Function at 0x411d20
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x574d49
mov eax, dword fs:[0]
push eax
sub esp, 0x49c
mov eax, dword [0x5e10a4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [0x5ec78c]
mov ebx, dword [ebp + 8]
test eax, eax
jne 0x411d91
push 0x11c
call fcn.004270ea
add esp, 4
mov dword [ebp - 0x49c], eax
mov dword [ebp - 4], 0
test eax, eax
je 0x411d83
mov ecx, eax
call fcn.00425540
jmp 0x411d85
xor eax, eax
mov dword [ebp - 4], 0xffffffff
mov dword [0x5ec78c], eax
mov ecx, eax
call fcn.0042c99d
mov edx, eax
mov dword [ebp - 0x43c], 7
xor eax, eax
mov dword [ebp - 0x440], 0
mov word [ebp - 0x450], ax
cmp word [edx], ax
jne 0x411dc0
xor ecx, ecx
jmp 0x411dd4
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x411dc5
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x450]
call fcn.004089f0
mov ecx, edi
mov dword [ebp - 4], 1
call fcn.00410b40
test al, al
je 0x4127b2
cmp dword [ebp - 0x43c], 8
lea eax, [ebp - 0x450]
cmovae eax, dword [ebp - 0x450]
push eax
call sym.Service.exe_SHStartSelfProtectService
cmp dword [ebp - 0x43c], 8
lea ecx, [ebp - 0x450]
push eax
cmovae ecx, dword [ebp - 0x450]
push ecx
push str.SetProtect_SHStartSelfProtectService_s_res_d
call fcn.0043390e
cmp dword [ebp - 0x43c], 8
lea eax, [ebp - 0x450]
push 1
cmovae eax, dword [ebp - 0x450]
push eax
call sym.Service.exe_AddProtectFile
cmp dword [ebp - 0x43c], 8
lea ecx, [ebp - 0x450]
push eax
cmovae ecx, dword [ebp - 0x450]
push ecx
push str.SetProtect_AddProtectFile_s_res_d
call fcn.0043390e
xor eax, eax
mov dword [ebp - 0x424], 7
add esp, 0x24
mov dword [ebp - 0x428], 0
mov word [ebp - 0x438], ax
cmp dword [ebp - 0x43c], 8
lea ecx, [ebp - 0x450]
mov eax, dword [ebp - 0x440]
cmovae ecx, dword [ebp - 0x450]
mov byte [ebp - 4], 2
cmp word [ecx + eax*2 - 2], 0x5c
lea eax, [ebp - 0x450]
jne 0x411ed2
push 0x57a200
push eax
lea eax, [ebp - 0x468]
push eax
call fcn.0040dcf0
add esp, 0xc
mov esi, eax
jmp 0x411ee9
push str.PDF_Convert2_
push eax
lea eax, [ebp - 0x468]
push eax
call fcn.0040dcf0
add esp, 0xc
mov esi, eax
lea eax, [ebp - 0x438]
cmp eax, esi
je 0x411f36
mov eax, dword [ebp - 0x424]
cmp eax, 8
jb 0x411f11
inc eax
lea ecx, [ebp - 0x438]
push eax
push dword [ebp - 0x438]
call fcn.00409050
xor eax, eax
mov dword [ebp - 0x424], 7
push esi
lea ecx, [ebp - 0x438]
mov dword [ebp - 0x428], eax
mov word [ebp - 0x438], ax
call fcn.0040b910
mov eax, dword [ebp - 0x454]
mov byte [ebp - 4], 2
cmp eax, 8
jb 0x411f58
inc eax
lea ecx, [ebp - 0x468]
push eax
push dword [ebp - 0x468]
call fcn.00409050
cmp dword [ebp - 0x424], 8
lea eax, [ebp - 0x438]
push 1
cmovae eax, dword [ebp - 0x438]
push eax
call sym.Service.exe_AddProtectFile
cmp dword [ebp - 0x424], 8
lea ecx, [ebp - 0x438]
mov esi, eax
cmovae ecx, dword [ebp - 0x438]
push esi
push ecx
push str.SetProtect_AddProtectFile_s_res_d
mov dword [ebp - 0x49c], esi
call fcn.0043390e
push 0x208
lea eax, [ebp - 0x420]
push 0
push eax
call fcn.0043fcd0
add esp, 0x20
lea eax, [ebp - 0x420]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x57a23c
lea eax, [ebp - 0x420]
push eax
push str._sdriversJKSvarer._s
call fcn.004357a9
add esp, 0xc
lea ecx, [ebp - 0x498]
push eax
call fcn.004086c0
cmp dword [ebp - 0x484], 8
lea eax, [ebp - 0x498]
push 0
cmovae eax, dword [ebp - 0x498]
push eax
mov byte [ebp - 4], 5
call sym.Service.exe_AddProtectFile
cmp dword [ebp - 0x484], 8
lea eax, [ebp - 0x498]
push esi
cmovae eax, dword [ebp - 0x498]
push eax
push str.SetProtect_AddProtectFile_s_res_d
call fcn.0043390e
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.0043fcd0
add esp, 0x20
lea eax, [ebp - 0x218]
push 0
push 0x2b
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea edi, [ebp - 0x218]
add edi, 0xfffffffe
nop dword [eax + eax]
mov ax, word [edi + 2]
lea edi, [edi + 2]
test ax, ax
jne 0x412060
mov eax, dword [0x5d7ba8]
lea edx, [ebp - 0x218]
mov dword [edi], eax
add edx, 0xfffffffe
nop dword [eax]
mov cx, word [edx + 2]
lea edx, [edx + 2]
test cx, cx
jne 0x412080
mov ecx, dword [str.JiKePDF2]
lea edi, [ebp - 0x218]
mov dword [edx], ecx
add edi, 0xfffffffe
mov ecx, dword [0x57a278]
mov dword [edx + 4], ecx
mov ecx, dword [0x57a27c]
mov dword [edx + 8], ecx
mov ecx, dword [0x57a280]
mov dword [edx + 0xc], ecx
mov cx, word [0x57a284]
mov word [edx + 0x10], cx
mov cx, word [edi + 2]
lea edi, [edi + 2]
test cx, cx
jne 0x4120c3
mov dword [edi], eax
lea edi, [ebp - 0x218]
add edi, 0xfffffffe
nop word [eax + eax]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x4120e0
mov ecx, 7
mov esi, str.JiKePDFReader
rep movsd dword es:[edi], dword [esi]
lea ecx, [ebp - 0x218]
add ecx, 0xfffffffe
mov ax, word [ecx + 2]
lea ecx, [ecx + 2]
test ax, ax
jne 0x412101
mov eax, dword [str..ini]
mov dword [ecx], eax
mov eax, dword [0x57a28c]
mov dword [ecx + 4], eax
mov ax, word [0x57a290]
mov word [ecx + 8], ax
lea eax, [ebp - 0x218]
push 0
push eax
call sym.Service.exe_AddProtectFile
push dword [ebp - 0x49c]
lea eax, [ebp - 0x218]
push eax
push str.SetProtect_AddProtectFile_s_res_d
call fcn.0043390e
add esp, 0x14
mov dword [ebp - 0x4a8], 0
lea ecx, [ebp - 0x4a8]
mov dword [ebp - 0x4a4], 0
call fcn.00412e60
mov dword [ebp - 0x4a8], eax
lea eax, [ebp - 0x4a0]
mov byte [ebp - 4], 6
push eax
lea ecx, [ebp - 0x4a8]
mov dword [ebp - 0x4a0], str.REGISTRYMACHINESOFTWAREClassesCLSID08FEFE51_90C0_4599_8F8D_8C3D94C96A14
mov byte [ebp - 0x49c], 1
call fcn.0040de00
push eax
add eax, 0x10
lea ecx, [ebp - 0x4a8]
push eax
push 0
lea eax, [ebp - 0x4a0]
push eax
call fcn.0040e140
lea eax, [ebp - 0x4a0]
mov dword [ebp - 0x4a0], str.REGISTRYMACHINESOFTWAREClassesCLSID524E3D34_9202_4E14_8607_120C91A05205
push eax
lea ecx, [ebp - 0x4a8]
mov byte [ebp - 0x49c], 1
call fcn.0040de00
push eax
add eax, 0x10
lea ecx, [ebp - 0x4a8]
push eax
push 0
lea eax, [ebp - 0x4a0]
push eax
call fcn.0040e140
lea eax, [ebp - 0x4a0]
mov dword [ebp - 0x4a0], str.REGISTRYMACHINESoftwareMicrosoftWindowsCurrentVersionShell_ExtensionsApproved
push eax
lea ecx, [ebp - 0x4a8]
mov byte [ebp - 0x49c], 1
call fcn.0040de00
push eax
add eax, 0x10
lea ecx, [ebp - 0x4a8]
push eax
push 0
lea eax, [ebp - 0x4a0]
push eax
call fcn.0040e140
lea eax, [ebp - 0x4a0]
mov dword [ebp - 0x4a0], str.RegistryMachineSOFTWARECLASSES_shellexContextMenuHandlers___________JiKePDFReader
push eax
lea ecx, [ebp - 0x4a8]
mov byte [ebp - 0x49c], 1
call fcn.0040de00
push eax
add eax, 0x10
lea ecx, [ebp - 0x4a8]
push eax
push 0
lea eax, [ebp - 0x4a0]
push eax
call fcn.0040e140
mov dword [ebp - 0x4a0], str.REGISTRYMACHINESOFTWARECLASSES_shellexDragDropHandlersJiKePDFReader
mov byte [ebp - 0x49c], 1
lea eax, [ebp - 0x4a0]
push eax
lea ecx, [ebp - 0x4a8]
call fcn.0040de00
push eax
add eax, 0x10
lea ecx, [ebp - 0x4a8]
push eax
push 0
lea eax, [ebp - 0x4a0]
push eax
call fcn.0040e140
lea eax, [ebp - 0x4a0]
mov dword [ebp - 0x4a0], str.REGISTRYMACHINESOFTWARECLASSESFolder_shellexDragDropHandlersJiKePDFReader
push eax
lea ecx, [ebp - 0x4a8]
mov byte [ebp - 0x49c], 1
call fcn.0040de00
push eax
add eax, 0x10
lea ecx, [ebp - 0x4a8]
push eax
push 0
lea eax, [ebp - 0x4a0]
push eax
call fcn.0040e140
lea eax, [ebp - 0x4a0]
mov dword [ebp - 0x4a0], str.REGISTRYMACHINESOFTWARECLASSESDirectory_shellexContextMenuHandlers___________JiKePDFReader
push eax
lea ecx, [ebp - 0x4a8]
mov byte [ebp - 0x49c], 1
call fcn.0040de00
push eax
add eax, 0x10
lea ecx, [ebp - 0x4a8]
push eax
push 0
lea eax, [ebp - 0x4a0]
push eax
call fcn.0040e140
lea eax, [ebp - 0x4a0]
mov dword [ebp - 0x4a0], str.REGISTRYMACHINESOFTWARECLASSESDrive_shellexContextMenuHandlersJiKePDFReader
push eax
lea ecx, [ebp - 0x4a8]
mov byte [ebp - 0x49c], 1
call fcn.0040de00
push eax
add eax, 0x10
lea ecx, [ebp - 0x4a8]
push eax
push 0
lea eax, [ebp - 0x4a0]
push eax
call fcn.0040e140
lea eax, [ebp - 0x4a0]
mov dword [ebp - 0x4a0], str.REGISTRYMACHINESOFTWARECLASSESlnkfile_shellexContextMenuHandlersJiKePDFReader
push eax
lea ecx, [ebp - 0x4a8]
mov byte [ebp - 0x49c], 1
call fcn.0040de00
push eax
add eax, 0x10
lea ecx, [ebp - 0x4a8]
push eax
push 0
lea eax, [ebp - 0x4a0]
push eax
call fcn.0040e140
lea eax, [ebp - 0x4a0]
mov dword [ebp - 0x4a0], str.REGISTRYMACHINESOFTWAREClassesCLSIDBF2F955C_AE7B_4E30_A460_DA050D9269BE
push eax
lea ecx, [ebp - 0x4a8]
mov byte [ebp - 0x49c], 1
call fcn.0040de00
push eax
add eax, 0x10
lea ecx, [ebp - 0x4a8]
push eax
push 0
lea eax, [ebp - 0x4a0]
push eax
call fcn.0040e140
lea eax, [ebp - 0x4a0]
mov dword [ebp - 0x4a0], str.REGISTRYMACHINESOFTWAREClassesCLSID39593D4F_20EC_4E11_BF17_48762CABBADD
push eax
lea ecx, [ebp - 0x4a8]
mov byte [ebp - 0x49c], 1
call fcn.0040de00
push eax
add eax, 0x10
lea ecx, [ebp - 0x4a8]
push eax
push 0
lea eax, [ebp - 0x4a0]
push eax
call fcn.0040e140
lea eax, [ebp - 0x4a0]
mov dword [ebp - 0x4a0], str.REGISTRYMACHINESOFTWAREClassesDirectory_background_shellexContextMenuHandlersCAADEAEB_42B3_4BEB_A14F_4528F3F9EB7B
push eax
lea ecx, [ebp - 0x4a8]
mov byte [ebp - 0x49c], 1
call fcn.0040de00
push eax
add eax, 0x10
lea ecx, [ebp - 0x4a8]
push eax
push 0
lea eax, [ebp - 0x4a0]
push eax
call fcn.0040e140
lea eax, [ebp - 0x4a0]
mov dword [ebp - 0x4a0], str.REGISTRYMACHINESOFTWAREClassesCLSID46C619B8_3907_4689_A70F_8DF3DD8FB2F6
push eax
lea ecx, [ebp - 0x4a8]
mov byte [ebp - 0x49c], 1
call fcn.0040de00
push eax
add eax, 0x10
lea ecx, [ebp - 0x4a8]
push eax
push 0
lea eax, [ebp - 0x4a0]
push eax
call fcn.0040e140
lea eax, [ebp - 0x4a0]
mov dword [ebp - 0x4a0], str.REGISTRYMACHINESOFTWAREClassesCLSID7A85B249_E368_4A32_8349_E981244BD9E1
push eax
lea ecx, [ebp - 0x4a8]
mov byte [ebp - 0x49c], 1
call fcn.0040de00
push eax
add eax, 0x10
lea ecx, [ebp - 0x4a8]
push eax
push 0
lea eax, [ebp - 0x4a0]
push eax
call fcn.0040e140
lea eax, [ebp - 0x4a0]
mov dword [ebp - 0x4a0], str.RegistryMachineSYSTEMControlSet001ServicesJKSvarer
push eax
lea ecx, [ebp - 0x4a8]
mov byte [ebp - 0x49c], 1
call fcn.0040de00
push eax
add eax, 0x10
lea ecx, [ebp - 0x4a8]
push eax
push 0
lea eax, [ebp - 0x4a0]
push eax
call fcn.0040e140
cmp dword [ebx + 0x14], 8
jb 0x412505
mov eax, dword [ebx]
jmp 0x412507
mov eax, ebx
push eax
push str.REGISTRYMACHINESYSTEMControlSet001Services_s
call fcn.004357a9
add esp, 8
lea ecx, [ebp - 0x468]
push eax
call fcn.004086c0
cmp dword [ebp - 0x454], 8
lea eax, [ebp - 0x468]
mov byte [ebp - 4], 7
cmovae eax, dword [ebp - 0x468]
push eax
push str.SetProtect_sControlSet001String_s
call fcn.0043390e
add esp, 8
mov byte [ebp - 0x49c], 1
cmp dword [ebp - 0x454], 8
lea eax, [ebp - 0x468]
lea ecx, [ebp - 0x4a8]
cmovae eax, dword [ebp - 0x468]
mov dword [ebp - 0x4a0], eax
lea eax, [ebp - 0x4a0]
push eax
call fcn.0040de00
push eax
add eax, 0x10
lea ecx, [ebp - 0x4a8]
push eax
push 0
lea eax, [ebp - 0x4a0]
push eax
call fcn.0040e140
cmp dword [ebx + 0x14], 8
jb 0x41259b
mov ebx, dword [ebx]
push ebx
push str.REGISTRYMACHINESYSTEMCurrentControlSetServices_s
call fcn.004357a9
add esp, 8
lea ecx, [ebp - 0x480]
push eax
call fcn.004086c0
cmp dword [ebp - 0x46c], 8
lea eax, [ebp - 0x480]
mov byte [ebp - 4], 8
cmovae eax, dword [ebp - 0x480]
push eax
push str.SetProtect_sCurrentControlSetString_s
call fcn.0043390e
add esp, 8
mov byte [ebp - 0x49c], 1
cmp dword [ebp - 0x46c], 8
lea eax, [ebp - 0x480]
lea ecx, [ebp - 0x4a8]
cmovae eax, dword [ebp - 0x480]
mov dword [ebp - 0x4a0], eax
lea eax, [ebp - 0x4a0]
push eax
call fcn.0040de00
push eax
add eax, 0x10
lea ecx, [ebp - 0x4a8]
push eax
push 0
lea eax, [ebp - 0x4a0]
push eax
call fcn.0040e140
mov ecx, dword [ebp - 0x4a8]
mov eax, dword [ecx]
mov dword [ebp - 0x49c], eax
cmp eax, ecx
je 0x41268f
nop dword [eax]
cmp dword [eax + 0x24], 8
lea esi, [eax + 0x10]
jb 0x41264d
mov ecx, dword [esi]
jmp 0x41264f
mov ecx, esi
movzx eax, byte [esi + 0x18]
push eax
push ecx
call sym.Service.exe_AddProtectReg
add esp, 8
cmp dword [esi + 0x14], 8
jb 0x412665
mov esi, dword [esi]
push eax
push esi
push str.SetProtect_AddProtectReg_s_res_d
call fcn.0043390e
add esp, 0xc
lea ecx, [ebp - 0x49c]
call fcn.0041b450
mov eax, dword [ebp - 0x49c]
mov ecx, dword [ebp - 0x4a8]
cmp eax, ecx
jne 0x412640
mov eax, dword [ebp - 0x46c]
cmp eax, 8
jb 0x4126b3
inc eax
lea ecx, [ebp - 0x480]
push eax
push dword [ebp - 0x480]
call fcn.00409050
mov ecx, dword [ebp - 0x4a8]
xor eax, eax
mov dword [ebp - 0x46c], 7
mov word [ebp - 0x480], ax
mov eax, dword [ebp - 0x454]
mov dword [ebp - 0x470], 0
cmp eax, 8
jb 0x4126f4
inc eax
lea ecx, [ebp - 0x468]
push eax
push dword [ebp - 0x468]
call fcn.00409050
mov ecx, dword [ebp - 0x4a8]
xor eax, eax
mov dword [ebp - 0x454], 7
mov dword [ebp - 0x458], 0
mov word [ebp - 0x468], ax
push ecx
push dword [ecx]
lea eax, [ebp - 0x49c]
mov byte [ebp - 4], 9
push eax
lea ecx, [ebp - 0x4a8]
call fcn.004134d0
push 0x2c
push 1
push dword [ebp - 0x4a8]
call fcn.00407050
mov eax, dword [ebp - 0x484]
add esp, 0xc
cmp eax, 8
jb 0x41275a
inc eax
lea ecx, [ebp - 0x498]
push eax
push dword [ebp - 0x498]
call fcn.00409050
xor eax, eax
mov dword [ebp - 0x484], 7
mov word [ebp - 0x498], ax
mov eax, dword [ebp - 0x424]
mov dword [ebp - 0x488], 0
cmp eax, 8
jb 0x412795
inc eax
lea ecx, [ebp - 0x438]
push eax
push dword [ebp - 0x438]
call fcn.00409050
xor eax, eax
mov dword [ebp - 0x424], 7
mov dword [ebp - 0x428], 0
mov word [ebp - 0x438], ax
mov eax, dword [ebp - 0x43c]
cmp eax, 8
jb 0x4127d0
inc eax
lea ecx, [ebp - 0x450]
push eax
push dword [ebp - 0x450]
call fcn.00409050
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004273c3
mov esp, ebp
pop ebp
ret 4