Function at 0x4a5d2d
Capabilities:
Get common file path
Get session user name

Disassembly:
push 0x3e4
mov eax, 0x7272cd
call fcn.0054dced
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x2e8], eax
xor ebx, ebx
push eax
mov dword [ebp - 4], ebx
call fcn.00421999
push ebx
lea ecx, [ebp - 0x288]
mov dword [ebp - 0x270], 7
call fcn.00401d0a
lea eax, [ebp - 0x2e4]
push eax
lea eax, [ebp - 0x218]
push eax
mov byte [ebp - 4], 1
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
lea ecx, [ebp - 0x288]
jne 0x4a5da3
push ebx
push 1
call fcn.00401f4f
push ebx
push 1
lea ecx, [ebp + 8]
call fcn.00407277
xor al, al
call fcn.0054dd70
ret
lea eax, [ebp - 0x218]
push eax
call fcn.0040184f
lea eax, [ebp - 0x3f0]
push eax
call fcn.00459a28
cmp dword [eax], 0x6a
pop ecx
lea esi, [ebp - 0x3f0]
sete byte [ebp - 0x2dd]
call fcn.00459ebd
lea eax, [ebp - 0x26c]
push eax
call fcn.00452832
cmp byte [ebp - 0x2dd], bl
mov byte [ebp - 4], 2
lea eax, [ebp - 0x218]
je 0x4a5e69
xor esi, esi
inc esi
push esi
push 0x1a
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jne 0x4a5e22
push ebx
push esi
lea ecx, [ebp - 0x26c]
call fcn.00401f4f
push ebx
push esi
lea ecx, [ebp - 0x288]
call fcn.00401f4f
push ebx
push esi
jmp 0x4a5d93
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x234]
push eax
call fcn.00452856
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x26c]
mov byte [ebp - 4], 3
call fcn.00401ebc
push ebx
push esi
lea ecx, [ebp - 0x234]
mov byte [ebp - 4], 2
call fcn.00401f4f
push 0x7c14dc
jmp 0x4a5ef4
push 1
push 0x28
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jne 0x4a5eb1
mov byte [ebp - 0x2dd], bl
push ebx
push 1
lea ecx, [ebp - 0x26c]
call fcn.00401f4f
push ebx
push 1
lea ecx, [ebp - 0x288]
call fcn.00401f4f
push ebx
push 1
lea ecx, [ebp + 8]
call fcn.00407277
mov al, byte [ebp - 0x2dd]
jmp 0x4a5d9d
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x234]
push eax
call fcn.00452856
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x26c]
mov byte [ebp - 4], 4
call fcn.00401ebc
push ebx
push 1
lea ecx, [ebp - 0x234]
mov byte [ebp - 4], 2
call fcn.00401f4f
push str.Cookies_
lea edi, [ebp - 0x26c]
call fcn.00452a47
lea eax, [ebp - 0x328]
push ebx
push eax
lea esi, [ebp - 0x288]
call fcn.0044e491
push eax
lea eax, [ebp - 0x37c]
push str.Cookie:
push eax
mov byte [ebp - 4], 5
call fcn.00424625
add esp, 0x14
push 0x7c1528
push eax
lea eax, [ebp - 0x360]
push eax
mov byte [ebp - 4], 6
call fcn.0040bba8
add esp, 0xc
lea ecx, [ebp + 8]
push ecx
push eax
lea eax, [ebp - 0x398]
push eax
mov byte [ebp - 4], 7
call fcn.00424550
add esp, 0xc
push 0x7b8170
push eax
lea eax, [ebp - 0x2dc]
push eax
mov byte [ebp - 4], 8
call fcn.0040bba8
add esp, 0xc
xor esi, esi
push ebx
inc esi
push esi
lea ecx, [ebp - 0x398]
call fcn.00407277
push ebx
push esi
lea ecx, [ebp - 0x360]
call fcn.00407277
push ebx
push esi
lea ecx, [ebp - 0x37c]
call fcn.00407277
push ebx
push esi
lea ecx, [ebp - 0x328]
mov byte [ebp - 4], 0xd
call fcn.00407277
push str.index.dat
mov eax, edi
push eax
lea eax, [ebp - 0x2c0]
push eax
mov dword [ebp - 0x2e4], ebx
call fcn.0040be01
add esp, 0xc
push ebx
lea ecx, [ebp - 0x250]
mov dword [ebp - 0x238], 0xf
call fcn.0040720e
lea eax, [ebp - 0x2a4]
mov byte [ebp - 4], 0xf
push eax
lea ecx, [ebp - 0x2c0]
call fcn.00452a80
lea ecx, [ebp - 0x2dc]
push ecx
push eax
lea eax, [ebp - 0x2e4]
push eax
lea edi, [ebp - 0x250]
mov byte [ebp - 4], 0x10
call fcn.004a644f
push ebx
push esi
lea ecx, [ebp - 0x2a4]
mov byte [ebp - 0x2de], al
call fcn.00401f4f
cmp byte [ebp - 0x2de], bl
je 0x4a60d1
lea eax, [ebp - 0x30c]
push ebx
push eax
call fcn.0044e742
pop ecx
pop ecx
mov edi, eax
lea eax, [ebp - 0x26c]
push eax
lea ecx, [ebp - 0x234]
mov byte [ebp - 4], 0x11
call fcn.00407bbe
push edi
lea eax, [ebp - 0x234]
push eax
lea eax, [ebp - 0x344]
push eax
mov byte [ebp - 4], 0x12
call fcn.0040b9a8
add esp, 0xc
lea ecx, [ebp - 0x2a4]
push ecx
mov ecx, eax
mov byte [ebp - 4], 0x13
call fcn.00452a80
mov ecx, dword [ebp - 0x2e8]
push 0xffffffffffffffff
push ebx
push eax
mov byte [ebp - 4], 0x14
call fcn.00401ebc
push ebx
push esi
lea ecx, [ebp - 0x2a4]
call fcn.00401f4f
push ebx
push esi
lea ecx, [ebp - 0x344]
call fcn.00401f4f
push ebx
push esi
lea ecx, [ebp - 0x234]
call fcn.00401f4f
push ebx
push esi
lea ecx, [ebp - 0x30c]
call fcn.00401f4f
push ebx
push esi
lea ecx, [ebp - 0x250]
call fcn.00407277
push ebx
push esi
lea ecx, [ebp - 0x2c0]
mov byte [ebp - 4], 0xd
call fcn.00401f4f
cmp byte [ebp - 0x2dd], bl
je 0x4a6304
push str.Lowindex.dat
lea eax, [ebp - 0x26c]
push eax
lea eax, [ebp - 0x2a4]
push eax
mov dword [ebp - 0x2e4], ebx
call fcn.0040be01
add esp, 0xc
push ebx
lea ecx, [ebp - 0x234]
mov dword [ebp - 0x21c], 0xf
call fcn.0040720e
lea eax, [ebp - 0x30c]
push eax
lea ecx, [ebp - 0x2a4]
mov byte [ebp - 4], 0x16
call fcn.00452a80
lea ecx, [ebp - 0x2dc]
push ecx
push eax
lea eax, [ebp - 0x2e4]
push eax
lea edi, [ebp - 0x234]
mov byte [ebp - 4], 0x17
call fcn.004a644f
push ebx
push esi
lea ecx, [ebp - 0x30c]
mov byte [ebp - 0x2de], al
mov byte [ebp - 4], 0x16
call fcn.00401f4f
cmp byte [ebp - 0x2de], bl
je 0x4a62ea
lea eax, [ebp - 0x328]
push ebx
push eax
call fcn.0044e742
pop ecx
pop ecx
mov edi, eax
lea eax, [ebp - 0x26c]
push eax
lea ecx, [ebp - 0x2c0]
mov byte [ebp - 4], 0x18
call fcn.00407bbe
push str.Low
lea eax, [ebp - 0x2c0]
push eax
lea eax, [ebp - 0x344]
push eax
mov byte [ebp - 4], 0x19
call fcn.0040be01
add esp, 0xc
push edi
push eax
lea eax, [ebp - 0x30c]
push eax
mov byte [ebp - 4], 0x1a
call fcn.0040b9a8
add esp, 0xc
lea ecx, [ebp - 0x250]
push ecx
mov ecx, eax
mov byte [ebp - 4], 0x1b
call fcn.00452a80
push ebx
push esi
lea ecx, [ebp - 0x30c]
call fcn.00401f4f
push ebx
push esi
lea ecx, [ebp - 0x344]
call fcn.00401f4f
push ebx
push esi
lea ecx, [ebp - 0x2c0]
call fcn.00401f4f
push ebx
push esi
lea ecx, [ebp - 0x328]
mov byte [ebp - 4], 0x20
call fcn.00401f4f
sub esp, 0x1c
mov eax, esp
mov dword [ebp - 0x2e4], esp
lea ecx, [ebp - 0x250]
push ecx
push eax
call fcn.00452842
call fcn.00455690
add esp, 0x1c
cmp al, bl
je 0x4a62dd
sub esp, 0x1c
mov eax, esp
mov dword [ebp - 0x2e4], esp
push dword [ebp - 0x2e8]
push eax
call fcn.00452842
call fcn.00455690
add esp, 0x1c
cmp al, bl
je 0x4a62c8
sub esp, 0x1c
mov eax, esp
mov dword [ebp - 0x2e4], esp
lea ecx, [ebp - 0x250]
push ecx
push eax
call fcn.00452842
call fcn.00455e26
mov dword [ebp - 0x2f0], eax
mov eax, esp
mov dword [ebp - 0x2e4], esp
push dword [ebp - 0x2e8]
mov edi, edx
push eax
call fcn.00452842
call fcn.00455e26
add esp, 0x1c
cmp edi, edx
jl 0x4a62dd
jg 0x4a62c8
cmp dword [ebp - 0x2f0], eax
jbe 0x4a62dd
mov ecx, dword [ebp - 0x2e8]
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x250]
push eax
call fcn.00401ebc
push ebx
push esi
lea ecx, [ebp - 0x250]
call fcn.00401f4f
push ebx
push esi
lea ecx, [ebp - 0x234]
call fcn.00407277
push ebx
push esi
lea ecx, [ebp - 0x2a4]
call fcn.00401f4f
mov eax, dword [ebp - 0x2e8]
cmp dword [eax + 0x14], ebx
push ebx
push esi
lea ecx, [ebp - 0x2dc]
setne byte [ebp - 0x2de]
call fcn.00407277
mov al, byte [ebp - 0x2de]
mov byte [ebp - 0x2dd], al
jmp 0x4a5e7f