#554: If %ProgramFiles% resolves to C:\Program Files (x86), we should still yield C:\Program Files

Author: Rajiv Subrahmanyam

.gitignore

@@ -24,9 +24,14 @@ Thumbs.db
 # Ignore development files
 docs/book/src/_build/
 .idea/
+.project
+.pydevproject
 
 # Ignore Django secret_key
 web/web/secret_key.py
 
 # Ignore yara rules
 data/yara/index_*.yar
+
+# Ignore venv
+venv

analyzer/windows/lib/common/abstracts.py

@@ -39,7 +39,10 @@ def _enum_paths(self):
             if basedir == "SystemRoot":
                 yield os.path.join(os.getenv("SystemRoot"), *path[1:])
             elif basedir == "ProgramFiles":
-                yield os.path.join(os.getenv("ProgramFiles"), *path[1:])
+		program_files = os.getenv("ProgramFiles")
+                yield os.path.join(program_files, *path[1:])
+		if program_files.lower().endswith(' (x86)'):
+                    yield os.path.join(program_files[:-6], *path[1:])
                 if os.getenv("ProgramFiles(x86)"):
                     yield os.path.join(os.getenv("ProgramFiles(x86)"),
                                        *path[1:])