Function at 0x47bad4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe84
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x17c], edx
mov dword [ebp - 0x178], edx
mov dword [ebp - 0x168], edx
mov dword [ebp - 0x170], edx
mov dword [ebp - 0x164], eax
mov esi, dword [0x5c1a5c]
xor eax, eax
push ebp
push 0x47bfdd
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x164]
mov eax, dword [eax + 0x278]
cmp dword [eax + 8], 0
jle 0x47bbef
mov eax, dword [ebp - 0x164]
mov eax, dword [eax + 0x1f0]
mov edx, dword [eax]
call dword [edx + pe_nt_image_headers32]
mov eax, dword [ebp - 0x164]
mov eax, dword [eax + 0x278]
mov edi, dword [eax + 8]
dec edi
test edi, edi
jl 0x47bbca
inc edi
xor esi, esi
mov eax, dword [ebp - 0x164]
mov eax, dword [eax + 0x278]
mov edx, esi
call fcn.0041070c
mov ebx, eax
cmp byte [ebx + 0x11], 0
je 0x47bb83
mov edx, dword [ebx + 4]
mov eax, dword [ebp - 0x164]
mov eax, dword [eax + 0x1f0]
mov ecx, dword [eax]
call dword [ecx + 0x34]
jmp 0x47bba8
lea edx, [ebp - 0x178]
mov eax, dword [ebx + 0x20]
call fcn.004794c4
mov edx, dword [ebp - 0x178]
mov eax, dword [ebp - 0x164]
mov eax, dword [eax + 0x1f0]
mov ecx, dword [eax]
call dword [ecx + 0x34]
mov eax, dword [ebx + 0x20]
mov edx, dword [ebp - 0x164]
cmp eax, dword [edx + 0x260]
jne 0x47bbc6
mov edx, esi
mov eax, dword [ebp - 0x164]
call fcn.0042ce58
inc esi
dec edi
jne 0x47bb52
mov eax, dword [ebp - 0x164]
call fcn.0042ce3c
test eax, eax
jge 0x47bfa9
xor edx, edx
mov eax, dword [ebp - 0x164]
call fcn.0042ce58
jmp 0x47bfa9
push 0x5c28cc
call sub.shell32.dll_SHGetDesktopFolder
call fcn.0040d6c8
test al, al
je 0x47bc18
mov ecx, 0x47bff4
mov dl, 1
mov eax, dword [0x407a70]
call fcn.0040b29c
call fcn.0040378c
mov eax, dword [ebp - 0x164]
add eax, 0x264
push eax
push 0
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
call fcn.0040d6c8
test al, al
je 0x47bc4c
mov ecx, 0x47c034
mov dl, 1
mov eax, dword [0x407a70]
call fcn.0040b29c
call fcn.0040378c
mov eax, dword [ebp - 0x164]
mov edx, dword [eax + 0x264]
mov eax, dword [esi]
mov ecx, 0x47c06c
call fcn.00479924
mov eax, dword [ebp - 0x164]
add eax, 0x268
push eax
push 0x11
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
call fcn.0040d6c8
test al, al
je 0x47bc98
mov ecx, 0x47c090
mov dl, 1
mov eax, dword [0x407a70]
call fcn.0040b29c
call fcn.0040378c
mov eax, dword [ebp - 0x164]
mov edx, dword [eax + 0x268]
mov eax, dword [esi]
mov ecx, 0x47c0c8
call fcn.00479924
push ebp
mov eax, dword [ebp - 0x164]
mov eax, dword [eax + 0x264]
xor ecx, ecx
xor edx, edx
call fcn.0047b8dc
pop ecx
xor edx, edx
mov eax, dword [ebp - 0x164]
call fcn.0042ce58
mov eax, dword [ebp - 0x164]
mov byte [eax + 0x26d], 0
mov eax, dword [ebp - 0x164]
mov eax, dword [eax + 0x264]
mov edx, dword [ebp - 0x164]
mov dword [edx + 0x260], eax
lea ecx, [ebp - 0x17c]
mov eax, dword [ebp - 0x164]
mov eax, dword [eax + 0x1f0]
xor edx, edx
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov edx, dword [ebp - 0x17c]
mov eax, dword [ebp - 0x164]
add eax, 0x254
call fcn.00403d94
mov eax, dword [ebp - 0x164]
mov eax, dword [eax + 0x278]
xor edx, edx
call fcn.0041070c
mov edx, dword [eax + 4]
mov eax, dword [ebp - 0x164]
add eax, 0x25c
call fcn.00403d94
push ebp
mov eax, dword [ebp - 0x164]
mov eax, dword [eax + 0x268]
xor ecx, ecx
mov edx, 1
call fcn.0047b8dc
pop ecx
lea eax, [ebp - 0x168]
push eax
mov eax, dword [0x5c19e4]
push eax
push 0
mov eax, dword [ebp - 0x164]
mov eax, dword [eax + 0x268]
push eax
mov eax, dword [0x5c28cc]
push eax
mov eax, dword [eax]
call dword [eax + 0x14]
call fcn.0040d6c8
test al, al
je 0x47bdae
mov ecx, 0x47c0ec
mov dl, 1
mov eax, dword [0x407a70]
call fcn.0040b29c
call fcn.0040378c
lea eax, [ebp - 0x170]
call fcn.00405b34
push eax
push 0x20
push 0
mov eax, dword [ebp - 0x168]
push eax
mov eax, dword [eax]
call dword [eax + 0x10]
call fcn.0040d6c8
test al, al
je 0x47be5f
mov ecx, 0x47c12c
mov dl, 1
mov eax, dword [0x407a70]
call fcn.0040b29c
call fcn.0040378c
jmp 0x47be5f
mov eax, dword [esi]
mov ecx, 0x47c168
mov edx, dword [ebp - 0x16c]
call fcn.00479924
push 0x47c168
mov eax, dword [ebp - 0x164]
mov edx, dword [eax + 0x268]
mov eax, dword [esi]
mov ecx, dword [ebp - 0x16c]
call fcn.00479a50
mov ebx, eax
mov eax, dword [esi]
mov edx, dword [ebp - 0x16c]
call fcn.0047994c
mov eax, dword [ebp - 0x164]
cmp byte [eax + 0x26c], 0
je 0x47be4f
push ebp
xor ecx, ecx
mov edx, 2
mov eax, ebx
call fcn.0047b8dc
pop ecx
jmp 0x47be5f
push ebp
mov cl, 1
mov edx, 2
mov eax, ebx
call fcn.0047b8dc
pop ecx
lea eax, [ebp - 0x174]
push eax
lea eax, [ebp - 0x16c]
push eax
push 1
mov eax, dword [ebp - 0x170]
push eax
mov eax, dword [eax]
call dword [eax + 0xc]
call fcn.0040d6bc
test al, al
je 0x47be91
cmp dword [ebp - 0x174], 1
je 0x47bdef
mov eax, dword [ebp - 0x164]
mov eax, dword [eax + 0x1f0]
mov edx, dword [eax]
call dword [edx + 0x14]
mov ecx, eax
dec ecx
mov edx, 2
mov eax, dword [ebp - 0x164]
call fcn.0047b860
mov eax, dword [ebp - 0x164]
mov eax, dword [eax + 0x1f0]
mov edx, dword [eax]
call dword [edx + 0x14]
mov edi, eax
lea eax, [ebp - 0x170]
call fcn.00405b34
push eax
push 0x20
push 0
mov eax, dword [0x5c28cc]
push eax
mov eax, dword [eax]
call dword [eax + 0x10]
jmp 0x47bf56
mov eax, dword [esi]
mov ecx, 0x47c168
mov edx, dword [ebp - 0x16c]
call fcn.00479924
push 0x47c168
mov eax, dword [ebp - 0x164]
mov edx, dword [eax + 0x264]
mov eax, dword [esi]
mov ecx, dword [ebp - 0x16c]
call fcn.00479a50
mov ebx, eax
mov eax, dword [esi]
mov edx, dword [ebp - 0x16c]
call fcn.0047994c
mov eax, dword [ebp - 0x164]
mov eax, dword [eax + 0x268]
push eax
push ebx
call sub.shell32.dll_ILIsEqual
test eax, eax
je 0x47bf46
mov eax, dword [esi]
mov edx, ebx
call fcn.0047994c
jmp 0x47bf56
push ebp
xor ecx, ecx
mov edx, 1
mov eax, ebx
call fcn.0047b8dc
pop ecx
lea eax, [ebp - 0x174]
push eax
lea eax, [ebp - 0x16c]
push eax
push 1
mov eax, dword [ebp - 0x170]
push eax
mov eax, dword [eax]
call dword [eax + 0xc]
call fcn.0040d6bc
test al, al
je 0x47bf88
cmp dword [ebp - 0x174], 1
je 0x47bee5
mov eax, dword [ebp - 0x164]
mov eax, dword [eax + 0x1f0]
mov edx, dword [eax]
call dword [edx + 0x14]
mov ecx, eax
dec ecx
mov edx, edi
mov eax, dword [ebp - 0x164]
call fcn.0047b860
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47bfe4
lea eax, [ebp - 0x17c]
mov edx, 2
call fcn.00403d64
lea eax, [ebp - 0x170]
call fcn.00405b34
lea eax, [ebp - 0x168]
call fcn.00405b34
ret