Function at 0x4408bd
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov esi, ecx
push str.shell32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0
push 0x10
mov edi, dword [sym.imp.USER32.dll_LoadImageW]
pop ebx
push ebx
push ebx
push 1
push 0x2c
push eax
mov dword [ebp - 8], eax
call edi
and dword [ebp - 4], 0
push 0
push ebx
push ebx
push 1
push 0x99
push dword [ebp - 8]
mov dword [esi + 0x4990], eax
call edi
push 0x800b
push eax
mov ecx, esi
mov dword [ebp - 4], eax
call fcn.004403b1
push 0xb31f
mov ecx, esi
push dword [ebp - 4]
call fcn.004403b1
push 0x8049
mov ecx, esi
push dword [ebp - 4]
call fcn.004403b1
push 0
push ebx
push ebx
push 1
push 0x4179
push dword [ebp - 8]
call edi
push 0xe103
push eax
mov ecx, esi
mov dword [ebp - 4], eax
call fcn.004403b1
push 0
push ebx
push ebx
push 1
push 5
push dword [ebp - 8]
call edi
push 0xe101
push eax
mov ecx, esi
mov dword [ebp - 4], eax
call fcn.004403b1
push 0
push ebx
push ebx
push 1
push 0x23
push dword [ebp - 8]
call edi
push 0
push ebx
push ebx
push 1
push 0x18
mov dword [esi + 0x49a4], eax
push dword [ebp - 8]
call edi
push 0
mov dword [esi + 0x4994], eax
push ebx
push ebx
push 1
push 0xe
push dword [ebp - 8]
call edi
push 0
push ebx
push ebx
push 1
push 0x109
mov dword [ebp - 0xc], eax
mov eax, dword [0x4b0550]
push dword [ebp - 8]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], eax
call edi
mov dword [ebp - 4], eax
mov eax, 0x400
push eax
push eax
lea ecx, [ebp - 0x10]
call fcn.00403c58
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
call fcn.00403cd2
xor ebx, ebx
cmp dword [ebp - 4], ebx
je 0x440a08
push 0x8031
mov ecx, esi
push dword [ebp - 4]
call fcn.004403b1
push 0x8032
mov ecx, esi
push dword [ebp - 4]
call fcn.004403b1
push ebx
push ecx
mov eax, esp
lea ecx, [ebp - 0x10]
push str.cmd.exe
push ecx
push eax
call fcn.0040a915
mov ecx, esi
call fcn.00440390
push 0xb335
push eax
mov ecx, esi
mov dword [ebp - 4], eax
call fcn.004403b1
lea eax, [ebp - 4]
push 1
push eax
lea eax, [ebp - 0x14]
push eax
push ebx
push str.powershell.exe
mov dword [ebp - 0x14], ebx
call dword [sym.imp.SHELL32.dll_ExtractIconExW]
push 0xbd78
mov ecx, esi
push dword [ebp - 4]
call fcn.004403b1
mov ebx, dword [sym.imp.USER32.dll_LoadIconW]
push 0x148
push dword [ebp - 8]
call ebx
push 0xb358
push eax
mov ecx, esi
mov dword [ebp - 4], eax
call fcn.004403b1
push 0x1c
push dword [ebp - 8]
call ebx
push 0xb359
push eax
mov ecx, esi
mov dword [ebp - 4], eax
call fcn.004403b1
push 0x8a
push dword [ebp - 8]
call ebx
push 0xe107
push eax
mov ecx, esi
mov dword [ebp - 4], eax
call fcn.004403b1
push 0x416b
push dword [ebp - 8]
call ebx
push 0
push 0x32
mov dword [ebp - 4], eax
call dword [sym.imp.USER32.dll_GetSystemMetrics]
push eax
push 0x31
call dword [sym.imp.USER32.dll_GetSystemMetrics]
push eax
push 1
push 0x416b
push dword [ebp - 8]
call edi
push 0xb360
mov ecx, esi
push dword [ebp - 4]
mov dword [0x4c4268], eax
call fcn.004403b1
push 0x800c
mov ecx, esi
push dword [ebp - 0xc]
call fcn.004403b1
push 0x800f
mov ecx, esi
push dword [ebp - 0xc]
call fcn.004403b1
push 0x852c
mov ecx, esi
push dword [ebp - 0xc]
call fcn.004403b1
push 0x8593
mov ecx, esi
push dword [ebp - 0xc]
call fcn.004403b1
push 0x800d
mov ecx, esi
push dword [ebp - 0xc]
call fcn.004403b1
push 0
push 0x32
call dword [sym.imp.USER32.dll_GetSystemMetrics]
push eax
push 0x31
call dword [sym.imp.USER32.dll_GetSystemMetrics]
push eax
push 1
push 0x14c
push dword [0x4c7b64]
call edi
push 0x808f
push eax
mov ecx, esi
call fcn.004403b1
push 0x851b
mov ecx, esi
push dword [ebp - 0xc]
call fcn.004403b1
push 0x800e
mov ecx, esi
push dword [ebp - 0xc]
call fcn.004403b1
push 0x17
call fcn.004977e7
mov dword [esp], 0xe124
push eax
mov ecx, esi
call fcn.004403b1
push 0x80
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call ebx
push 0xe140
push eax
mov ecx, esi
mov dword [esi + 0x1ec], eax
call fcn.004403b1
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0xc]
lea ecx, [ebp - 0x10]
call fcn.004038fb
lea ecx, [ebp - 0x18]
call fcn.004038fb
pop edi
pop esi
pop ebx
leave
ret 4