax, [ebp - 0xc]
call fcn.00552960
mov word [ebp - 0x94], 0x6c
lea edx, [ebp - 0xc]
lea eax, [ebp - 0x1c]
xor ecx, ecx
call fcn.00551a8c
inc dword [ebp - 0x88]
lea eax, [ebp - 0x1c]
inc dword [ebp - 0x88]
mov dword [ebp - 0xb4], eax
mov edx, dword [ebp - 0xb4]
cmp dword [edx], 0
jne 0x407192
mov edx, 0x564242
jmp 0x40719a
mov eax, dword [ebp - 0xb4]
mov edx, dword [eax]
lea eax, [ebp - 0x20]
call fcn.00552794
inc dword [ebp - 0x88]
mov eax, dword [eax]
mov dl, 1
call fcn.00464888
cmp al, 1
sete cl
and ecx, 1
push ecx
dec dword [ebp - 0x88]
lea eax, [ebp - 0x20]
mov edx, 2
call fcn.00552924
sub dword [ebp - 0x88], 2
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.004027dc
pop ecx
test cl, cl
je 0x4071fa
push dword [ebp - 8]
call fcn.00406c64
pop ecx
test al, al
je 0x4071fa
mov byte [ebp - 0xa5], 1
cmp byte [ebp - 0xa5], 0
jne 0x407596
mov word [ebp - 0x94], 0x78
lea eax, [ebp - 0x38]
call fcn.0040fb58
add dword [ebp - 0x88], 2
mov word [ebp - 0x94], 0x84
mov word [ebp - 0x94], 0x90
xor edx, edx
mov dword [ebp - 0x40], edx
lea ecx, [ebp - 0x40]
push ecx
inc dword [ebp - 0x88]
call fcn.004040f8
pop ecx
lea edx, [ebp - 0x40]
mov edx, dword [edx]
lea eax, [ebp - 0x38]
call fcn.0040ff10
dec dword [ebp - 0x88]
lea eax, [ebp - 0x40]
mov edx, 2
call fcn.00552924
mov word [ebp - 0x94], 0x9c
mov edx, 0x564256
lea eax, [ebp - 0x4c]
call fcn.00552794
inc dword [ebp - 0x88]
push dword [eax]
xor ecx, ecx
mov dword [ebp - 0x3c], ecx
lea eax, [ebp - 0x3c]
push eax
inc dword [ebp - 0x88]
mov edx, str.InstallDir
lea eax, [ebp - 0x48]
call fcn.00552794
inc dword [ebp - 0x88]
push dword [eax]
mov edx, 0x564243
lea eax, [ebp - 0x44]
call fcn.00552794
inc dword [ebp - 0x88]
mov edx, dword [eax]
lea eax, [ebp - 0x38]
pop ecx
call fcn.0041003c
dec dword [ebp - 0x88]
lea eax, [ebp - 0x4c]
mov edx, 2
call fcn.00552924
dec dword [ebp - 0x88]
lea eax, [ebp - 0x48]
mov edx, 2
call fcn.00552924
dec dword [ebp - 0x88]
lea eax, [ebp - 0x44]
mov edx, 2
call fcn.00552924
mov word [ebp - 0x94], 0x84
mov word [ebp - 0x94], 0xa8
mov edx, 0x564257
lea eax, [ebp - 0x50]
call fcn.00552794
inc dword [ebp - 0x88]
lea edx, [ebp - 0x50]
lea eax, [ebp - 0x3c]
call fcn.00552a04
push eax
dec dword [ebp - 0x88]
lea eax, [ebp - 0x50]
mov edx, 2
call fcn.00552924
pop ecx
test cl, cl
je 0x407566
mov word [ebp - 0x94], 0xb4
xor eax, eax
mov dword [ebp - 0x54], eax
inc dword [ebp - 0x88]
mov word [ebp - 0x94], 0xc0
mov word [ebp - 0x94], 0xcc
lea edx, [ebp - 0x5c]
push edx
call fcn.0055e4b0
pop ecx
add dword [ebp - 0x88], 3
mov word [ebp - 0x94], 0xc0
mov word [ebp - 0x94], 0xd8
push 1
lea ecx, [ebp - 0x5c]
push ecx
xor eax, eax
mov dword [ebp - 0x60], eax
lea edx, [ebp - 0x60]
push edx
inc dword [ebp - 0x88]
call fcn.0055f18c
add esp, 0xc
lea edx, [ebp - 0x60]
lea eax, [ebp - 0x54]
call fcn.0055294c
dec dword [ebp - 0x88]
lea eax, [ebp - 0x60]
mov edx, 2
call fcn.00552924
mov word [ebp - 0x94], 0xe4
xor ecx, ecx
mov dword [ebp - 0x64], ecx
lea ecx, [ebp - 0x64]
inc dword [ebp - 0x88]
lea edx, [ebp - 0x3c]
lea eax, [ebp - 0x54]
call fcn.00552974
lea eax, [ebp - 0x64]
push eax
mov edx, 0x564258
lea eax, [ebp - 0x68]
call fcn.00552794
inc dword [ebp - 0x88]
lea edx, [ebp - 0x68]
xor ecx, ecx
mov dword [ebp - 0x6c], ecx
lea ecx, [ebp - 0x6c]
inc dword [ebp - 0x88]
pop eax
call fcn.00552974
lea eax, [ebp - 0x6c]
xor edx, edx
mov dword [ebp - 0x70], edx
lea ecx, [ebp - 0x70]
inc dword [ebp - 0x88]
lea edx, [ebp - 8]
call fcn.00552974
lea edx, [ebp - 0x70]
lea eax, [ebp - 0xc]
call fcn.0055294c
dec dword [ebp - 0x88]
lea eax, [ebp - 0x70]
mov edx, 2
call fcn.00552924
dec dword [ebp - 0x88]
lea eax, [ebp - 0x6c]
mov edx, 2
call fcn.00552924
dec dword [ebp - 0x88]
lea eax, [ebp - 0x68]
mov edx, 2
call fcn.00552924
dec dword [ebp - 0x88]
lea eax, [ebp - 0x64]
mov edx, 2
call fcn.00552924
mov word [ebp - 0x94], 0xf0
lea edx, [ebp - 0xc]
lea eax, [ebp - 0x74]
xor ecx, ecx
call fcn.00551a8c
inc dword [ebp - 0x88]
lea eax, [ebp - 0x74]
inc dword [ebp - 0x88]
mov dword [ebp - 0xb8], eax
mov edx, dword [ebp - 0xb8]
cmp dword [edx], 0
jne 0x4074cd
mov edx, 0x56425a
jmp 0x4074d5
mov eax, dword [ebp - 0xb8]
mov edx, dword [eax]
lea eax, [ebp - 0x78]
call fcn.00552794
inc dword [ebp - 0x88]
mov eax, dword [eax]
mov dl, 1
call fcn.00464888
cmp al, 1
sete cl
and ecx, 1
push ecx
dec dword [ebp - 0x88]
lea eax, [ebp - 0x78]
mov edx, 2
call fcn.00552924
sub dword [ebp - 0x88], 2
lea eax, [ebp - 0x74]
mov edx, 2
call fcn.004027dc
pop ecx
test cl, cl
je 0x407535
push dword [ebp - 8]
call fcn.00406c64
pop ecx
test al, al
je 0x407535
mov byte [ebp - 0xa5], 1
sub dword [ebp - 0x88], 3
push 2
lea eax, [ebp - 0x5c]
push eax
call fcn.0055e56c
add esp, 8
dec dword [ebp - 0x88]
lea eax, [ebp - 0x54]
mov edx, 2
call fcn.00552924
mov word [ebp - 0x94], 0x84
dec dword [ebp - 0x88]
lea eax, [ebp - 0x3c]
mov edx, 2
call fcn.00552924
sub dword [ebp - 0x88], 2
lea eax, [ebp - 0x38]
mov edx, 2
call fcn.0040fbb8
mov word [ebp - 0x94], 0x18
dec dword [ebp - 0x88]
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00552924
dec dword [ebp - 0x88]
lea eax, [ebp - 8]
mov edx, 2
call fcn.00552924
mov word [ebp - 0x94], 0xc
push dword [ebp - 0xac]
call sub.ADVAPI32.DLL_CloseServiceHandle
xor ecx, ecx
mov dword [ebp - 0xac], ecx
mov word [ebp - 0x94], 0
jmp 0x407658
mov al, byte [ebp - 0xa5]
mov edx, dword [ebp - 0xa4]
mov dword fs:[0], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret