Function at 0x405c7f
Capabilities:
Get common file path

Disassembly:
mov eax, 0x4181bc
call fcn.0040fa68
sub esp, 0x20
mov eax, dword [0x4200d0]
push ebx
push esi
push edi
mov ecx, 0x4200d0
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x18], eax
and dword [ebp - 4], 0
mov edi, 0x104
mov edx, edi
lea esi, [ebp - 0x18]
call fcn.00406d1d
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov ebx, eax
neg ebx
sbb bl, bl
or eax, 0xffffffff
mov ecx, esi
inc bl
call fcn.004066f0
test bl, bl
je 0x405cdf
call fcn.0040442e
mov esi, eax
jmp 0x405ecb
mov eax, dword [0x4200d0]
mov ecx, 0x4200d0
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
mov edx, edi
lea esi, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.00406d1d
push eax
push 0
push 0x41abbc
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
mov ebx, eax
neg ebx
sbb bl, bl
or eax, 0xffffffff
mov ecx, esi
inc bl
call fcn.004066f0
test bl, bl
je 0x405d33
call fcn.0040442e
mov esi, eax
jmp 0x405ec0
mov eax, dword [ebp - 0x10]
push ecx
add eax, 0xfffffff0
mov dword [ebp - 0x20], esp
mov esi, esp
call fcn.00407184
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x2c]
push 0x40a988
push eax
call fcn.004076be
add esp, 0xc
lea ebx, [ebp - 0x20]
mov byte [ebp - 4], 2
call fcn.00407dbd
mov byte [ebp - 4], 3
mov ebx, dword [ebp - 0x20]
cmp dword [ebx - 0xc], 0
jne 0x405d96
lea eax, [ebx - 0x10]
call fcn.0040328d
mov byte [ebp - 4], 1
cmp byte [ebp - 0x2c], 0
jne 0x405d8c
push dword [ebp - 0x24]
call dword [ebp - 0x28]
pop ecx
mov esi, 0x80004005
jmp 0x405eb5
push 1
push dword [ebp - 0x10]
push ebx
call fcn.0040c5c6
add esp, 0xc
test eax, eax
jge 0x405dd1
call fcn.0040442e
mov esi, eax
lea eax, [ebx - 0x10]
call fcn.0040328d
mov byte [ebp - 4], 1
cmp byte [ebp - 0x2c], 0
jne 0x405eb5
push dword [ebp - 0x24]
call dword [ebp - 0x28]
pop ecx
jmp 0x405eb5
push str.215E16EB_DAF1_4683_8DDA_5452BFA0A99D
lea esi, [ebp - 0x14]
call fcn.0040bdb5
mov eax, esi
mov byte [ebp - 4], 4
call fcn.0040be0f
test al, al
jne 0x405dff
call fcn.0040442e
push dword [ebp - 0x14]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x405daf
mov eax, dword [0x4200d0]
mov ecx, 0x4200d0
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 5
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push str.ppid
push str.delete
lea eax, [ebp - 0x1c]
push str.__s___s_d
push eax
call fcn.00406552
mov esi, dword [ebp - 0x1c]
push esi
push dword [ebp - 0x10]
call fcn.0040bbd4
mov edi, eax
add esp, 0x1c
test edi, edi
jge 0x405e78
lea eax, [esi - 0x10]
call fcn.0040328d
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebx - 0x10]
call fcn.0040328d
mov byte [ebp - 4], 1
cmp byte [ebp - 0x2c], 0
jne 0x405e74
push dword [ebp - 0x24]
call dword [ebp - 0x28]
pop ecx
mov esi, edi
jmp 0x405eb5
push 0x2710
lea eax, [ebp - 0x14]
call fcn.0040be1e
lea eax, [esi - 0x10]
mov byte [ebp - 0x2c], 1
call fcn.0040328d
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebx - 0x10]
call fcn.0040328d
mov byte [ebp - 4], 1
cmp byte [ebp - 0x2c], 0
jne 0x405eb3
push dword [ebp - 0x24]
call dword [ebp - 0x28]
pop ecx
xor esi, esi
mov eax, dword [ebp - 0x24]
add eax, 0xfffffff0
call fcn.0040328d
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.0040328d
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
call fcn.0040328d
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret