Function at 0x476870
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f7a20
mov eax, dword fs:[0]
push eax
sub esp, 0x234
mov eax, dword [0x53ba20]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x220], ebx
mov eax, dword [0x555284]
push 0x50f1a8
push 0x555794
mov dword [ebp - 0x230], eax
call fcn.004c9380
neg eax
push 0
sbb edi, edi
and edi, 2
add edi, 0x9f3f
mov dword [ebp - 0x22c], edi
call fcn.00452f40
add esp, 0xc
cmp eax, 0x4563
jb 0x476973
push 0x50f1c0
push 0x555794
call fcn.004c9380
add esp, 8
test eax, eax
jne 0x47690a
mov dword [ebp - 0x22c], 0x9f40
jmp 0x47691b
cmp edi, 0x9f41
jne 0x476973
call fcn.00477f30
test al, al
je 0x476973
call fcn.00447c40
push 0
push 0x50f1c0
mov ecx, eax
call fcn.00448f20
call fcn.00447d00
mov esi, eax
mov ecx, esi
call fcn.00445ea0
mov ecx, esi
mov dword [ebx + 0x94], eax
call fcn.00445e00
mov esi, dword [sym.imp.USER32.dll_GetSysColor]
push 0xd
mov dword [ebx + 0x98], eax
call esi
push 0xe
mov dword [ebx + 0x9c], eax
call esi
mov dword [ebx + 0xa0], eax
mov dword [ebx + 0xa4], 0x404040
call fcn.00448e60
test al, al
jne 0x476981
call fcn.0044be10
push dword [ebp - 0x228]
mov esi, dword [ebx + 4]
lea eax, [ebx + 0x2f4]
push eax
push 0x5384d8
push 0x536320
push 0x570400
call fcn.00445a30
add esp, 0x14
movzx eax, ax
lea ecx, [ebx + 0x2d4]
push 0
push eax
push 0
push 0
push 0x56000000
push 0
push 0x53634c
push esi
call fcn.0045ea40
push dword [ebp - 0x228]
and byte [ebx + 0x411], 0xfe
mov esi, dword [ebx + 0x2d8]
mov dword [ebx + 0x2c], eax
lea eax, [ebx + 0x37c]
push eax
push 0x538448
push 0x536320
push 0x570400
call fcn.00445a30
add esp, 0x14
movzx eax, ax
lea ecx, [ebx + 0x35c]
push 0
push eax
push 0
push 0
push 0x56000000
push 0
push 0x53634c
push esi
call fcn.0045ea40
mov edi, dword [sym.imp.KERNEL32.dll_MulDiv]
push 0x60
push dword [0x5408ec]
mov dword [ebp - 4], 0
push 0x10
call edi
push 0x60
push dword [0x5408ec]
mov esi, eax
push 0x10
call edi
push 3
push 3
push 0x21
push esi
push eax
call dword [sym.imp.COMCTL32.dll_ImageList_Create]
mov esi, eax
push 0
push 0x37
mov dword [ebp - 0x240], esi
call fcn.0043b070
mov ebx, dword [sym.imp.COMCTL32.dll_ImageList_ReplaceIcon]
add esp, 8
push eax
push 0xffffffffffffffff
push esi
call ebx
push 0x104
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x50f1d4
lea eax, [ebp - 0x218]
push 0x104
push eax
call fcn.004d6277
add esp, 0xc
lea eax, [ebp - 0x234]
mov dword [ebp - 0x234], 0
push eax
lea eax, [ebp - 0x218]
push eax
push dword [0x570404]
call dword [sym.imp.SHELL32.dll_ExtractAssociatedIconW]
push eax
push 0xffffffffffffffff
push esi
call ebx
push 0x60
push dword [0x5408ec]
push 0x10
call edi
push 0x60
push dword [0x5408ec]
mov edi, eax
push 0x10
call dword [sym.imp.KERNEL32.dll_MulDiv]
push 0
push edi
push eax
push 1
push 0xb9
push dword [0x570408]
call dword [sym.imp.USER32.dll_LoadImageW]
push eax
push 0xffffffffffffffff
push esi
call ebx
mov ebx, dword [ebp - 0x220]
push esi
push 0
push 0x1303
push dword [ebx + 0x380]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebx + 0x360]
lea edi, [ebx + 0x418]
mov dword [ebp - 0x21c], eax
mov ecx, 0x538568
lea eax, [edi + 0x20]
push eax
call fcn.00464d40
movzx esi, ax
mov eax, dword [edi + 0x14]
mov dword [ebp - 0x224], esi
test eax, eax
jne 0x476b94
call fcn.004c1544
mov dword [edi + 0x14], eax
test eax, eax
jne 0x476b94
push 0xe
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea eax, [ebx + 0x35c]
push eax
push dword [ebx + 0x2d8]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebx + 4]
call fcn.0048b500
add esp, 0x18
test eax, eax
jns 0x476c30
or eax, 0xffffffff
jmp 0x476f9a
push 0
push 0
push eax
call fcn.004c1646
test si, si
je 0x476b63
lea esi, [edi + 8]
test esi, esi
je 0x476fb8
test edi, edi
je 0x476fb8
mov dword [esi], edi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 0x536324
mov dword [esi + 4], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x53633c]
mov dword [esi + 8], eax
push 0x536324
mov dword [0x53633c], esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [0x536350]
mov eax, dword [0x536358]
mov edx, dword [0x53634c]
sub eax, ecx
push 0
push dword [0x570404]
push edi
push dword [ebp - 0x21c]
push eax
mov eax, dword [0x536354]
sub eax, edx
push eax
mov eax, dword [ebp - 0x224]
push ecx
push edx
push 0x56000000
push 0
movzx eax, ax
push eax
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
jmp 0x476b63
mov eax, dword [ebx + 0x2a8]
lea esi, [ebx + 0x2a8]
mov edi, dword [0x555ed8]
mov ecx, esi
call dword [eax + 8]
mov dword [ebp - 0x224], eax
mov eax, dword [esi + 0x14]
test eax, eax
jne 0x476c60
call fcn.004c1544
mov dword [esi + 0x14], eax
test eax, eax
je 0x476c89
push esi
push dword [ebp - 0x224]
push eax
call fcn.004c1646
push dword [esi + 0x14]
call fcn.004c15a9
push eax
push 0xfffffffffffffffc
push edi
call dword [sym.imp.USER32.dll_SetWindowLongW]
test eax, eax
je 0x476c89
mov dword [esi + 0x20], eax
mov dword [esi + 4], edi
mov esi, dword [ebx + 0x41c]
push 0
push 0
push 0x1304
push dword [ebx + 0x380]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 2
push 0x50f1ec
push esi
push eax
lea ecx, [ebx + 0x35c]
call fcn.00476540
mov eax, dword [0x570314]
push dword [ebx + 4]
mov dword [ebx + 0x24], eax
mov eax, dword [0x555ed8]
mov dword [ebx + 0x28], eax
call dword [sym.imp.USER32.dll_GetMenu]
push eax
lea ecx, [ebx + 0x6c]
mov dword [ebp - 0x228], eax
call fcn.00475c20
mov ecx, ebx
call fcn.004760e0
mov eax, dword [0x555ecc]
lea esi, [ebx + 0x2f8]
mov dword [esi + 4], eax
mov ecx, esi
mov eax, dword [ebx + 0x360]
mov dword [esi + 8], eax
call fcn.00465f40
movsd xmm0, qword [0x5510e0]
mulsd xmm0, qword [0x50d110]
push 0x64
push CreateSecurityPage
cvttsd2si eax, xmm0
push eax
call dword [sym.imp.KERNEL32.dll_MulDiv]
cmp byte [esi], 0
mov edx, dword [esi + 0x38]
mov dword [ebp - 0x224], eax
mov dword [esi + 0x44], eax
mov eax, dword [esi + 0x2c]
je 0x476d45
mov ecx, dword [esi + 0x14]
sub ecx, dword [esi + 0xc]
jmp 0x476d4b
mov ecx, dword [esi + 0x18]
sub ecx, dword [esi + 0x10]
sub ecx, edx
sub ecx, eax
test ecx, ecx
jle 0x476d7d
push CreateSecurityPage
push ecx
push dword [ebp - 0x224]
call dword [sym.imp.KERNEL32.dll_MulDiv]
push 0
push eax
test esi, esi
mov byte [esi + 0x48], 0
mov eax, 0x24
mov ecx, esi
cmove ecx, eax
call fcn.004655c0
mov ecx, esi
call fcn.00465f40
cmp byte [0x555288], 0
jne 0x476dcb
push dword [esi + 4]
call dword [sym.imp.USER32.dll_IsWindowVisible]
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
test eax, eax
jne 0x476da7
push 5
push dword [esi + 4]
call edi
push 0
push dword [esi + 8]
call edi
cmp dword [esi + 0x28], 0
je 0x476dbb
mov dword [esi + 0x28], 0
mov ecx, esi
mov dword [esi + 0x50], 0
call fcn.00465f40
jmp 0x476dee
push dword [ebp - 0x230]
lea ecx, [ebx + 0x35c]
call fcn.00465400
lea eax, [ebp - 0x230]
mov ecx, ebx
push eax
push 0
push 0
call fcn.00477600
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
mov ecx, 0x5703c4
call fcn.00476020
mov edi, ebx
lea ecx, [ebx + 0x34]
neg edi
mov esi, eax
sbb edi, edi
and edi, ecx
mov eax, dword [esi + 8]
mov edx, dword [esi + 0xc]
cmp eax, edx
jne 0x476e81
mov ecx, dword [esi + 4]
lea ebx, [ebp - 0x238]
cmp ebx, ecx
mov ebx, dword [ebp - 0x220]
jb 0x476e43
lea ebx, [ebp - 0x238]
lea eax, [ecx + edx*4]
cmp ebx, eax
mov ebx, dword [ebp - 0x220]
jb 0x476fc4
mov eax, dword [esi + 8]
test edx, edx
jne 0x476e54
mov eax, 1
mov dword [ebp - 0x21c], eax
jmp 0x476e65
add eax, eax
mov dword [ebp - 0x21c], eax
js 0x476e93
cmp eax, 0x1fffffff
ja 0x476e93
push 4
push eax
push ecx
call fcn.004d7d82
add esp, 0xc
test eax, eax
je 0x476e93
mov ecx, dword [ebp - 0x21c]
mov dword [esi + 0xc], ecx
mov dword [esi + 4], eax
mov ecx, dword [esi + 8]
mov eax, dword [esi + 4]
lea eax, [eax + ecx*4]
test eax, eax
je 0x476e90
mov dword [eax], edi
inc dword [esi + 8]
mov edx, dword [esi + 0x18]
lea eax, [ebx + 0x38]
mov edi, ebx
neg edi
sbb edi, edi
and edi, eax
mov eax, dword [esi + 0x14]
cmp eax, edx
jne 0x476f13
mov ecx, dword [esi + 0x10]
lea ebx, [ebp - 0x23c]
cmp ebx, ecx
mov ebx, dword [ebp - 0x220]
jb 0x476ed5
lea ebx, [ebp - 0x23c]
lea eax, [ecx + edx*4]
cmp ebx, eax
mov ebx, dword [ebp - 0x220]
jb 0x476fce
mov eax, dword [esi + 0x14]
test edx, edx
jne 0x476ee6
mov eax, 1
mov dword [ebp - 0x21c], eax
jmp 0x476ef7
add eax, eax
mov dword [ebp - 0x21c], eax
js 0x476f25
cmp eax, 0x1fffffff
ja 0x476f25
push 4
push eax
push ecx
call fcn.004d7d82
add esp, 0xc
test eax, eax
je 0x476f25
mov ecx, dword [ebp - 0x21c]
mov dword [esi + 0x18], ecx
mov dword [esi + 0x10], eax
mov ecx, dword [esi + 0x14]
mov eax, dword [esi + 0x10]
lea eax, [eax + ecx*4]
test eax, eax
je 0x476f22
mov dword [eax], edi
inc dword [esi + 0x14]
push 0
push dword [ebp - 0x22c]
push 0x9f41
push 0x9f3f
push dword [ebp - 0x228]
call dword [sym.imp.USER32.dll_CheckMenuRadioItem]
push dword [ebx + 4]
xor esi, esi
mov eax, 8
cmp byte [0x555288], 0
cmovne esi, eax
call dword [sym.imp.USER32.dll_GetMenu]
push esi
push 0x9c6e
push eax
call dword [sym.imp.USER32.dll_CheckMenuItem]
movzx eax, byte [0x555288]
push eax
push 0x9c6e
push 0x402
push dword [0x555edc]
call dword [sym.imp.USER32.dll_SendMessageW]
push 1
mov ecx, ebx
call fcn.00465b40
mov byte [ebx + 0x4f8], 1
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004c3287
mov esp, ebp
pop ebp
ret 0x10
push 1
push 0xc0000005
call fcn.00445d70
push 0x80004005
call fcn.0042d2e0
push 0x80004005
call fcn.0042d2e0
int3