Function at 0x48af80
Capabilities:
Get common file path

Disassembly:
push 0x618
mov eax, 0x4ae7a8
call fcn.00453742
mov esi, dword [ebp + 8]
and dword [ebp - 0x61c], 0
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push eax
call fcn.004526c0
mov edi, dword [ebp + 0xc]
add esp, 0xc
lea eax, [ebp - 0x620]
push eax
xor ebx, ebx
push edi
inc ebx
push 0
mov byte [ebp - 0x617], bl
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
js 0x48b020
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x620]
mov byte [ebp - 0x617], 0
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
lea eax, [ebp - 0x624]
push eax
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
test eax, eax
js 0x48b020
mov eax, dword [ebp - 0x624]
push dword [ebp - 0x620]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
mov eax, dword [ebp - 0x624]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
push 0
lea eax, [ebp - 0x616]
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x2a8]
mov byte [ebp - 0x615], 0
mov dword [ebp - 0x2a8], 0x4b7b38
mov dword [ebp - 0x280], 0x4b7b40
call fcn.00411330
and dword [ebp - 4], 0
push 0x4b4e80
lea ecx, [ebp - 0x2a8]
call fcn.0047fa54
lea ecx, [ebp - 0x2a8]
call fcn.0048ce54
cmp edi, 0x2b
je 0x48b07f
cmp edi, 0x26
jne 0x48b0db
lea ecx, [ebp - 0x2a8]
call fcn.0048c6dc
test al, al
je 0x48b0b7
lea eax, [ebp - 0x2e4]
push eax
lea ecx, [ebp - 0x2a8]
call fcn.0048c5ed
cmp dword [eax + 0x14], 0
mov ecx, ebx
mov dword [ebp - 0x61c], ecx
je 0x48b0bd
mov byte [ebp - 0x615], 0
jmp 0x48b0c3
mov ecx, dword [ebp - 0x61c]
mov byte [ebp - 0x615], bl
test bl, cl
je 0x48b0db
and ecx, 0xfffffffe
mov dword [ebp - 0x61c], ecx
lea ecx, [ebp - 0x2e4]
call fcn.00401b80
cmp byte [ebp - 0x617], 0
jne 0x48b0ed
cmp byte [ebp - 0x615], 0
je 0x48b163
push 0
lea eax, [ebp - 0x616]
push eax
lea ecx, [ebp - 0x248]
mov dword [ebp - 0x248], 0x4b7b38
mov dword [ebp - 0x220], 0x4b7b40
call fcn.00403e30
mov eax, edi
mov byte [ebp - 4], bl
sub eax, 5
je 0x48b4c1
sub eax, 0xf
je 0x48b46c
sub eax, 6
je 0x48b33f
dec eax
dec eax
je 0x48b33f
sub eax, 7
je 0x48b33f
sub eax, 3
je 0x48b264
sub eax, 5
je 0x48b185
lea ecx, [ebp - 0x248]
mov byte [ebp - 4], 0
call fcn.00401b80
push 0
lea eax, [ebp - 0x2a8]
push eax
mov ecx, esi
mov dword [esi], 0x4b7b38
mov dword [esi + 0x28], 0x4b7b40
call fcn.0041122d
jmp 0x48b5f0
lea eax, [ebp - 0x278]
push ebx
push eax
call fcn.0048cae7
pop ecx
pop ecx
lea ecx, [ebp - 0x278]
mov byte [ebp - 4], 0xc
call fcn.0048ce54
lea ecx, [ebp - 0x278]
call fcn.0048c6dc
test al, al
je 0x48b1d7
lea eax, [ebp - 0x470]
push eax
lea ecx, [ebp - 0x278]
call fcn.0048c5ed
mov ecx, dword [ebp - 0x61c]
or ecx, 4
cmp dword [eax + 0x14], 0
je 0x48b1dd
xor bl, bl
jmp 0x48b1dd
mov ecx, dword [ebp - 0x61c]
test cl, 4
je 0x48b1ed
lea ecx, [ebp - 0x470]
call fcn.00401b80
test bl, bl
je 0x48b237
lea eax, [ebp - 0x3a4]
push 0x26
push eax
call fcn.0048af80
pop ecx
pop ecx
mov ecx, eax
mov byte [ebp - 4], 0xd
call fcn.0048cf6b
push eax
lea ecx, [ebp - 0x278]
call fcn.00411c5a
lea ecx, [ebp - 0x3a4]
mov byte [ebp - 4], 0xc
call fcn.00401b80
push str.Common_Files_
lea ecx, [ebp - 0x278]
call fcn.0047fa54
push 0
lea eax, [ebp - 0x278]
push eax
mov ecx, esi
mov dword [esi], 0x4b7b38
mov dword [esi + 0x28], 0x4b7b40
call fcn.0041122d
lea ecx, [ebp - 0x278]
call fcn.00401b80
jmp 0x48b5e5
lea eax, [ebp - 0x278]
push 0
push eax
call fcn.0048cae7
pop ecx
pop ecx
lea ecx, [ebp - 0x278]
mov byte [ebp - 4], 0xe
call fcn.0048ce54
lea ecx, [ebp - 0x278]
call fcn.0048c6dc
test al, al
je 0x48b2b7
lea eax, [ebp - 0x560]
push eax
lea ecx, [ebp - 0x278]
call fcn.0048c5ed
mov ecx, dword [ebp - 0x61c]
or ecx, 8
cmp dword [eax + 0x14], 0
je 0x48b2bd
xor bl, bl
jmp 0x48b2bd
mov ecx, dword [ebp - 0x61c]
test cl, 8
je 0x48b2cd
lea ecx, [ebp - 0x560]
call fcn.00401b80
test bl, bl
je 0x48b237
lea eax, [ebp - 0x374]
push 0
push eax
call fcn.0047e759
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x278]
mov byte [ebp - 4], 0xf
call fcn.00411c5a
lea ecx, [ebp - 0x374]
mov byte [ebp - 4], 0xe
call fcn.00401b80
lea eax, [ebp - 0x4e8]
push eax
lea ecx, [ebp - 0x278]
call fcn.0048c5ed
push eax
lea ecx, [ebp - 0x278]
mov byte [ebp - 4], 0x10
call fcn.00411c5a
lea ecx, [ebp - 0x4e8]
mov byte [ebp - 4], 0xe
call fcn.00401b80
push str.Program_Files
jmp 0x48b22c
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jbe 0x48b377
lea eax, [ebp - 0x3d4]
push 0
push eax
call fcn.0047e759
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x248]
mov byte [ebp - 4], 7
call fcn.00411c5a
lea ecx, [ebp - 0x3d4]
jmp 0x48b419
lea eax, [ebp - 0x434]
push 5
push eax
call fcn.0048af80
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x248]
mov byte [ebp - 4], 8
call fcn.00411c5a
lea ecx, [ebp - 0x434]
mov byte [ebp - 4], bl
call fcn.00401b80
cmp dword [ebp - 0x234], 0
je 0x48b421
lea eax, [ebp - 0x4ac]
push eax
lea ecx, [ebp - 0x248]
call fcn.0048cf6b
mov ecx, eax
call fcn.0048c56a
push eax
lea ecx, [ebp - 0x248]
mov byte [ebp - 4], 9
call fcn.00411c5a
lea ecx, [ebp - 0x4ac]
mov byte [ebp - 4], bl
call fcn.00401b80
cmp edi, 0x23
jne 0x48b462
lea eax, [ebp - 0x524]
push eax
lea ecx, [ebp - 0x248]
call fcn.0048cf6b
mov ecx, eax
call fcn.0048c56a
push eax
lea ecx, [ebp - 0x248]
mov byte [ebp - 4], 0xa
call fcn.00411c5a
lea ecx, [ebp - 0x524]
mov byte [ebp - 4], bl
call fcn.00401b80
cmp edi, 0x23
jne 0x48b462
push ebx
lea eax, [ebp - 0x616]
push eax
push str.All_Users_
lea ecx, [ebp - 0x314]
call fcn.00428274
lea eax, [ebp - 0x314]
push eax
lea ecx, [ebp - 0x248]
mov byte [ebp - 4], 0xb
call fcn.0048b87f
lea ecx, [ebp - 0x314]
mov byte [ebp - 4], bl
call fcn.00401b80
push str.Application_Data_
jmp 0x48b5bd
lea eax, [ebp - 0x278]
push ebx
push eax
call fcn.0047e759
pop ecx
pop ecx
push ebx
lea eax, [ebp - 0x616]
push eax
push str.Fonts
lea ecx, [ebp - 0x344]
mov byte [ebp - 4], 0x11
call fcn.00428274
lea eax, [ebp - 0x344]
push eax
lea ecx, [ebp - 0x278]
mov byte [ebp - 4], 0x12
call fcn.0048b87f
lea ecx, [ebp - 0x344]
mov byte [ebp - 4], 0x11
call fcn.00401b80
jmp 0x48b237
mov edi, dword [sym.imp.KERNEL32.dll_GetVersion]
call edi
cmp eax, 0x80000000
jbe 0x48b525
lea eax, [ebp - 0x404]
push 0
push eax
call fcn.0047e759
pop ecx
pop ecx
lea ecx, [ebp - 0x59c]
push ecx
mov ecx, eax
mov byte [ebp - 4], 2
call fcn.0048c5ed
push eax
lea ecx, [ebp - 0x248]
mov byte [ebp - 4], 3
call fcn.00411c5a
lea ecx, [ebp - 0x59c]
call fcn.00401b80
lea ecx, [ebp - 0x404]
mov byte [ebp - 4], bl
call fcn.00401b80
push str.My_Documents_
jmp 0x48b5bd
lea eax, [ebp - 0x2d8]
push 2
push eax
call fcn.0048af80
pop ecx
pop ecx
lea ecx, [ebp - 0x614]
push ecx
mov ecx, eax
mov byte [ebp - 4], 4
call fcn.0048cf6b
mov ecx, eax
call fcn.0048c56a
push eax
lea ecx, [ebp - 0x248]
mov byte [ebp - 4], 5
call fcn.00411c5a
lea ecx, [ebp - 0x614]
call fcn.00401b80
lea ecx, [ebp - 0x2d8]
mov byte [ebp - 4], bl
call fcn.00401b80
lea eax, [ebp - 0x5d8]
push eax
lea ecx, [ebp - 0x248]
call fcn.0048cf6b
mov ecx, eax
call fcn.0048c56a
push eax
lea ecx, [ebp - 0x248]
mov byte [ebp - 4], 6
call fcn.00411c5a
lea ecx, [ebp - 0x5d8]
mov byte [ebp - 4], bl
call fcn.00401b80
call edi
cmp al, 5
jae 0x48b51b
push str.Personal_
lea ecx, [ebp - 0x248]
call fcn.0047fa54
push 0
lea eax, [ebp - 0x248]
push eax
mov ecx, esi
mov dword [esi], 0x4b7b38
mov dword [esi + 0x28], 0x4b7b40
call fcn.0041122d
lea ecx, [ebp - 0x248]
call fcn.00401b80
lea ecx, [ebp - 0x2a8]
call fcn.00401b80
mov eax, esi
call fcn.004536f1
ret