Function at 0x405a00
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x464a79
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xa44
mov ecx, dword [esp + 0xa54]
push ebx
push ebp
push esi
lea eax, [esp + 0x14c]
push edi
push eax
push ecx
call fcn.00405130
add esp, 8
xor ebx, ebx
lea edx, [esp + 0x4c]
mov byte [esp + 0x4c], 0
push ebx
push 0x1a
push edx
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
mov edi, str.Apple_ComputerSafariCookiescookies.plist
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x4c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [0x47469c]
mov ecx, ebp
and ecx, 3
mov dword [esp + 0x10], eax
rep movsb byte es:[edi], byte [esi]
mov dword [esp + 0xa5c], ebx
mov dword [esp + 0x14], eax
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x48], ebx
mov dword [esp + 0x44], ebx
mov dword [esp + 0x40], ebx
push ebx
lea ecx, [esp + 0x14]
mov byte [esp + 0xa60], 3
call fcn.00401450
mov dword [esp + 0x38], ebx
lea eax, [esp + 0x4c]
lea ecx, [esp + 0x10]
push eax
mov dword [esp + 0xa60], 4
call fcn.004014d0
test al, al
jne 0x405b9a
mov ecx, dword [esp + 0x44]
xor esi, esi
dec ecx
mov dword [esp + 0xa5c], 7
sar ecx, 0x10
inc ecx
test ecx, ecx
jle 0x405b0e
mov edx, dword [esp + 0x40]
mov eax, dword [edx + esi*4]
push eax
call fcn.0045e8a5
mov eax, dword [esp + 0x48]
add esp, 4
inc esi
dec eax
sar eax, 0x10
inc eax
cmp esi, eax
jl 0x405af0
mov eax, dword [esp + 0x40]
cmp eax, ebx
je 0x405b1f
push eax
call fcn.0045e8a5
add esp, 4
mov ecx, dword [esp + 0x3c]
mov byte [esp + 0xa5c], 6
cmp ecx, ebx
je 0x405b6a
xor edi, edi
mov eax, dword [edi + ecx]
cmp eax, ebx
je 0x405b59
mov ecx, dword [eax - 4]
lea esi, [eax - 4]
push 0x401440
push ecx
push 0xc
push eax
call fcn.004524d6
push esi
call fcn.0045e8a5
mov ecx, dword [esp + 0x40]
add esp, 4
add edi, 4
cmp edi, 0x1c
jl 0x405b31
push ecx
call fcn.0045e8a5
add esp, 4
lea ecx, [esp + 0x14]
mov dword [esp + 0x3c], ebx
mov byte [esp + 0xa5c], 5
call fcn.0045e3c6
lea ecx, [esp + 0x10]
mov dword [esp + 0xa5c], 0xffffffff
call fcn.0045e3c6
xor al, al
jmp 0x405cfb
mov ebp, dword [esp + 0xa68]
lea edx, [esp + 0x254]
push edx
push ebx
push 0x46f458
push ebp
call fcn.00404fb0
mov ebx, eax
add esp, 0x10
xor esi, esi
test ebx, ebx
jle 0x405c2a
lea eax, [esp + 0x254]
push eax
push esi
push 0x46f458
push ebp
call fcn.00404fb0
lea edi, [esp + 0x264]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x10
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x405c25
lea ecx, [esp + 0x254]
push 0x46f388
push ecx
call fcn.00453990
add esp, 8
test eax, eax
je 0x405c25
mov byte [eax], 0
inc eax
push eax
lea edx, [esp + 0x258]
lea eax, [esp + 0x154]
push edx
lea ecx, [esp + 0x18]
push eax
push ecx
call fcn.00405540
add esp, 0x10
inc esi
cmp esi, ebx
jl 0x405bc0
lea edx, [esp + 0x4c]
lea ecx, [esp + 0x10]
push edx
call fcn.00401610
mov eax, dword [esp + 0x44]
xor esi, esi
dec eax
mov dword [esp + 0xa5c], 0xa
sar eax, 0x10
inc eax
test eax, eax
jle 0x405c70
mov ecx, dword [esp + 0x40]
mov eax, dword [ecx + esi*4]
push eax
call fcn.0045e8a5
mov edx, dword [esp + 0x48]
add esp, 4
inc esi
dec edx
sar edx, 0x10
inc edx
cmp esi, edx
jl 0x405c52
mov eax, dword [esp + 0x40]
test eax, eax
je 0x405c81
push eax
call fcn.0045e8a5
add esp, 4
mov ecx, dword [esp + 0x3c]
mov byte [esp + 0xa5c], 9
test ecx, ecx
je 0x405ccc
xor edi, edi
mov eax, dword [edi + ecx]
test eax, eax
je 0x405cbb
mov ecx, dword [eax - 4]
lea esi, [eax - 4]
push 0x401440
push ecx
push 0xc
push eax
call fcn.004524d6
push esi
call fcn.0045e8a5
mov ecx, dword [esp + 0x40]
add esp, 4
add edi, 4
cmp edi, 0x1c
jl 0x405c93
push ecx
call fcn.0045e8a5
add esp, 4
lea ecx, [esp + 0x14]
mov dword [esp + 0x3c], 0
mov byte [esp + 0xa5c], 8
call fcn.0045e3c6
lea ecx, [esp + 0x10]
mov dword [esp + 0xa5c], 0xffffffff
call fcn.0045e3c6
mov al, 1
mov ecx, dword [esp + 0xa54]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0xa50
ret