Function at 0x406369
Capabilities:
Get common file path

Disassembly:
mov ecx, dword [esp + 8]
sub esp, 0x20
test ecx, ecx
jns 0x406385
lea eax, [ecx*4 + 4]
mov ecx, dword [0x46bda0]
sub ecx, eax
mov ecx, dword [ecx]
mov eax, dword [0x473df8]
mov edx, 0x463d40
push ebx
push ebp
mov ebp, dword [esp + 0x2c]
lea ebx, [eax + ecx*2]
xor ecx, ecx
push edi
mov edi, edx
cmp ebp, edx
jb 0x4063b6
mov eax, ebp
sub eax, edx
sar eax, 1
cmp eax, 0x4008
jae 0x4063b6
mov edi, ebp
mov ebp, ecx
mov dword [esp + 0x30], ebp
movzx ecx, word [ebx]
test cx, cx
je 0x40660c
push esi
mov esi, 0xe000
xor ebp, ebp
mov eax, edi
sub eax, edx
and eax, 0xfffffffe
cmp eax, 0x4008
jge 0x406607
movzx ecx, cx
add ebx, 2
test esi, ecx
je 0x4065e2
cmp cx, si
jbe 0x4065e5
movzx edx, word [ebx]
add ebx, 2
movzx eax, dl
mov esi, edx
mov dword [esp + 0x18], eax
and esi, 0x7fff
mov dword [esp + 0x24], eax
or eax, 0x8000
shr edx, 8
mov dword [esp + 0x20], eax
mov eax, edx
or eax, 0x8000
mov dword [esp + 0x38], edx
mov dword [esp + 0x28], eax
mov eax, 0xe002
mov dword [esp + 0x2c], edx
mov dword [esp + 0x1c], ebx
cmp cx, ax
jne 0x406577
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov esi, dword [esp + 0x38]
test eax, eax
jns 0x406463
mov ecx, 0x5a04
cmp ax, cx
je 0x406463
cmp esi, 0x23
je 0x406463
mov dword [esp + 0x10], ebp
cmp esi, 0x2e
jne 0x40646b
mov dword [esp + 0x10], 1
cmp dword [0x473e84], 0
mov ecx, dword [esp + 0x18]
push 2
pop ebx
push 4
pop eax
cmovne ebx, eax
test cl, cl
jns 0x4064ba
mov eax, ecx
and ecx, 0x3f
and eax, 0x40
push eax
mov eax, dword [0x473df8]
push edi
lea eax, [eax + ecx*2]
push eax
push str.SoftwareMicrosoftWindowsCurrentVersion
push 0x80000002
call fcn.00406f1d
cmp word [edi], bp
jne 0x406558
push esi
push edi
call fcn.00406369
jmp 0x406553
cmp ecx, 0x25
jne 0x4064d0
push 0x2004
push edi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
jmp 0x406553
cmp ecx, 0x24
jne 0x4064e7
push 0x2004
push edi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
xor ecx, ecx
mov ebx, ecx
jmp 0x4064e9
xor ecx, ecx
test ebx, ebx
je 0x406551
mov ebp, dword [esp + 0x10]
mov eax, dword [0x46bdb0]
dec ebx
test eax, eax
je 0x406512
test ebp, ebp
je 0x406512
push edi
push ecx
push ecx
push dword [esp + ebx*4 + 0x2c]
push dword [0x46bdb8]
call eax
test eax, eax
je 0x406551
lea eax, [esp + 0x14]
push eax
push dword [esp + ebx*4 + 0x24]
push dword [0x46bdb8]
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x406546
push edi
push dword [esp + 0x18]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
push dword [esp + 0x14]
mov esi, eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
test esi, esi
jne 0x406551
xor eax, eax
mov word [edi], ax
push eax
pop ecx
test ebx, ebx
jne 0x4064f1
xor ebp, ebp
cmp word [edi], bp
je 0x40656b
cmp dword [esp + 0x38], 0x1a
jne 0x40656b
push str.MicrosoftInternet_ExplorerQuick_Launch
push edi
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push edi
call fcn.004073a6
mov ebx, dword [esp + 0x1c]
jmp 0x4065cc
mov eax, 0xe001
cmp cx, ax
jne 0x4065b6
cmp esi, 0x1d
jne 0x406594
push dword [0x46bdb8]
push edi
call fcn.004071aa
jmp 0x4065a6
imul eax, esi, 0x4008
add eax, section..ndata
push eax
push edi
call fcn.00407220
lea eax, [esi - 0x15]
cmp eax, 7
jae 0x4065cc
push edi
call fcn.004073a6
jmp 0x4065cc
mov eax, 0xe003
cmp cx, ax
jne 0x4065cc
or eax, 0xffffffff
sub eax, esi
push eax
push edi
call fcn.00406369
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edx, 0x463d40
mov esi, 0xe000
lea edi, [edi + eax*2]
jmp 0x4065fb
cmp cx, si
jne 0x4065f5
mov ax, word [ebx]
mov word [edi], ax
add edi, 2
add ebx, 2
jmp 0x4065fb
mov word [edi], cx
add edi, 2
movzx ecx, word [ebx]
test cx, cx
jne 0x4063ca
mov ebp, dword [esp + 0x34]
pop esi
xor eax, eax
mov word [edi], ax
test ebp, ebp
je 0x40661e
push edx
push ebp
call fcn.00407220
jmp 0x406620
mov eax, edx
pop edi
pop ebp
pop ebx
add esp, 0x20
ret 8