Function at 0x415740
Capabilities:
Get common file path

Disassembly:
sub rsp, 0x3f8
mov qword [rsp + 0x3f0], rbx
mov qword [rsp + 0x3e8], rbp
mov qword [rsp + 0x3e0], rsi
mov qword [rsp + 0x3d8], rdi
mov qword [rsp + 0x3d0], r12
mov qword [rsp + 0x3c8], r13
mov rbx, rdx
mov r12, rcx
mov qword [rsp + 0xa8], 0xfffffffffffffffe
call fcn.004545a0
test eax, eax
je 0x415811
xor r8d, r8d
lea rdx, str.CUninstall_::_GetInstalledFilesToDelete_n
lea rcx, [rsp + 0x2c0]
call fcn.00486850
movabs rdx, 0x203a5952544e45
mov qword [rsp + 0xb0], rdx
lea rdi, [rsp + 0xb0]
xor eax, eax
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
lea rdx, [rsp + 0x2c0]
xor ecx, ecx
nop
nop
movzx eax, byte [rdx + rcx]
mov byte [rdi + rcx - 1], al
inc rcx
test al, al
jne 0x4157e0
call fcn.004546e0
mov rcx, rax
call fcn.004545b0
call fcn.004546e0
mov rcx, rax
lea rdx, [rsp + 0xb0]
call fcn.004548a0
lea rbp, [r12 + 0x1b8]
lea rcx, [r12 + 0xe8]
mov r8, rbp
mov rdx, rbx
call fcn.00474920
mov rdx, qword [0x004dfd00]
mov qword [rsp + 0x20], rdx
mov edx, 0x104
lea rcx, [rsp + 0x1b0]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
cmp qword [rbp], 0
jne 0x415856
xor ebx, ebx
jmp 0x41585a
lea rbx, [rbp + 8]
test rbx, rbx
je 0x415d2d
test rbx, rbx
je 0x41589b
sub rbx, rbp
sub rbx, 7
mov rcx, rbx
lea rax, [rbx - 1]
cmp rax, 0x1f3
ja 0x41589b
mov rax, qword [rbp]
cmp rbx, rax
jae 0x41588e
lea rbx, [rbx + rbp + 8]
jmp 0x415890
xor ebx, ebx
lea rsi, [rcx - 1]
cmp rsi, rax
jae 0x4158af
jmp 0x41589f
xor ebx, ebx
jmp 0x4158af
cmp rsi, 0xffffffffffffffff
je 0x4158af
mov rsi, qword [rbp + rsi*8 + 0x200]
jmp 0x4158b6
lea rsi, [rbp + 0x11a0]
mov rdx, qword [rsi + 0x30]
lea rcx, [r12 + 0x2560]
call fcn.0049aaa4
call fcn.004545a0
test eax, eax
je 0x4158fd
mov r8, qword [rsi + 0x30]
lea rdx, str.FileToDelete___s_n
lea rcx, [rsp + 0xb0]
call fcn.00486850
call fcn.004546e0
mov rcx, rax
lea rdx, [rsp + 0xb0]
call fcn.004548a0
cmp dword [rsi + 0x4c], 2
jne 0x415972
mov rdx, qword [rsi + 0x30]
lea rcx, [rsp + 0x20]
call fcn.0049b398
lea r8, str..PNF
lea rdx, [0x004a9e10]
lea rcx, [rsp + 0x20]
call fcn.004999f4
lea rdx, [rsp + 0x20]
lea rcx, [r12 + 0x2560]
call fcn.0049a8fc
call fcn.004545a0
test eax, eax
je 0x415972
mov r8, qword [rsp + 0x20]
lea rdx, str.FileToDelete___s_n
lea rcx, [rsp + 0xb0]
call fcn.00486850
call fcn.004546e0
mov rcx, rax
lea rdx, [rsp + 0xb0]
call fcn.004548a0
cmp dword [r12 + 0x17c], 0
je 0x415a92
cmp dword [rsi + 0x4c], 2
jne 0x415a83
mov rdx, qword [rsi]
lea rcx, [rsp + 0x20]
call fcn.0049b398
lea r8, [0x004ac24c]
lea rdx, [0x004a9e10]
lea rcx, [rsp + 0x20]
call fcn.004999f4
lea rdx, str.System32CatRootF750E6C3_38EE_11D1_85E5_00C04FC295EE_
lea rcx, [rsp + 0x48]
call fcn.0049b290
mov rdi, rax
lea rdx, [rsp + 0x1b0]
lea rcx, [rsp + 0x90]
call fcn.0049b290
nop
mov r8, rdi
mov rdx, rax
lea rcx, [rsp + 0x38]
call fcn.0049b804
nop
lea r8, [rsp + 0x20]
mov rdx, rax
lea rcx, [rsp + 0x78]
call fcn.0049b804
nop
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.0049b31c
nop
lea rcx, [rsp + 0x78]
call fcn.0049b1dc
nop
lea rcx, [rsp + 0x38]
call fcn.0049b1dc
nop
lea rcx, [rsp + 0x90]
call fcn.0049b1dc
nop
lea rcx, [rsp + 0x48]
call fcn.0049b1dc
lea rdx, [rsp + 0x20]
lea rcx, [r12 + 0x2560]
call fcn.0049a8fc
call fcn.004545a0
test eax, eax
je 0x415a83
mov r8, qword [rsp + 0x20]
lea rdx, str.FileToDelete___s_n
lea rcx, [rsp + 0xb0]
call fcn.00486850
call fcn.004546e0
mov rcx, rax
lea rdx, [rsp + 0xb0]
call fcn.004548a0
cmp dword [r12 + 0x17c], 0
jne 0x415d24
cmp dword [rsi + 0x4c], 2
jne 0x415b73
lea rdx, str.INFOTHER_
lea rcx, [rsp + 0x68]
call fcn.0049b290
mov rdi, rax
lea rdx, [rsp + 0x1b0]
lea rcx, [rsp + 0xa0]
call fcn.0049b290
nop
mov r8, rdi
mov rdx, rax
lea rcx, [rsp + 0x58]
call fcn.0049b804
nop
mov r8, qword [rsi]
mov rdx, rax
lea rcx, [rsp + 0x88]
call fcn.0049b8ec
nop
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.0049b31c
nop
lea rcx, [rsp + 0x88]
call fcn.0049b1dc
nop
lea rcx, [rsp + 0x58]
call fcn.0049b1dc
nop
lea rcx, [rsp + 0xa0]
call fcn.0049b1dc
nop
lea rcx, [rsp + 0x68]
call fcn.0049b1dc
lea rdx, [rsp + 0x20]
lea rcx, [r12 + 0x2560]
call fcn.0049a8fc
call fcn.004545a0
test eax, eax
je 0x415b73
mov r8, qword [rsp + 0x20]
lea rdx, str.FileToDelete___s_n
lea rcx, [rsp + 0xb0]
call fcn.00486850
call fcn.004546e0
mov rcx, rax
lea rdx, [rsp + 0xb0]
call fcn.004548a0
cmp dword [r12 + 0x17c], 0
jne 0x415d24
lea rdx, str.OPTIONSCABS_
lea rcx, [rsp + 0x40]
call fcn.0049b290
mov rdi, rax
lea rdx, [rsp + 0x1b0]
lea rcx, [rsp + 0x30]
call fcn.0049b290
nop
mov r8, rdi
mov rdx, rax
lea rcx, [rsp + 0x28]
call fcn.0049b804
nop
mov r8, qword [rsi]
mov rdx, rax
lea rcx, [rsp + 0x98]
call fcn.0049b8ec
nop
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.0049b31c
nop
lea rcx, [rsp + 0x98]
call fcn.0049b1dc
nop
lea rcx, [rsp + 0x28]
call fcn.0049b1dc
nop
lea rcx, [rsp + 0x30]
call fcn.0049b1dc
nop
lea rcx, [rsp + 0x40]
call fcn.0049b1dc
lea rdx, [rsp + 0x20]
lea rcx, [r12 + 0x2560]
call fcn.0049a8fc
call fcn.004545a0
test eax, eax
je 0x415c53
mov r8, qword [rsp + 0x20]
lea rdx, str.FileToDelete___s_n
lea rcx, [rsp + 0xb0]
call fcn.00486850
call fcn.004546e0
mov rcx, rax
lea rdx, [rsp + 0xb0]
call fcn.004548a0
lea rdx, str.OPTIONSINSTALL_
lea rcx, [rsp + 0x80]
call fcn.0049b290
mov rdi, rax
lea rdx, [rsp + 0x1b0]
lea rcx, [rsp + 0x70]
call fcn.0049b290
nop
mov r8, rdi
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.0049b804
nop
mov r8, qword [rsi]
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.0049b8ec
nop
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.0049b31c
nop
lea rcx, [rsp + 0x50]
call fcn.0049b1dc
nop
lea rcx, [rsp + 0x60]
call fcn.0049b1dc
nop
lea rcx, [rsp + 0x70]
call fcn.0049b1dc
nop
lea rcx, [rsp + 0x80]
call fcn.0049b1dc
lea rdx, [rsp + 0x20]
lea rcx, [r12 + 0x2560]
call fcn.0049a8fc
call fcn.004545a0
test eax, eax
je 0x415d24
mov r8, qword [rsp + 0x20]
lea rdx, str.FileToDelete___s_n
lea rcx, [rsp + 0xb0]
call fcn.00486850
call fcn.004546e0
mov rcx, rax
lea rdx, [rsp + 0xb0]
call fcn.004548a0
test rbx, rbx
jne 0x415863
call fcn.004545a0
test eax, eax
je 0x415db2
xor r8d, r8d
lea rdx, str.CUninstall_::_GetInstalledFilesToDelete_n
lea rcx, [rsp + 0x2c0]
call fcn.00486850
movabs rdx, 0x20203a54495845
mov qword [rsp + 0xb0], rdx
lea rdi, [rsp + 0xb0]
xor eax, eax
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
lea rdx, [rsp + 0x2c0]
xor ecx, ecx
nop
movzx eax, byte [rdx + rcx]
mov byte [rdi + rcx - 1], al
inc rcx
test al, al
jne 0x415d80
call fcn.004546e0
mov rcx, rax
lea rdx, [rsp + 0xb0]
call fcn.004548a0
call fcn.004546e0
mov rcx, rax
call fcn.004545c0
nop
lea rcx, [rsp + 0x20]
call fcn.0049b1dc
mov rbx, qword [rsp + 0x3f0]
mov rbp, qword [rsp + 0x3e8]
mov rsi, qword [rsp + 0x3e0]
mov rdi, qword [rsp + 0x3d8]
mov r12, qword [rsp + 0x3d0]
mov r13, qword [rsp + 0x3c8]
add rsp, 0x3f8
ret