Function at 0x40683a
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x18
mov eax, dword [ebp + 0xc]
mov ecx, dword [0x424cb8]
test eax, eax
js 0x406ab2
lea esi, [eax + ecx]
mov eax, dword [ebp + 8]
sub eax, 0x4255e0
mov dword [ebp - 0x24], 0x4255e0
cmp eax, 0x7ff
ja 0x40687a
mov eax, dword [ebp + 8]
mov dword [ebp - 0x24], eax
mov dword [ebp + 8], 0
mov cl, byte [esi]
test cl, cl
je 0x406909
mov eax, dword [ebp - 0x24]
sub eax, 0x4255e0
cmp eax, 0x3ff
jg 0x406909
inc esi
cmp cl, 0xfc
jbe 0x406a8e
mov al, byte [esi + 1]
movsx edx, byte [esi]
and eax, 0x7f
mov dword [ebp - 0x1c], edx
movsx ebx, al
shl ebx, 7
mov eax, edx
and eax, 0x7f
or ebx, eax
movsx eax, byte [esi]
or eax, 0x8000
mov dword [ebp - 0x18], eax
movsx eax, byte [esi + 1]
mov dword [ebp - 0x14], eax
movsx eax, byte [esi + 1]
or eax, 0x8000
add esi, 2
mov dword [ebp - 0x10], eax
cmp cl, 0xfe
je 0x40697d
cmp cl, 0xfd
je 0x406940
inc cl
je 0x406933
push dword [ebp - 0x24]
call fcn.004067a5
add dword [ebp - 0x24], eax
mov cl, byte [esi]
test cl, cl
je 0x406909
mov eax, dword [ebp - 0x24]
sub eax, 0x4255e0
cmp eax, 0x3ff
jle 0x406893
mov edx, dword [ebp - 0x24]
mov byte [edx], 0
cmp dword [ebp + 8], 0
je 0x40692c
push 0x4255e0
push dword [ebp + 8]
call fcn.0040678e
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 8
mov eax, 0x4255e0
jmp 0x406922
not ebx
push ebx
push dword [ebp - 0x24]
call fcn.0040683a
jmp 0x4068e9
cmp ebx, 0x1d
je 0x40696d
mov eax, ebx
shl eax, 0xa
add eax, section..ndata
push eax
push dword [ebp - 0x24]
call fcn.0040678e
lea eax, [ebx - 0x15]
cmp eax, 6
ja 0x4068e9
push dword [ebp - 0x24]
call fcn.00406ad3
jmp 0x4068e9
push dword [0x424d20]
push dword [ebp - 0x24]
call fcn.004066c9
jmp 0x406958
mov edi, 2
cmp dword [0x424c34], 0
je 0x406990
mov edi, 4
cmp byte [ebp - 0x1c], 0
js 0x406a59
cmp edx, 0x25
je 0x406a4a
cmp edx, 0x24
je 0x406a36
dec edi
cmp edi, 0xffffffff
je 0x4069f5
mov eax, dword [0x424d10]
test eax, eax
je 0x4069d2
push dword [ebp - 0x24]
push 0
push 0
push dword [ebp + edi*4 - 0x1c]
push dword [0x424d20]
call eax
test eax, eax
je 0x4069f5
lea eax, [ebp - 0x20]
push eax
push dword [ebp + edi*4 - 0x1c]
push dword [0x424d20]
call sub.SHELL32.DLL_SHGetSpecialFolderLocation
test eax, eax
je 0x406a1b
mov eax, dword [ebp - 0x24]
dec edi
cmp edi, 0xffffffff
mov byte [eax], 0
jne 0x4069b2
mov edx, dword [ebp - 0x24]
cmp byte [edx], 0
je 0x406960
cmp dword [ebp - 0x14], 0x1a
jne 0x406960
push 0x406810
push edx
call fcn.004067ae
jmp 0x406960
push dword [ebp - 0x24]
push dword [ebp - 0x20]
call sub.SHELL32.DLL_SHGetPathFromIDListA
mov ebx, eax
push dword [ebp - 0x20]
call sub.OLE32.dll_CoTaskMemFree
test ebx, ebx
je 0x4069e9
jmp 0x4069f5
push 0x400
push dword [ebp - 0x24]
call sub.KERNEL32.dll_GetWindowsDirectoryA
xor edi, edi
jmp 0x4069ac
push 0x400
push dword [ebp - 0x24]
call sub.KERNEL32.dll_GetSystemDirectoryA
jmp 0x406a43
mov eax, edx
and edx, 0x3f
and eax, 0x40
add edx, dword [0x424cb8]
push eax
push dword [ebp - 0x24]
push edx
push 0x4067d0
push 0x80000002
call fcn.0040664e
mov edx, dword [ebp - 0x24]
cmp byte [edx], 0
jne 0x406a43
push dword [ebp - 0x14]
push edx
call fcn.0040683a
jmp 0x406a43
cmp cl, 0xfc
je 0x406aa1
mov eax, dword [ebp - 0x24]
mov byte [eax], cl
inc eax
mov dword [ebp - 0x24], eax
jmp 0x4068f4
mov edx, dword [ebp - 0x24]
mov al, byte [esi]
inc esi
mov byte [edx], al
inc edx
mov dword [ebp - 0x24], edx
jmp 0x4068f4
lea edx, [eax*4]
mov esi, ecx
mov eax, dword [0x4255d0]
sub eax, edx
add esi, dword [eax - 4]
jmp 0x406857