Function at 0x47af60
Capabilities:
Get common file path

Disassembly:
sub esp, 0x20
push ebx
push ebp
push esi
push edi
mov ebx, ecx
push str.shell32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, dword [sym.imp.USER32.dll_LoadImageW]
push 0
push 0x10
push 0x10
mov ebp, eax
push 1
push 0x2c
push ebp
call esi
push 0
push 0x10
push 0x10
push 1
push 0x99
push ebp
mov dword [ebx + 0x4994], eax
mov dword [esp + 0x2c], 0
call esi
push 0x800b
push eax
mov ecx, ebx
mov dword [esp + 0x1c], eax
call fcn.0047a9c0
mov eax, dword [esp + 0x14]
push 0xb31f
push eax
mov ecx, ebx
call fcn.0047a9c0
mov ecx, dword [esp + 0x14]
push 0x8049
push ecx
mov ecx, ebx
call fcn.0047a9c0
push 0
push 0x10
push 0x10
push 1
push 0x4179
push ebp
call esi
push 0xe103
push eax
mov ecx, ebx
mov dword [esp + 0x1c], eax
call fcn.0047a9c0
push 0
push 0x10
push 0x10
push 1
push 5
push ebp
call esi
push 0xe101
push eax
mov ecx, ebx
mov dword [esp + 0x1c], eax
call fcn.0047a9c0
push 0
push 0x10
push 0x10
push 1
push 0x23
push ebp
call esi
push 0
push 0x10
push 0x10
push 1
push 0x18
push ebp
mov dword [ebx + 0x49a8], eax
call esi
mov dword [ebx + 0x4998], eax
push 0
push 0x10
push 0x10
push 1
push 0xe
push ebp
call esi
push 0
push 0x10
push 0x10
mov edi, eax
mov eax, dword [0x546560]
push 1
push 0x109
push ebp
mov dword [esp + 0x38], edi
mov dword [esp + 0x44], eax
mov dword [esp + 0x28], eax
call esi
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x14], eax
mov edx, 0x400
cmp dword [ecx - 0xc], 1
lea eax, [ecx - 0xc]
mov dword [esp + 0x1c], edx
mov dword [esp + 0x18], eax
jg 0x47b092
cmp dword [ecx - 4], edx
jge 0x47b106
mov ecx, dword [ecx - 8]
cmp ecx, edx
mov dword [esp + 0x24], ecx
jle 0x47b3fd
test ecx, ecx
mov dword [esp + 0x1c], ecx
jne 0x47b3fd
mov edi, dword [0x546560]
mov dword [esp + 0x10], edi
lea ecx, [ecx + ecx + 2]
lea esi, [eax + 0xc]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x24]
mov esi, dword [esp + 0x18]
mov dword [eax - 8], ecx
mov eax, dword [0x546564]
cmp esi, eax
je 0x47b0f8
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x47b0f8
push esi
call fcn.00531732
add esp, 4
mov ecx, dword [esp + 0x10]
mov edi, dword [esp + 0x20]
mov esi, dword [sym.imp.USER32.dll_LoadImageW]
push 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov ecx, dword [esp + 0x10]
mov edx, dword [ecx - 0xc]
lea eax, [ecx - 0xc]
cmp edx, 1
mov dword [esp + 0x18], eax
jle 0x47b195
mov edx, dword [0x546564]
add ecx, 0xfffffff4
cmp ecx, edx
je 0x47b15a
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x47b14d
mov edx, dword [esp + 0x10]
add edx, 0xfffffff4
push edx
call fcn.00531732
add esp, 4
mov eax, dword [0x546560]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x18]
mov ecx, dword [eax + 4]
push ecx
lea ecx, [esp + 0x14]
call fcn.00405530
test eax, eax
je 0x47b195
mov eax, dword [esp + 0x18]
mov edi, dword [esp + 0x10]
mov edx, dword [eax + 4]
lea esi, [eax + 0xc]
lea ecx, [edx + edx + 2]
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [esp + 0x20]
mov esi, dword [sym.imp.USER32.dll_LoadImageW]
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edx, dword [esp + 0x10]
mov dword [edx - 8], eax
mov ecx, dword [esp + 0x10]
mov word [ecx + eax*2], 0
mov eax, dword [esp + 0x14]
test eax, eax
je 0x47b1d7
push 0x8031
push eax
mov ecx, ebx
call fcn.0047a9c0
mov edx, dword [esp + 0x14]
push 0x8032
push edx
mov ecx, ebx
call fcn.0047a9c0
push 0
push ecx
mov eax, esp
lea ecx, [esp + 0x18]
push str.cmd.exe
push ecx
push eax
call fcn.00412f10
mov ecx, ebx
call fcn.0047a980
push 0xb335
push eax
mov ecx, ebx
mov dword [esp + 0x1c], eax
call fcn.0047a9c0
lea edx, [esp + 0x14]
push 1
lea eax, [esp + 0x2c]
push edx
push eax
push 0
push str.powershell.exe
mov dword [esp + 0x3c], 0
call dword [sym.imp.SHELL32.dll_ExtractIconExW]
mov ecx, dword [esp + 0x14]
push 0xbd78
push ecx
mov ecx, ebx
call fcn.0047a9c0
push 0x148
push ebp
call dword [sym.imp.USER32.dll_LoadIconW]
push 0xb358
push eax
mov ecx, ebx
mov dword [esp + 0x1c], eax
call fcn.0047a9c0
push 0x1c
push ebp
call dword [sym.imp.USER32.dll_LoadIconW]
push 0xb359
push eax
mov ecx, ebx
mov dword [esp + 0x1c], eax
call fcn.0047a9c0
push 0x8a
push ebp
call dword [sym.imp.USER32.dll_LoadIconW]
push 0xe107
push eax
mov ecx, ebx
mov dword [esp + 0x1c], eax
call fcn.0047a9c0
push 0x416b
push ebp
call dword [sym.imp.USER32.dll_LoadIconW]
push 0
push 0x32
mov dword [esp + 0x1c], eax
call dword [sym.imp.USER32.dll_GetSystemMetrics]
push eax
push 0x31
call dword [sym.imp.USER32.dll_GetSystemMetrics]
push eax
push 1
push 0x416b
push ebp
call esi
mov edx, dword [esp + 0x14]
push 0xb360
push edx
mov ecx, ebx
mov dword [0x55aac0], eax
call fcn.0047a9c0
push 0x800c
push edi
mov ecx, ebx
call fcn.0047a9c0
push 0x800f
push edi
mov ecx, ebx
call fcn.0047a9c0
push 0x852c
push edi
mov ecx, ebx
call fcn.0047a9c0
push 0x8593
push edi
mov ecx, ebx
call fcn.0047a9c0
push 0x800d
push edi
mov ecx, ebx
call fcn.0047a9c0
mov ebp, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0
push 0x32
call ebp
push eax
push 0x31
call ebp
push eax
mov eax, dword [0x55e3d4]
push 1
push 0x14c
push eax
call esi
push 0x808f
push eax
mov ecx, ebx
call fcn.0047a9c0
push 0x851b
push edi
mov ecx, ebx
call fcn.0047a9c0
push 0x800e
push edi
mov ecx, ebx
call fcn.0047a9c0
push 0x17
call fcn.005296d0
add esp, 4
mov ecx, ebx
push 0xe124
push eax
call fcn.0047a9c0
push 0x80
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.USER32.dll_LoadIconW]
push 0xe140
push eax
mov ecx, ebx
mov dword [ebx + 0x1f0], eax
call fcn.0047a9c0
mov edx, dword [ebx]
mov ecx, ebx
call dword [edx + 0xc]
mov eax, dword [esp + 0x10]
mov edx, dword [0x546564]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x47b3cb
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x47b3cb
mov edx, dword [esp + 0x10]
add edx, 0xfffffff4
push edx
call fcn.00531732
add esp, 4
mov eax, dword [esp + 0x2c]
mov edx, dword [0x546564]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x47b3f3
lea esi, [eax - 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x47b3f3
push esi
call fcn.00531732
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 4
mov edx, dword [esp + 0x1c]
lea eax, [edx + edx + 0xe]
push eax
call fcn.00531ba5
add esp, 4
test eax, eax
je 0x47b43d
mov ecx, dword [esp + 0x1c]
mov dword [eax], 1
lea edi, [eax + 0xc]
mov word [eax + ecx*2 + 0xc], 0
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x18]
mov dword [esp + 0x10], edi
jmp 0x47b0b7
xor ecx, ecx
jmp 0x47b106