Function at 0x404400
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x880
mov eax, dword [0x4c32cc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor ebx, ebx
push 0x103
lea eax, [ebp - 0x637]
push ebx
push eax
mov byte [ebp - 0x638], bl
call fcn.004a3190
add esp, 0xc
push 0x103
lea ecx, [ebp - 0x52f]
push ebx
push ecx
mov byte [ebp - 0x530], bl
call fcn.004a3190
add esp, 0xc
push 0x103
lea edx, [ebp - 0x427]
push ebx
push edx
mov byte [ebp - 0x428], bl
call fcn.004a3190
add esp, 0xc
push 0x103
lea eax, [ebp - 0x217]
push ebx
push eax
mov byte [ebp - 0x218], bl
call fcn.004a3190
add esp, 0xc
push 0x103
lea ecx, [ebp - 0x31f]
push ebx
push ecx
mov byte [ebp - 0x320], bl
call fcn.004a3190
add esp, 0xc
push 0x103
lea edx, [ebp - 0x10f]
push ebx
push edx
mov byte [ebp - 0x110], bl
call fcn.004a3190
add esp, 0xc
call fcn.004029f0
test eax, eax
jne 0x4044d4
mov byte [edi], bl
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a01d6
mov esp, ebp
pop ebp
ret
push 0x104
push str.EDGEBrowserBasePath
push str.SoftwareBillP_StudiosWinPatrol
lea ecx, [ebp - 0x638]
mov edx, 0x80000001
call fcn.0048e050
mov ecx, dword [0x4c78c4]
add esp, 0xc
push ebx
push 0x1c
lea eax, [ebp - 0x740]
push eax
push ecx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea edx, [ebp - 0x740]
push edx
mov edx, 0x7ffffffe
mov eax, 0x104
lea ecx, [ebp - 0x428]
call fcn.00401000
push str.MicrosoftEdgeCookies
lea eax, [ebp - 0x428]
push eax
push str._s_s
lea ecx, [ebp - 0x218]
push 0x104
push ecx
call fcn.00402830
add esp, 0x14
mov edx, 0x104
lea eax, [ebp - 0x110]
lea esp, [esp]
cmp byte [eax], bl
je 0x40456a
inc eax
dec edx
jne 0x404560
jmp 0x404594
cmp edx, ebx
je 0x404594
mov ecx, 0x104
sub ecx, edx
lea edx, [ebp - 0x218]
mov eax, 0x104
push edx
sub eax, ecx
lea ecx, [ebp + ecx - 0x110]
mov edx, 0x7fffffff
call fcn.00401000
mov edx, 0x104
lea eax, [ebp - 0x428]
nop
cmp byte [eax], bl
je 0x4045aa
inc eax
dec edx
jne 0x4045a0
jmp 0x4045d2
cmp edx, ebx
je 0x4045d2
mov ecx, 0x104
sub ecx, edx
mov eax, 0x104
sub eax, ecx
push str.PackagesMicrosoft.MicrosoftEdge
lea ecx, [ebp + ecx - 0x428]
mov edx, 0x7fffffff
call fcn.00401000
lea eax, [ebp - 0x880]
push eax
lea ecx, [ebp - 0x428]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x4046ba
lea edx, [ebp - 0x854]
push edx
mov edx, 0x7ffffffe
mov eax, 0x104
lea ecx, [ebp - 0x218]
call fcn.00401000
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
lea eax, [ebp - 0x218]
push eax
push str.Packages_
lea ecx, [ebp - 0x740]
push ecx
push 0x4b1c14
lea edx, [ebp - 0x320]
push 0x104
push edx
call fcn.00402830
lea eax, [ebp - 0x320]
push eax
push 0x4b19e0
lea ecx, [ebp - 0x218]
push 0x104
push ecx
call fcn.00402830
push str.EDGEBrowserBasePath
push str.SoftwareBillP_StudiosWinPatrol
lea ecx, [ebp - 0x320]
mov edx, 0x80000001
call fcn.0048e390
push str.ACACMicrosoftEdgeCookies
push str.ACINetCookiesLow
push str.ACINetCookies
push str.__s__s__s
lea edx, [ebp - 0x530]
push 0x104
push edx
call fcn.00402830
add esp, 0x48
mov eax, 0x104
lea ecx, [ebp - 0x110]
cmp byte [ebp - 0x110], bl
je 0x4046f0
nop
cmp byte [ecx], bl
je 0x4046d5
inc ecx
dec eax
jne 0x4046b0
jmp 0x404724
xor eax, eax
cmp byte [ebp - 0x110], bl
setne al
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a01d6
mov esp, ebp
pop ebp
ret
cmp eax, ebx
je 0x404724
mov ecx, 0x104
sub ecx, eax
lea eax, [ebp - 0x530]
push eax
jmp 0x40470c
cmp byte [ecx], bl
je 0x4046fa
inc ecx
dec eax
jne 0x4046f0
jmp 0x404724
cmp eax, ebx
je 0x404724
mov ecx, 0x104
lea edx, [ebp - 0x52f]
sub ecx, eax
push edx
mov eax, 0x104
sub eax, ecx
mov edx, 0x7fffffff
lea ecx, [ebp + ecx - 0x110]
call fcn.00401000
push str.AC_
lea eax, [ebp - 0x218]
push eax
push str._s_s
lea ecx, [ebp - 0x530]
push 0x104
push ecx
call fcn.00402830
add esp, 0x14
lea ebx, [ebp - 0x320]
lea ecx, [ebp - 0x530]
call fcn.00484660
cmp byte [ebp - 0x110], 0
mov edx, 0x104
lea eax, [ebp - 0x110]
jne 0x404796
mov edi, edi
cmp byte [eax], 0
je 0x40477e
inc eax
dec edx
jne 0x404770
jmp 0x404809
test edx, edx
je 0x404809
mov ecx, 0x104
sub ecx, edx
lea edx, [ebp - 0x320]
push edx
jmp 0x4047f1
cmp byte [eax], 0
je 0x4047a1
inc eax
dec edx
jne 0x404796
jmp 0x4047c9
test edx, edx
je 0x4047c9
mov ecx, 0x104
sub ecx, edx
mov eax, 0x104
sub eax, ecx
push 0x4b1c70
lea ecx, [ebp + ecx - 0x110]
mov edx, 0x7fffffff
call fcn.00401000
mov edx, 0x104
lea eax, [ebp - 0x110]
cmp byte [eax], 0
je 0x4047df
inc eax
dec edx
jne 0x4047d4
jmp 0x404809
test edx, edx
je 0x404809
mov ecx, 0x104
lea eax, [ebp - 0x320]
sub ecx, edx
push eax
mov eax, 0x104
sub eax, ecx
mov edx, 0x7fffffff
lea ecx, [ebp + ecx - 0x110]
call fcn.00401000
lea ecx, [ebp - 0x110]
push ecx
mov edx, 0x7ffffffe
mov eax, 0x104
mov ecx, edi
call fcn.00401000
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
mov eax, 1
pop ebx
call fcn.004a01d6
mov esp, ebp
pop ebp
ret