Function at 0x403ec0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x318
mov eax, dword [0x4c32cc]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x104
push str.IECookieFolder
push str.SoftwareBillP_StudiosWinPatrol
lea ecx, [ebp - 0x110]
mov edx, 0x80000001
call fcn.0048e050
add esp, 0xc
test eax, eax
je 0x403f76
lea edi, [ebp - 0x110]
call fcn.004049c0
test eax, eax
je 0x403f76
cmp eax, 2
jne 0x403f49
mov edx, 0x104
mov eax, edi
cmp byte [eax], 0
je 0x403f21
inc eax
dec edx
jne 0x403f16
jmp 0x403f49
test edx, edx
je 0x403f49
mov ecx, 0x104
sub ecx, edx
mov eax, 0x104
sub eax, ecx
push 0x4b17dc
lea ecx, [ebp + ecx - 0x110]
mov edx, 0x7fffffff
call fcn.00401000
lea eax, [ebp - 0x110]
push eax
mov edx, 0x7ffffffe
mov eax, 0x104
mov ecx, ebx
call fcn.00401000
mov eax, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a01d6
mov esp, ebp
pop ebp
ret
mov edx, dword [0x4c78c4]
push 0
push 0x21
lea ecx, [ebp - 0x110]
push ecx
push edx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea edi, [ebp - 0x110]
call fcn.004049c0
test eax, eax
je 0x403fbf
cmp eax, 2
jne 0x403f49
mov edx, 0x104
mov eax, edi
lea esp, [esp]
cmp byte [eax], 0
je 0x403f21
inc eax
dec edx
jne 0x403fb0
jmp 0x403f49
push str.SoftwareMicrosoftWindowsCurrentVersionExplorer
mov edx, 0x7ffffffe
mov eax, 0xff
lea ecx, [ebp - 0x210]
call fcn.00401000
mov edx, 0xff
lea eax, [ebp - 0x210]
cmp byte [eax], 0
je 0x403fef
inc eax
dec edx
jne 0x403fe4
jmp 0x404017
test edx, edx
je 0x404017
mov ecx, 0xff
sub ecx, edx
mov eax, 0xff
sub eax, ecx
push str.Shell_Folders
lea ecx, [ebp + ecx - 0x210]
mov edx, 0x7fffffff
call fcn.00401000
push 0x104
lea ecx, [ebp - 0x210]
push 0x4b1bb4
push ecx
lea ecx, [ebp - 0x110]
mov edx, 0x80000001
call fcn.0048e050
add esp, 0xc
test eax, eax
je 0x4040f9
lea edx, [ebp - 0x110]
push edx
mov edx, 0x7ffffffe
mov eax, 0xff
lea ecx, [ebp - 0x318]
call fcn.00401000
lea edi, [ebp - 0x318]
call fcn.004049c0
mov esi, eax
test esi, esi
je 0x40408a
mov eax, edi
push eax
mov edx, 0x7ffffffe
mov eax, 0xff
lea ecx, [ebp - 0x110]
call fcn.00401000
jmp 0x404097
lea edi, [ebp - 0x110]
call fcn.004049c0
mov esi, eax
test esi, esi
je 0x4040f9
cmp esi, 2
jne 0x4040ed
mov edx, 0x104
lea eax, [ebp - 0x110]
jmp 0x4040b0
cmp byte [eax], 0
je 0x4040c5
inc eax
dec edx
jne 0x4040b0
lea ecx, [ebp - 0x110]
push ecx
jmp 0x403f50
test edx, edx
je 0x4040ed
mov ecx, 0x104
sub ecx, edx
mov eax, 0x104
sub eax, ecx
push 0x4b17dc
lea ecx, [ebp + ecx - 0x110]
mov edx, 0x7fffffff
call fcn.00401000
lea ecx, [ebp - 0x110]
push ecx
jmp 0x403f50
push str.SoftwareMicrosoftWindowsCurrentVersionExplorer
mov edx, 0x7ffffffe
mov eax, 0xff
lea ecx, [ebp - 0x210]
call fcn.00401000
mov eax, 0xff
lea ecx, [ebp - 0x210]
mov edi, edi
cmp byte [ecx], 0
je 0x40412b
inc ecx
dec eax
jne 0x404120
jmp 0x404153
test eax, eax
je 0x404153
mov ecx, 0xff
sub ecx, eax
mov eax, 0xff
sub eax, ecx
push str.Shell_Folders
lea ecx, [ebp + ecx - 0x210]
mov edx, 0x7fffffff
call fcn.00401000
push 0x104
lea edx, [ebp - 0x210]
push 0x4b1bb4
push edx
lea ecx, [ebp - 0x110]
mov edx, 0x80000001
call fcn.0048e050
add esp, 0xc
test eax, eax
je 0x40426e
lea eax, [ebp - 0x110]
push eax
mov edx, 0x7ffffffe
mov eax, 0xff
lea ecx, [ebp - 0x318]
call fcn.00401000
mov edx, 0xff
lea eax, [ebp - 0x318]
cmp byte [eax], 0
je 0x4041b1
inc eax
dec edx
jne 0x4041a6
jmp 0x4041d9
test edx, edx
je 0x4041d9
mov ecx, 0xff
sub ecx, edx
mov eax, 0xff
sub eax, ecx
push str.low
lea ecx, [ebp + ecx - 0x318]
mov edx, 0x7fffffff
call fcn.00401000
lea edi, [ebp - 0x318]
call fcn.004049c0
mov esi, eax
test esi, esi
je 0x404204
mov ecx, edi
push ecx
mov edx, 0x7ffffffe
mov eax, 0xff
lea ecx, [ebp - 0x110]
call fcn.00401000
jmp 0x404211
lea edi, [ebp - 0x110]
call fcn.004049c0
mov esi, eax
test esi, esi
je 0x40426e
cmp esi, 2
jne 0x404262
mov edx, 0x104
lea eax, [ebp - 0x110]
cmp byte [eax], 0
je 0x40423a
inc eax
dec edx
jne 0x404225
lea edx, [ebp - 0x110]
push edx
jmp 0x403f50
test edx, edx
je 0x404262
mov ecx, 0x104
sub ecx, edx
mov eax, 0x104
sub eax, ecx
push 0x4b17dc
lea ecx, [ebp + ecx - 0x110]
mov edx, 0x7fffffff
call fcn.00401000
lea edx, [ebp - 0x110]
push edx
jmp 0x403f50
push str.SoftwareMicrosoftWindowsCurrentVersionExplorer
mov edx, 0x7ffffffe
mov eax, 0xff
lea ecx, [ebp - 0x210]
call fcn.00401000
mov edx, 0xff
lea eax, [ebp - 0x210]
cmp byte [eax], 0
je 0x40429e
inc eax
dec edx
jne 0x404293
jmp 0x4042c6
test edx, edx
je 0x4042c6
mov ecx, 0xff
sub ecx, edx
mov eax, 0xff
sub eax, ecx
push str.User_Shell_Folders
lea ecx, [ebp + ecx - 0x210]
mov edx, 0x7fffffff
call fcn.00401000
push 0x104
lea eax, [ebp - 0x210]
push 0x4b1bb4
push eax
lea ecx, [ebp - 0x110]
mov edx, 0x80000001
call fcn.0048e050
add esp, 0xc
test eax, eax
je 0x404329
lea edi, [ebp - 0x110]
call fcn.004049c0
test eax, eax
je 0x404329
cmp eax, 2
jne 0x4040ed
mov edx, 0x104
mov eax, edi
lea ecx, [ecx]
cmp byte [eax], 0
je 0x4040c5
inc eax
dec edx
jne 0x404310
lea ecx, [ebp - 0x110]
push ecx
jmp 0x403f50
push 0x104
lea edx, [ebp - 0x110]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov edx, 0x104
lea eax, [ebp - 0x110]
cmp byte [eax], 0
je 0x404351
inc eax
dec edx
jne 0x404346
jmp 0x404379
test edx, edx
je 0x404379
mov ecx, 0x104
sub ecx, edx
mov eax, 0x104
sub eax, ecx
push str.Cookies
lea ecx, [ebp + ecx - 0x110]
mov edx, 0x7fffffff
call fcn.00401000
lea edi, [ebp - 0x110]
call fcn.004049c0
test eax, eax
je 0x4043b2
cmp eax, 2
jne 0x403f49
mov edx, 0x104
mov eax, edi
jmp 0x4043a0
cmp byte [eax], 0
je 0x403f21
inc eax
dec edx
jne 0x4043a0
jmp 0x403f49
push 0x104
lea edx, [ebp - 0x110]
mov ecx, 0x3c8
call fcn.00499890
add esp, 4
lea ecx, [ebp - 0x110]
push ecx
mov edx, 0x7ffffffe
mov eax, 0x104
mov ecx, ebx
call fcn.00401000
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
xor eax, eax
pop esi
call fcn.004a01d6
mov esp, ebp
pop ebp
ret