Function at 0x414c84
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x448010]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push str.ProgramFiles64Folder
mov byte [ebp - 0x219], dl
mov edi, ecx
call fcn.0040a0e8
test eax, eax
jne 0x414d0f
mov ecx, dword [edi]
sub ecx, 0x10
call fcn.0040ab13
add eax, 0x10
lea ecx, [ebp - 0x220]
push str.ProgramW6432
mov dword [ebp - 0x220], eax
call fcn.0040b951
test eax, eax
je 0x414d01
lea eax, [ebp - 0x220]
mov ecx, edi
push eax
call fcn.00409e7f
mov ecx, edi
call fcn.0040ab6c
mov ecx, dword [ebp - 0x220]
lea ecx, [ecx - 0x10]
call fcn.004052ff
mov al, 1
jmp 0x414fe0
mov ecx, dword [ebp - 0x220]
lea ecx, [ecx - 0x10]
call fcn.004052ff
push str.SystemFolder
lea ecx, [ebp - 0x218]
mov byte [ebp - 0x211], 1
call fcn.00404f61
mov ecx, edi
push dword [eax]
call fcn.0040a0e8
mov ecx, dword [ebp - 0x218]
mov ebx, eax
neg ebx
sbb bl, bl
add ecx, 0xfffffff0
call fcn.004052ff
add bl, 1
je 0x414d8a
xor ebx, ebx
lea eax, [ebp - 0x210]
cmp byte [ebp - 0x219], bl
push eax
push ebx
push ebx
push 0x29
pop eax
push 0x25
pop ecx
cmovne eax, ecx
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea eax, [ebp - 0x210]
mov ecx, edi
push eax
call fcn.00404f39
mov ecx, edi
call fcn.0040ab6c
mov al, byte [ebp - 0x211]
jmp 0x414fe0
push str.System32Folder
lea ecx, [ebp - 0x218]
call fcn.00404f61
mov ecx, edi
push dword [eax]
call fcn.0040a0e8
mov ecx, dword [ebp - 0x218]
mov ebx, eax
neg ebx
sbb bl, bl
add ecx, 0xfffffff0
call fcn.004052ff
add bl, 1
je 0x414dd0
push 0x104
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
jmp 0x414e14
push str.WindowsFolder
lea ecx, [ebp - 0x218]
call fcn.00404f61
mov ecx, edi
push dword [eax]
call fcn.0040a0e8
mov ecx, dword [ebp - 0x218]
mov ebx, eax
neg ebx
sbb bl, bl
add ecx, 0xfffffff0
call fcn.004052ff
add bl, 1
je 0x414e28
push 0x104
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push 0x5c
pop ecx
mov word [ebp + eax*2 - 0x210], cx
lea eax, [eax*2 + 2]
jmp 0x414e9b
push str.WindowsVolume
lea ecx, [ebp - 0x218]
call fcn.00404f61
mov ecx, edi
push dword [eax]
call fcn.0040a0e8
mov ecx, dword [ebp - 0x218]
mov ebx, eax
neg ebx
sbb bl, bl
add ecx, 0xfffffff0
call fcn.004052ff
add bl, 1
je 0x414e77
push 0x104
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
xor eax, eax
mov word [ebp - 0x20a], ax
jmp 0x414eb0
push str.TempFolder
mov ecx, edi
call fcn.0040a0e8
test eax, eax
jne 0x414ec3
lea eax, [ebp - 0x210]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
add eax, eax
cmp eax, 0x208
jae 0x414ff1
xor ecx, ecx
mov word [ebp + eax - 0x210], cx
lea eax, [ebp - 0x210]
mov ecx, edi
push eax
call fcn.00404f39
jmp 0x414d7f
push str.SETUPEXEDIR
mov ecx, edi
call fcn.0040a0e8
xor ebx, ebx
test eax, eax
jne 0x414f45
mov eax, dword [0x449ac8]
mov esi, 0x449ac8
cmp dword [eax - 0xc], ebx
jne 0x414f38
push 0x104
lea eax, [ebp - 0x210]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
sub eax, 1
je 0x414f0e
push 0x5c
pop ecx
cmp word [ebp + eax*2 - 0x210], cx
je 0x414f0e
sub eax, 1
jne 0x414eff
lea eax, [eax*2 + 2]
cmp eax, 0x208
jae 0x414ff1
xor ecx, ecx
mov word [ebp + eax - 0x210], cx
lea eax, [ebp - 0x210]
push eax
mov ecx, esi
call fcn.00404f39
push esi
mov ecx, edi
call fcn.00409e7f
jmp 0x414d7f
mov esi, ebx
push dword [esi*4 + 0x443448]
mov ecx, edi
call fcn.0040a0e8
test eax, eax
je 0x414f5f
inc esi
cmp esi, 0xe
jb 0x414f47
cmp esi, 0xe
jae 0x414fde
lea eax, [ebp - 0x218]
push eax
push dword [esi*4 + 0x443410]
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
je 0x414f9c
mov ecx, dword [esi*4 + 0x443410]
mov edx, edi
call fcn.00414ff9
test al, al
jne 0x414d7f
mov ecx, edi
call fcn.004150fa
jmp 0x414fe0
lea eax, [ebp - 0x210]
push eax
push dword [ebp - 0x218]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
mov esi, eax
mov dword [ebp - 0x220], ebx
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
mov ecx, dword [ebp - 0x220]
push dword [ebp - 0x218]
push ecx
mov edx, dword [ecx]
call dword [edx + 0x14]
test esi, esi
jne 0x414d6a
mov al, bl
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004246ea
mov esp, ebp
pop ebp
ret
call fcn.00424ce7
int3