Function at 0x524e70
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdd0
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x230], eax
mov dword [ebp - 0x22c], eax
mov dword [ebp - 0x228], eax
mov dword [ebp - 0x224], eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x52565a
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0xc], eax
mov dl, 1
mov eax, dword [0x422568]
call fcn.00427dc8
mov dword [ebp - 0x14], eax
mov edx, 0x52567c
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x5256d8
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x525734
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x525790
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x5257ec
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x525848
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x5258a4
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x525900
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x52595c
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x5259b8
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x525a14
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x525a70
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x525acc
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x525b28
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x525b84
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x525be0
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x525c3c
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x525c98
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x525cf4
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x525d50
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x525dac
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x525e08
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x525e64
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x525ec0
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x525f1c
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x525f78
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x525fd4
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x526030
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x52608c
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x5260e8
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x526144
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x5261a0
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x5261fc
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x526258
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x5262b4
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x526310
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x52636c
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x5263c8
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x526424
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x526480
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x5264dc
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x526538
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x526594
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x5265f0
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x52664c
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x5266a8
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x526704
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x526760
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x5267bc
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x526818
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x526874
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x5268d0
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x52692c
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x526988
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x5269e4
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x526a40
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x526a9c
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x526af8
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x526b54
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x526bb0
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x526c0c
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x526c68
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x526cc4
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x526d20
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x526d7c
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x526dd8
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x526e34
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x526e90
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x526eec
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x526f48
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x526fa4
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x527000
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x52705c
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x5270b8
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x527114
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x527170
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x5271cc
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x527228
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x527284
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x5272e0
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x52733c
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x527398
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x5273f4
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x527450
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x5274ac
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x527508
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x527564
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x5275c0
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x52761c
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x527678
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x5276d4
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x527730
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x52778c
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x5277e8
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x527844
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x5278a0
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x5278fc
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x527958
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x5279b4
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x527a10
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov dl, 1
mov eax, dword [0x442894]
call fcn.004429d0
mov dword [ebp - 0x10], eax
mov edx, 0x80000000
mov eax, dword [ebp - 0x10]
call fcn.00442a70
xor ecx, ecx
mov edx, 0x527a6c
mov eax, dword [ebp - 0x10]
call fcn.00442bb0
test al, al
je 0x5254b3
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x14]
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x525446
inc ebx
xor esi, esi
lea ecx, [ebp - 0x224]
mov edx, esi
mov eax, dword [ebp - 0x14]
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0x224]
mov eax, dword [ebp - 0x10]
call fcn.004430f0
test al, al
je 0x525442
mov dword [ebp - 0xc], 1
jmp 0x525446
inc esi
dec ebx
jne 0x525417
cmp dword [ebp - 0xc], 0
jne 0x5254ab
cmp dword [ebp + 8], 0
jne 0x5254ab
call fcn.00403468
mov eax, 0x64
call fcn.00403490
mov ebx, eax
cmp ebx, 0x63
jg 0x52546c
test ebx, ebx
jge 0x525471
mov ebx, 0x63
lea ecx, [ebp - 8]
mov edx, ebx
mov eax, dword [ebp - 0x14]
mov ebx, dword [eax]
call dword [ebx + 0xc]
xor eax, eax
push ebp
push 0x5254a1
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
call fcn.00442ad4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5254ab
mov eax, dword [ebp - 0x10]
call fcn.00442a40
mov eax, dword [ebp - 0x10]
call fcn.00403ddc
mov eax, dword [ebp - 0x14]
call fcn.00403ddc
cmp dword [ebp - 0xc], 0
jne 0x52562f
push 0
push 0x23
lea eax, [ebp - 0x21e]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderPathW
lea eax, [ebp - 4]
lea edx, [ebp - 0x21e]
mov ecx, 0x105
call fcn.00405fc8
lea edx, [ebp - 0x228]
mov eax, dword [ebp - 4]
call fcn.0041513c
mov edx, dword [ebp - 0x228]
lea eax, [ebp - 4]
mov ecx, 0x527284
call fcn.0040629c
mov eax, dword [ebp - 4]
call fcn.004facf4
test al, al
jne 0x525549
xor eax, eax
push ebp
push 0x52553f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0040cfc4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x525549
lea edx, [ebp - 0x22c]
mov eax, dword [ebp - 4]
call fcn.0041513c
mov edx, dword [ebp - 0x22c]
lea eax, [ebp - 4]
mov ecx, 0x527a84
call fcn.0040629c
mov dl, 1
mov eax, dword [0x43c8f4]
call fcn.0043c9b8
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.0040cf58
test al, al
je 0x525598
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.0040d0ec
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.0043d1e4
push 0
lea eax, [ebp - 0x230]
push eax
mov ecx, 0x527aa8
mov edx, 0x527ad0
mov eax, ebx
mov esi, dword [eax]
call dword [esi]
mov eax, dword [ebp - 0x230]
mov edx, 0x527afc
call fcn.0040be68
test eax, eax
jne 0x5255ce
mov dword [ebp - 0xc], 1
jmp 0x525616
cmp dword [ebp + 8], 0
jne 0x525616
xor eax, eax
push ebp
push 0x52560c
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x527afc
mov ecx, 0x527aa8
mov edx, 0x527ad0
mov eax, ebx
mov esi, dword [eax]
call dword [esi + 4]
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.0043d364
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x525616
mov eax, dword [ebp - 4]
call fcn.0040cf58
test al, al
je 0x52562f
mov edx, 7
mov eax, dword [ebp - 4]
call fcn.0040d0ec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x525661
lea eax, [ebp - 0x230]
mov edx, 4
call fcn.00405dd8
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405dd8
ret