Function at 0x42c190
Capabilities:
Get common file path
Read .ini file

Disassembly:
push ebp
lea ebp, [esp - 0x210]
sub esp, 0x210
push 0xffffffffffffffff
push 0x469961
mov eax, dword fs:[0]
push eax
sub esp, 0x8c
mov eax, dword [0x48fac0]
xor eax, ebp
mov dword [ebp + 0x20c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
push str.COLShadow::InitOutlook
push str._____s__IN
mov dword [ebp - 0x30], esi
call fcn.00409e70
xor edi, edi
mov ebx, 1
add esp, 8
mov ecx, esi
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], edi
mov dword [ebp - 4], edi
call fcn.0041de20
mov dword [ebp - 0x18], edi
lea eax, [ebp - 0x18]
push eax
push 0x481428
push 0x15
push edi
push 0x473594
mov byte [ebp - 4], bl
call dword [sym.imp.ole32.dll_CoCreateInstance]
cmp eax, edi
jge 0x42c23f
push 0x34f
push 0x47316c
push eax
lea ecx, [ebp - 0x44]
call fcn.0040e8a0
push 0x485bc0
lea ecx, [ebp - 0x44]
push ecx
call fcn.004489f1
mov ecx, dword [ebp - 0x18]
xor eax, eax
cmp ecx, edi
mov dword [ebp - 0x28], eax
je 0x42c25e
mov edx, dword [ecx]
lea eax, [ebp - 0x28]
push eax
push 0x471e94
push ecx
mov ecx, dword [edx]
call ecx
mov eax, dword [ebp - 0x28]
cmp eax, edi
mov byte [ebp - 4], 2
jne 0x42c28b
push 0x351
push 0x47316c
push SysReAllocString
lea ecx, [ebp - 0x6c]
call fcn.0040e8a0
push 0x485bc0
lea edx, [ebp - 0x6c]
push edx
call fcn.004489f1
cmp dword [esi + 0x54], eax
je 0x42c2ac
mov ecx, dword [eax]
mov edx, dword [ecx + 4]
push eax
mov edi, eax
call edx
mov eax, dword [esi + 0x54]
test eax, eax
je 0x42c2a9
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov dword [esi + 0x54], edi
mov ebx, dword [esi + 0x54]
push str.MAPI
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov edi, eax
test edi, edi
mov dword [ebp - 0x14], edi
jne 0x42c2cd
push 0x8007000e
call fcn.00401210
mov eax, dword [ebx]
mov ecx, dword [eax + 0x4c]
add esi, 0x5c
push esi
push edi
push ebx
mov byte [ebp - 4], 3
call ecx
push edi
mov byte [ebp - 4], 2
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [esi]
test eax, eax
mov dword [ebp - 0x14], eax
jne 0x42c317
push 0x355
push 0x47316c
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x78]
call fcn.0040e8a0
push 0x485bc0
lea edx, [ebp - 0x78]
push edx
call fcn.004489f1
mov ebx, dword [eax]
mov ecx, dword [0x48ee48]
mov edx, dword [0x48ee4c]
mov esi, dword [0x48ee50]
mov edi, dword [0x48ee54]
sub esp, 0x10
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], edx
mov dword [eax + 8], esi
mov dword [eax + 0xc], edi
sub esp, 0x10
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], edx
mov dword [eax + 8], esi
mov dword [eax + 0xc], edi
sub esp, 0x10
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], edx
mov dword [eax + 8], esi
mov dword [eax + 0xc], edi
sub esp, 0x10
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [ebx + 0x58]
mov dword [eax + 4], edx
mov dword [eax + 8], esi
mov dword [eax + 0xc], edi
mov eax, dword [ebp - 0x14]
push eax
call ecx
xor ebx, ebx
cmp eax, ebx
jge 0x42c3a1
push 0x357
push 0x47316c
push eax
lea ecx, [ebp - 0x70]
call fcn.0040e8a0
push 0x485bc0
lea edx, [ebp - 0x70]
push edx
call fcn.004489f1
mov edi, dword [ebp - 0x30]
mov ecx, edi
mov byte [edi + 0x9d], 1
call fcn.0042a2b0
call fcn.0041e370
push str.engine_
lea eax, [ebp - 0x14]
push 0x4910b0
push eax
call fcn.0040bb70
add esp, 0xc
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x24]
push ecx
mov byte [ebp - 4], 4
call fcn.00432370
add esp, 8
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 6
call fcn.00408280
mov edx, dword [0x4910b0]
push edx
call fcn.0040cba0
add esp, 4
lea eax, [ebp - 0x24]
push eax
push 0x4910b0
call fcn.0042d7e0
add esp, 8
mov ecx, edi
call fcn.0041e160
test al, al
jne 0x42c424
push str.xxx_Fail_to_SetDllDirectoryForAMSP___
call fcn.00409e70
add esp, 4
push str.TMAS_SFAgent.dll
lea ecx, [ebp - 0x1c]
push 0x4910c0
push ecx
call fcn.0040bb70
add esp, 0xc
mov edx, dword [ebp - 0x1c]
push 0x4910ac
push edx
lea eax, [edi + 0x90]
push eax
mov byte [ebp - 4], 7
call fcn.0041d8d0
add esp, 0xc
push eax
push str.____LoadDllAndCreateObject_of_SFAgent__return_code__d_
call fcn.00409e70
add esp, 8
cmp dword [0x4910ac], ebx
je 0x42c67c
mov ecx, dword [ebp - 0x1c]
push ecx
push str.____Loading_Spam_Filter_Agent_success:__s
call fcn.00409e70
add esp, 8
cmp byte [edi + 0x9c], 0
je 0x42c49d
mov eax, dword [edi + 0x98]
mov ecx, dword [0x4910ac]
mov edx, dword [ecx]
push eax
mov eax, dword [edx]
call eax
mov ecx, dword [0x4910bc]
push ecx
push 1
push str.EnableInTheCloud
push 0x472128
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ecx, dword [0x4910ac]
mov edx, dword [ecx]
neg eax
mov edx, dword [edx + 4]
sbb eax, eax
neg eax
push eax
movzx eax, byte [0x4910ff]
push eax
mov eax, dword [0x49117c]
push eax
mov eax, dword [0x4910bc]
push eax
mov eax, dword [ebp - 0x24]
push eax
mov eax, dword [0x4910b0]
push eax
mov eax, dword [0x4910c0]
push eax
call edx
cmp eax, ebx
jne 0x42c667
mov eax, dword [0x4910d4]
push 1
push eax
lea ecx, [ebp - 0x98]
call fcn.0042dc10
lea ecx, [ebp - 0x90]
mov byte [ebp - 4], 8
call fcn.0040aa40
lea ecx, [ebp - 0x90]
mov bl, 9
push ecx
mov byte [ebp - 4], bl
call fcn.0041f610
add esp, 4
test al, al
je 0x42c540
push 0x491154
lea ecx, [ebp - 0x90]
call fcn.00409f90
mov ecx, dword [0x4910c8]
xor esi, esi
cmp ecx, esi
mov dword [0x4910e0], esi
mov dword [0x4910e4], esi
mov dword [0x4910e8], esi
mov dword [0x4910ec], esi
je 0x42c576
mov esi, ecx
call fcn.004293b0
push esi
call fcn.00437b08
add esp, 4
xor esi, esi
mov ecx, dword [0x4910cc]
cmp ecx, esi
je 0x42c592
mov esi, ecx
call fcn.004293b0
push esi
call fcn.00437b08
add esp, 4
xor esi, esi
push 0x18
call fcn.00437add
mov ecx, eax
add esp, 4
mov dword [ebp - 0x14], ecx
cmp ecx, esi
mov byte [ebp - 4], 0xa
je 0x42c5b0
call fcn.00429310
jmp 0x42c5b2
xor eax, eax
push 0x18
mov byte [ebp - 4], bl
mov dword [0x4910c8], eax
call fcn.00437add
mov ecx, eax
add esp, 4
mov dword [ebp - 0x14], ecx
cmp ecx, esi
mov byte [ebp - 4], 0xb
je 0x42c5d8
call fcn.00429310
jmp 0x42c5da
xor eax, eax
mov edx, dword [0x4910c8]
push eax
push edx
mov byte [ebp - 4], bl
mov dword [0x4910cc], eax
call fcn.00421670
mov edx, dword [0x4910cc]
mov ecx, dword [0x4910ac]
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
add esp, 8
push edx
mov edx, dword [0x4910c8]
push edx
call eax
mov ecx, dword [0x4910ac]
mov edx, dword [ecx]
mov eax, dword [edx + 0x28]
push 0x49116c
push 0x491168
push 0x4910bc
call eax
cmp byte [0x4910ff], 0
mov ecx, dword [0x4910ac]
mov dword [0x4910d8], ecx
sete dl
lea ecx, [ebp - 0x90]
mov byte [0x4910ff], dl
mov byte [ebp - 4], 8
call fcn.0040a330
lea ecx, [ebp - 0x98]
mov byte [ebp - 4], 7
call fcn.0042dc40
xor ebx, ebx
jmp 0x42c693
push str.____Initialize_Spam_Filter_Agent_failed.
mov dword [0x4910d8], ebx
call fcn.00409e70
add esp, 4
jmp 0x42c693
mov eax, dword [ebp - 0x1c]
push eax
push str.____Loading_Spam_Filter_Agent_failed:__s
mov dword [0x4910d8], ebx
call fcn.00409e70
add esp, 8
mov dword [ebp - 0x2c], ebx
mov esi, dword [edi + 0x54]
push str.Redemption.MAPIUtils
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0xc
call fcn.004124b0
mov eax, dword [eax]
mov ecx, dword [esi]
lea edx, [ebp - 0x2c]
push edx
push eax
mov eax, dword [ecx + 0x48]
push esi
mov byte [ebp - 4], 0xd
call eax
mov ecx, dword [ebp - 0x14]
push ecx
mov esi, eax
mov byte [ebp - 4], 0xc
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
cmp esi, ebx
jge 0x42c6f2
push 0x3b2
push 0x47316c
push esi
lea ecx, [ebp - 0x4c]
call fcn.0040e8a0
push 0x485bc0
lea edx, [ebp - 0x4c]
push edx
call fcn.004489f1
mov eax, dword [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x20]
call fcn.00412910
cmp dword [ebp - 0x20], ebx
mov byte [ebp - 4], 0xe
jne 0x42c72c
push 0x3b4
push 0x47316c
push reloc.OLEAUT32.dll_SysReAllocStringLen
lea ecx, [ebp - 0x3c]
call fcn.0040e8a0
push 0x485bc0
lea ecx, [ebp - 0x3c]
push ecx
call fcn.004489f1
lea edx, [ebp - 0x20]
push edx
lea ecx, [edi + 0x60]
call fcn.00418d60
mov eax, dword [edi + 0x5c]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x40]
lea ebx, [edi + 0x64]
push ebx
push 6
push eax
call edx
test eax, eax
jl 0x42cbd2
cmp dword [ebx], 0
je 0x42cbd2
mov eax, dword [edi + 0x5c]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x40]
lea esi, [edi + 0x78]
push esi
push 4
push eax
call edx
test eax, eax
jl 0x42cbb1
cmp dword [esi], 0
je 0x42cbb1
mov eax, dword [edi + 0x5c]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x40]
lea esi, [edi + 0x7c]
push esi
push 0x10
push eax
call edx
test eax, eax
jl 0x42cb90
cmp dword [esi], 0
je 0x42cb90
mov eax, dword [ebx]
mov ecx, dword [eax]
lea edx, [edi + 0x80]
push edx
push eax
mov eax, dword [ecx + 0x44]
call eax
test eax, eax
jge 0x42c7d4
push 0x3c0
push 0x47316c
push eax
lea ecx, [ebp - 0x54]
call fcn.0040e8a0
push 0x485bc0
lea ecx, [ebp - 0x54]
push ecx
call fcn.004489f1
mov ecx, edi
call fcn.0041e7f0
test al, al
jne 0x42c804
push 0x3c1
push 0x47316c
push SysStringLen
lea ecx, [ebp - 0x74]
call fcn.0040e8a0
push 0x485bc0
lea edx, [ebp - 0x74]
push edx
call fcn.004489f1
push 0x3c
call fcn.00437add
mov ecx, eax
add esp, 4
mov dword [ebp - 0x14], ecx
test ecx, ecx
mov byte [ebp - 4], 0xf
je 0x42c825
push edi
call fcn.00413650
mov ecx, eax
jmp 0x42c827
xor ecx, ecx
test ecx, ecx
mov byte [ebp - 4], 0xe
mov dword [0x4910a8], ecx
jne 0x42c85a
push 0x3c3
push 0x47316c
push reloc.OLEAUT32.dll_SysStringLen
lea ecx, [ebp - 0x5c]
call fcn.0040e8a0
push 0x485bc0
lea eax, [ebp - 0x5c]
push eax
call fcn.004489f1
mov edx, dword [ecx]
mov eax, dword [edx + 4]
call eax
mov ecx, edi
call fcn.0041eab0
test al, al
je 0x42c873
mov dword [ebp - 0x34], 1
mov eax, dword [edi + 0x5c]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x40]
lea ebx, [edi + 0x70]
push ebx
push 3
push eax
call edx
test eax, eax
jl 0x42cb6f
cmp dword [ebx], 0
je 0x42cb6f
mov eax, dword [edi + 0x5c]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x40]
lea esi, [edi + 0x74]
push esi
push 5
push eax
call edx
test eax, eax
jl 0x42cb4e
mov ecx, dword [esi]
test ecx, ecx
je 0x42cb4e
mov eax, dword [ecx]
mov eax, dword [eax + 0x44]
lea edx, [edi + 0x8c]
push edx
push ecx
call eax
test eax, eax
jge 0x42c8ec
push 0x3cc
push 0x47316c
push eax
lea ecx, [ebp - 0x7c]
call fcn.0040e8a0
push 0x485bc0
lea ecx, [ebp - 0x7c]
push ecx
call fcn.004489f1
cmp byte [0x4910fd], 0
jne 0x42c96a
push str.COLShadow::InitOutlook
push str._____s__OUT
call fcn.00409e70
mov eax, dword [ebp - 0x20]
add esp, 8
test eax, eax
mov byte [ebp - 4], 0xc
je 0x42c91a
mov edx, dword [eax]
push eax
mov eax, dword [edx + 8]
call eax
mov eax, dword [ebp - 0x2c]
test eax, eax
mov byte [ebp - 4], 7
je 0x42c92d
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
lea ecx, [ebp - 0x1c]
call fcn.00408280
lea ecx, [ebp - 0x24]
call fcn.00408280
mov eax, dword [ebp - 0x28]
test eax, eax
mov byte [ebp - 4], 1
je 0x42c950
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [ebp - 0x18]
test eax, eax
mov byte [ebp - 4], 0
je 0x42c963
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
xor eax, eax
jmp 0x42cb29
mov eax, dword [edi + 0x64]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x50]
push 0x491180
push eax
call edx
test eax, eax
jge 0x42c98b
push str.xxx_Can_not_get_Inbox_Folders_store_ID
call fcn.00409e70
add esp, 4
mov eax, dword [edi + 0x68]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x50]
push 0x491188
push eax
call edx
test eax, eax
jge 0x42c9ac
push str.xxx_Can_not_get_Spam_Mail_Folders_store_ID
call fcn.00409e70
add esp, 4
mov eax, dword [edi + 0x6c]
test eax, eax
je 0x42c9d1
mov ecx, dword [eax]
mov edx, dword [ecx + 0x50]
push 0x491184
push eax
call edx
test eax, eax
jge 0x42c9d1
push str.xxx_Can_not_get_JunkMail_Folders_store_ID
call fcn.00409e70
add esp, 4
mov eax, dword [ebx]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x50]
push 0x49118c
push eax
call edx
test eax, eax
jge 0x42c9f1
push str.xxx_Can_not_get_Deleted_Items_Folders_store_ID
call fcn.00409e70
add esp, 4
mov eax, dword [esi]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x50]
push 0x491190
push eax
call edx
mov esi, eax
test esi, esi
jge 0x42ca13
push str.xxx_Can_not_get_Sent_Mail_Folders_store_ID
call fcn.00409e70
add esp, 4
mov ecx, edi
call fcn.0041eb20
test al, al
jne 0x42ca3f
push 0x3ea
push 0x47316c
push esi
lea ecx, [ebp - 0x64]
call fcn.0040e8a0
push 0x485bc0
lea eax, [ebp - 0x64]
push eax
call fcn.004489f1
push 0xcc
call fcn.00437add
mov ecx, eax
add esp, 4
mov dword [ebp - 0x14], ecx
test ecx, ecx
mov byte [ebp - 4], 0x10
je 0x42ca69
mov edx, dword [0x4910d0]
push edx
call fcn.0040e9c0
mov ecx, eax
jmp 0x42ca6b
xor ecx, ecx
test ecx, ecx
mov byte [ebp - 4], 0xe
mov dword [0x4910a0], ecx
jne 0x42ca9e
push 0x3f4
push 0x47316c
push reloc.OLEAUT32.dll_VariantInit
lea ecx, [ebp - 0x40]
call fcn.0040e8a0
push 0x485bc0
lea eax, [ebp - 0x40]
push eax
call fcn.004489f1
call fcn.0040eae0
mov ecx, dword [0x4910a0]
push 0
call fcn.0043c1b9
mov eax, dword [ebp - 0x20]
test eax, eax
mov byte [ebp - 4], 0xc
je 0x42cac3
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [ebp - 0x2c]
test eax, eax
mov byte [ebp - 4], 7
je 0x42cad6
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
lea ecx, [ebp - 0x1c]
call fcn.00408280
lea ecx, [ebp - 0x24]
call fcn.00408280
mov eax, dword [ebp - 0x28]
test eax, eax
mov byte [ebp - 4], 1
je 0x42caf9
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [ebp - 0x18]
test eax, eax
mov byte [ebp - 4], 0
je 0x42cb0c
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x34], 0
je 0x42cb26
push str.____Is_able_to_monitor_JunkMail_folder
call fcn.00409e70
add esp, 4
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x20c]
xor ecx, ebp
call fcn.00448e02
add ebp, 0x210
mov esp, ebp
pop ebp
ret
push 0x3ca
push 0x47316c
push eax
lea ecx, [ebp - 0x48]
call fcn.0040e8a0
push 0x485bc0
lea eax, [ebp - 0x48]
push eax
call fcn.004489f1
push 0x3c8
push 0x47316c
push eax
lea ecx, [ebp - 0x50]
call fcn.0040e8a0
push 0x485bc0
lea ecx, [ebp - 0x50]
push ecx
call fcn.004489f1
push 0x3bd
push 0x47316c
push eax
lea ecx, [ebp - 0x58]
call fcn.0040e8a0
push 0x485bc0
lea edx, [ebp - 0x58]
push edx
call fcn.004489f1
push 0x3ba
push 0x47316c
push eax
lea ecx, [ebp - 0x60]
call fcn.0040e8a0
push 0x485bc0
lea eax, [ebp - 0x60]
push eax
call fcn.004489f1
push 0x3b7
push 0x47316c
push eax
lea ecx, [ebp - 0x68]
call fcn.0040e8a0
push 0x485bc0
lea ecx, [ebp - 0x68]
push ecx
call fcn.004489f1
xor edi, edi
push 0x208
lea edx, [ebp + 2]
push edi
push edx
mov word [ebp], di
call fcn.004481f0
mov esi, dword [ebp - 0x30]
mov ecx, dword [esi + 0x20]
add esp, 0xc
push edi
push 0x23
lea eax, [ebp]
push eax
push ecx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x42ccb7
lea edx, [ebp]
push edx
lea ecx, [ebp - 0x18]
call fcn.00406140
mov bl, 0x12
push 0x46e0a8
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], bl
call fcn.00405800
push str.OutlookFail.log
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x14]
push ecx
call fcn.0040bb70
mov eax, dword [eax]
push eax
mov byte [ebp - 4], 0x13
call fcn.0041d280
add esp, 0x10
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], bl
call fcn.00408280
push str.xxxxxxxxxxxxx_Fail_to_initialize_Outlook_xxxxxxxxxxxxx
call fcn.0041d9a0
mov ecx, dword [ebp - 0x80]
add esp, 4
lea edx, [ebp - 0x14]
push edx
call fcn.00413040
mov eax, dword [eax]
push eax
push str.xxx__s
mov byte [ebp - 4], 0x14
call fcn.0041d9a0
add esp, 8
lea ecx, [ebp - 0x14]
call fcn.00408280
call fcn.00418ec0
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0x11
call fcn.00408280
mov byte [esi + 0x9e], 1
mov ecx, dword [0x4910b0]
cmp dword [ecx - 0xc], 2
mov dword [ebp - 0x38], edi
jle 0x42cd12
mov ecx, dword [0x4910dc]
call fcn.0042fa40
test al, al
jne 0x42cd12
push str.Global.ini
lea edx, [ebp - 0x14]
push 0x4910b0
push edx
call fcn.0040bb70
mov eax, dword [eax]
add esp, 0xc
push eax
push 0x476b60
push str.EnableTBar
push str.Antispam
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
lea ecx, [ebp - 0x14]
call fcn.00408280
mov dword [ebp - 4], 0xffffffff
mov eax, 0x42cb13
ret