Function at 0x422a10
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x474
push esi
push edi
cmp dword [ebp + 8], 0
jne 0x422a29
or eax, 0xffffffff
jmp 0x422d86
mov eax, dword [ebp + 8]
mov word [eax], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], str.Shell32.dll
mov dword [ebp - 0x264], str.shfolder.dll
mov dword [ebp - 0x220], str.SHGetSpecialFolderPathW
mov dword [ebp - 0x244], str.SHGetFolderPathW
mov ecx, 8
mov esi, str.C:My_Documents
lea edi, [ebp - 0x240]
rep movsd dword es:[edi], dword [esi]
mov ecx, 6
mov esi, str.My_Pictures
lea edi, [ebp - 0x260]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x422af2
mov edx, dword [ebp - 0x220]
push edx
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x422af2
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov edx, dword [ebp - 0x264]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x422af2
mov eax, dword [ebp - 0x244]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 4], eax
cmp dword [ebp - 0x10], 0
jne 0x422c1b
cmp dword [ebp - 4], 0
jne 0x422c1b
push 0x43a1f4
lea edx, [ebp - 0x21c]
push edx
call fcn.004182c8
add esp, 8
lea eax, [ebp - 0x46c]
push eax
call fcn.0042243d
add esp, 4
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x470], ecx
mov edx, dword [ebp - 0x470]
sub edx, 5
mov dword [ebp - 0x470], edx
cmp dword [ebp - 0x470], 0x22
ja case.0x422b5c.3
mov ecx, dword [ebp - 0x470]
xor eax, eax
mov al, byte [ecx + 0x422d9c]
jmp dword [eax*4 + 0x422d8c]
mov edx, dword [ebp + 8]
push edx
call fcn.0042243d
add esp, 4
mov dword [ebp - 8], 2
jmp 0x422c16
lea eax, [ebp - 0x240]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.004182c8
add esp, 8
cmp dword [ebp + 0x10], 0
je 0x422ba9
mov dword [ebp - 8], 1
mov edx, dword [ebp + 8]
push edx
call fcn.004225b5
add esp, 4
jmp 0x422bb0
mov dword [ebp - 8], 3
jmp 0x422c16
push 1
push 5
lea eax, [ebp - 0x21c]
push eax
call fcn.00422a10
add esp, 0xc
lea ecx, [ebp - 0x21c]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.004182c8
add esp, 8
lea eax, [ebp - 0x260]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.0041829e
add esp, 8
cmp dword [ebp + 0x10], 0
je 0x422c06
mov dword [ebp - 8], 1
mov edx, dword [ebp + 8]
push edx
call fcn.004225b5
add esp, 4
jmp 0x422c0d
mov dword [ebp - 8], 3
jmp 0x422c16
mov dword [ebp - 8], 0xffffffff
jmp 0x422d72
cmp dword [ebp - 0x10], 0
je 0x422c34
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
push 0
call dword [ebp - 0x10]
jmp 0x422c4e
cmp dword [ebp - 4], 0
je 0x422c4e
mov eax, dword [ebp + 8]
push eax
push 0
push 0
mov ecx, dword [ebp + 0xc]
or ch, 0x80
push ecx
push 0
call dword [ebp - 4]
cmp dword [ebp + 0xc], 0x23
jne 0x422c8f
mov edx, dword [ebp + 8]
xor eax, eax
mov ax, word [edx]
test eax, eax
jne 0x422c8f
cmp dword [ebp - 0x10], 0
je 0x422c77
mov ecx, dword [ebp + 0x10]
push ecx
push 0x1a
mov edx, dword [ebp + 8]
push edx
push 0
call dword [ebp - 0x10]
jmp 0x422c8f
cmp dword [ebp - 4], 0
je 0x422c8f
mov eax, dword [ebp + 8]
push eax
push 0
push 0
push 0x801a
push 0
call dword [ebp - 4]
mov ecx, dword [ebp + 8]
xor edx, edx
mov dx, word [ecx]
test edx, edx
jne 0x422d72
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x474], eax
mov ecx, dword [ebp - 0x474]
sub ecx, 0x1a
mov dword [ebp - 0x474], ecx
cmp dword [ebp - 0x474], 0xd
ja case.0x422cd2.3
mov eax, dword [ebp - 0x474]
xor edx, edx
mov dl, byte [eax + 0x422dcf]
jmp dword [edx*4 + 0x422dbf]
cmp dword [ebp + 0x10], 0
je 0x422d2d
push 1
push 5
lea ecx, [ebp - 0x21c]
push ecx
call fcn.00422a10
add esp, 0xc
lea edx, [ebp - 0x21c]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.004182c8
add esp, 8
lea ecx, [ebp - 0x260]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.0041829e
add esp, 8
mov eax, dword [ebp + 8]
push eax
call fcn.004225b5
add esp, 4
mov dword [ebp - 8], 1
jmp 0x422d34
mov dword [ebp - 8], 3
jmp 0x422d72
push 0x104
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push str.Application_Data
mov edx, dword [ebp + 8]
push edx
call fcn.0041829e
add esp, 8
jmp 0x422d72
push str.c:Program_Files
mov eax, dword [ebp + 8]
push eax
call fcn.004182c8
add esp, 8
jmp 0x422d72
mov dword [ebp - 8], 0xffffffff
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 8]
pop edi
pop esi
mov esp, ebp
pop ebp
ret