Function at 0x455f32
Capabilities:
Get common file path

Disassembly:
push 0x2e4
mov eax, 0x619bdd
call fcn.00429e48
mov dword [ebp - 0x2d8], ecx
mov ebx, dword [ebp + 8]
xor edi, edi
call fcn.00455052
cmp dword [ebx + 0x10], edi
je 0x45637e
push str.Uninstall
lea ecx, [ebp - 0x2b4]
call fcn.00411838
lea eax, [ebp - 0x2d4]
mov dword [ebp - 4], edi
push eax
push edi
push edi
push 0x689f84
mov dword [ebp - 0x2d4], edi
call sub.SHELL32.dll_SHGetKnownFolderPath
mov esi, eax
test esi, esi
js 0x45605b
push dword [ebp - 0x2d4]
lea ecx, [ebp - 0x2f0]
call fcn.00411838
push 0x647c3c
mov ecx, eax
mov byte [ebp - 4], 1
call fcn.00411a7f
push eax
lea ecx, [ebp - 0x2cc]
call fcn.004137ee
lea ecx, [ebp - 0x2f0]
mov byte [ebp - 4], 3
call fcn.0041395f
push ebx
lea ecx, [ebp - 0x284]
call fcn.00411873
push edi
push dword [ebp - 0x2d4]
lea ecx, [ebp - 0x284]
mov byte [ebp - 4], 4
call fcn.004573ff
push dword [ebp - 0x2d4]
mov edi, eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
cmp edi, 0xffffffff
je 0x45601a
mov ecx, dword [ebp - 0x2bc]
push 0x68d3dc
inc ecx
push ecx
push edi
lea ecx, [ebp - 0x284]
call 0x457498
cmp dword [ebp - 0x270], 8
lea eax, [ebp - 0x284]
push dword [ebp - 0x274]
cmovae eax, dword [ebp - 0x284]
lea ecx, [ebp - 0x2b4]
push eax
call fcn.00411b20
lea ecx, [ebp - 0x284]
call fcn.0041395f
lea ecx, [ebp - 0x2cc]
call fcn.0041395f
jmp 0x45611e
push 0x4e
lea eax, [ebp - 0x60]
push edi
push eax
call fcn.0042af50
xor eax, eax
lea edi, [ebp - 0x27c]
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x27c]
push eax
call dword [sym.imp.ole32.dll_CoCreateGuid]
mov esi, eax
test esi, esi
js 0x45610f
movzx eax, byte [ebp - 0x26d]
push eax
movzx eax, byte [ebp - 0x26e]
push eax
movzx eax, byte [ebp - 0x26f]
push eax
movzx eax, byte [ebp - 0x270]
push eax
movzx eax, byte [ebp - 0x271]
push eax
movzx eax, byte [ebp - 0x272]
push eax
movzx eax, byte [ebp - 0x273]
push eax
movzx eax, byte [ebp - 0x274]
push eax
movzx eax, word [ebp - 0x276]
push eax
movzx eax, word [ebp - 0x278]
push eax
push dword [ebp - 0x27c]
lea eax, [ebp - 0x60]
push str._08X_04X_04X_02X_02X_02X_02X_02X_02X_02X_02X
push 0x27
push eax
call fcn.00413897
add esp, 0x38
test eax, eax
jns 0x45610f
push eax
push str.ScheduleDirectoryRemovalOnNextLogon_StringCchPrintf___failed._hr0x_08X
push 0x64789c
push 1
call fcn.0044f68f
add esp, 0x10
lea eax, [ebp - 0x60]
push eax
lea ecx, [ebp - 0x2b4]
call fcn.00411a7f
xor edi, edi
xor ecx, ecx
push 7
pop eax
mov dword [ebp - 0x29c], edi
mov dword [ebp - 0x28c], edi
mov dword [ebp - 0x288], eax
mov word [ebp - 0x29c], cx
mov byte [ebp - 4], 5
test esi, esi
js 0x456302
push 0x208
lea eax, [ebp - 0x268]
push edi
push eax
call fcn.0042af50
add esp, 0xc
lea eax, [ebp - 0x268]
push eax
push edi
push edi
push 0x25
push edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov esi, eax
test esi, esi
js 0x4562fc
push edi
push str.cmd.exe
push 0x104
lea eax, [ebp - 0x268]
push eax
call fcn.004183ac
mov esi, eax
mov dword [ebp - 0x26c], esi
test esi, esi
js 0x4562fc
lea eax, [ebp - 0x268]
push eax
lea ecx, [ebp - 0x29c]
call fcn.00411a05
push str.__q__c_rmdir__s__q__
lea ecx, [ebp - 0x29c]
call fcn.00411a7f
cmp dword [ebx + 0x14], 8
mov eax, ebx
jb 0x4561ce
mov eax, dword [ebx]
push eax
lea ecx, [ebp - 0x29c]
call fcn.00411a7f
push 0x68f9c8
lea ecx, [ebp - 0x29c]
call fcn.00411a7f
cmp dword [ebx + 0x18], edi
je 0x4562fc
cmp dword [ebx + 0x14], 8
mov edi, dword [0x6cecac]
mov eax, dword [edi]
mov ecx, dword [eax + 8]
mov eax, ebx
mov dword [ebp - 0x2d0], ecx
jb 0x45620e
mov eax, dword [ebx]
push eax
call dword [0x63a7a0]
mov ecx, edi
call dword [ebp - 0x2d0]
test eax, eax
je 0x4562fc
cmp dword [ebx + 0x14], 8
mov esi, dword [0x6cecac]
mov eax, dword [esi]
mov edi, dword [eax + 0xc]
mov eax, ebx
jb 0x45623a
mov eax, dword [ebx]
push eax
mov ecx, edi
call dword [0x63a7a0]
mov ecx, esi
call edi
test eax, eax
jne 0x456275
cmp dword [ebx + 0x14], 8
mov esi, dword [0x6cecac]
mov eax, dword [esi]
mov edi, dword [eax + 0xc]
mov eax, ebx
jb 0x456260
mov eax, dword [ebx]
push eax
mov ecx, edi
call dword [0x63a7a0]
mov ecx, esi
call edi
test eax, eax
je 0x45637e
mov edi, dword [0x6cecac]
lea ecx, [ebp - 0x29c]
cmp dword [ebp - 0x288], 8
cmovae ecx, dword [ebp - 0x29c]
mov eax, dword [edi]
cmp dword [ebp - 0x2a0], 8
mov esi, dword [eax + 4]
mov eax, dword [ebp - 0x28c]
lea edx, [eax + eax]
push edx
push ecx
push 1
lea eax, [ebp - 0x2b4]
mov ecx, esi
cmovae eax, dword [ebp - 0x2b4]
push eax
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnce
push dword [ebx + 0x18]
call dword [0x63a7a0]
mov ecx, edi
call esi
test eax, eax
je 0x4562e2
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
js 0x4562fc
jmp 0x4562e8
mov esi, dword [ebp - 0x26c]
cmp dword [ebx + 0x14], 8
jb 0x4562f0
mov ebx, dword [ebx]
mov ecx, dword [ebp - 0x2d8]
push ebx
call fcn.0045321e
mov eax, dword [ebp - 0x288]
cmp eax, 8
jb 0x45634f
mov ecx, dword [ebp - 0x29c]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x26c], eax
mov dword [ebp - 0x2d0], ecx
cmp eax, 0x1000
jb 0x456346
lea eax, [ebp - 0x26c]
push eax
lea eax, [ebp - 0x2d0]
push eax
call fcn.00413aba
mov eax, dword [ebp - 0x26c]
mov ecx, dword [ebp - 0x2d0]
push eax
push ecx
call fcn.00429b68
pop ecx
pop ecx
and dword [ebp - 0x28c], 0
lea ecx, [ebp - 0x2b4]
xor eax, eax
mov dword [ebp - 0x288], 7
mov word [ebp - 0x29c], ax
call fcn.0041395f
mov eax, esi
call fcn.00429df7
ret 4
push 0x80004005
call fcn.0041393f
int3