Function at 0x405932
Capabilities:
Get common file path

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x1c
test eax, eax
jns 0x40594e
mov ecx, dword [0x42e8c0]
lea eax, [eax*4 + 4]
sub ecx, eax
mov eax, dword [ecx]
mov ecx, dword [0x42f118]
mov edx, 0x42e080
push ebp
mov ebp, dword [esp + 0x24]
add ecx, eax
push edi
mov edi, edx
cmp ebp, edx
jb 0x40597a
mov eax, ebp
sub eax, edx
cmp eax, 0x800
jae 0x40597a
mov edi, ebp
xor ebp, ebp
mov dword [esp + 0x28], ebp
cmp byte [ecx], 0
je 0x405b87
push ebx
push esi
mov eax, edi
mov ebx, ecx
sub eax, edx
mov dword [esp + 0x18], ebx
cmp eax, 0x400
jge 0x405b81
mov dl, byte [ecx]
cmp dl, 4
jae 0x405b5d
movsx ebp, byte [ebx + 2]
movsx ecx, byte [ecx + 1]
mov esi, ebp
and esi, 0x7f
mov dword [esp + 0x14], ebp
mov eax, ecx
shl esi, 7
and eax, 0x7f
mov dword [esp + 0x20], ecx
or esi, eax
mov dword [esp + 0x28], ebp
mov eax, ecx
or eax, 0x8000
mov dword [esp + 0x1c], eax
mov eax, ebp
or eax, 0x8000
mov dword [esp + 0x24], eax
cmp dl, 2
jne 0x405b09
mov eax, dword [0x42f0e0]
test eax, eax
jns 0x405a08
mov edx, 0x5a04
cmp ax, dx
je 0x405a08
cmp ebp, 0x23
je 0x405a08
cmp ebp, 0x2e
je 0x405a08
xor eax, eax
jmp 0x405a0b
xor eax, eax
inc eax
cmp dword [0x42f1a4], 0
push 2
pop ebx
push 4
mov dword [esp + 0x38], eax
pop eax
cmovne ebx, eax
test cl, cl
jns 0x405a58
mov eax, ecx
and ecx, 0x3f
add ecx, dword [0x42f118]
and eax, 0x40
push eax
push edi
push ecx
push str.SoftwareMicrosoftWindowsCurrentVersion
push 0x80000002
call fcn.00406335
cmp byte [edi], 0
jne 0x405aec
push ebp
push edi
call fcn.00405932
jmp 0x405ae7
cmp ecx, 0x25
jne 0x405a6b
push 0x400
push edi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
jmp 0x405ae7
cmp ecx, 0x24
jne 0x405a7e
push 0x400
push edi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
xor ebx, ebx
test ebx, ebx
je 0x405ae7
mov ebp, dword [esp + 0x34]
mov eax, dword [0x42e8d0]
dec ebx
test eax, eax
je 0x405aa9
test ebp, ebp
je 0x405aa9
push edi
push 0
push 0
push dword [esp + ebx*4 + 0x28]
push dword [0x42e8d8]
call eax
test eax, eax
je 0x405ae3
lea eax, [esp + 0x10]
push eax
push dword [esp + ebx*4 + 0x20]
push dword [0x42e8d8]
call sub.SHELL32.dll_SHGetSpecialFolderLocation
test eax, eax
jne 0x405adc
push edi
push dword [esp + 0x14]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
push dword [esp + 0x10]
mov esi, eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
test esi, esi
jne 0x405ae3
mov byte [edi], 0
test ebx, ebx
jne 0x405a86
mov ebp, dword [esp + 0x14]
cmp byte [edi], 0
je 0x405afd
cmp ebp, 0x1a
jne 0x405afd
push str.MicrosoftInternet_ExplorerQuick_Launch
push edi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push edi
call fcn.00406696
mov ebx, dword [esp + 0x18]
jmp 0x405b50
cmp dl, 3
jne 0x405b42
cmp esi, 0x1d
jne 0x405b21
push dword [0x42e8d8]
push edi
call fcn.00405fc6
jmp 0x405b32
mov eax, esi
shl eax, 0xa
add eax, section..ndata
push eax
push edi
call fcn.004064c9
lea eax, [esi - 0x15]
cmp eax, 7
jae 0x405b50
push edi
call fcn.00406696
jmp 0x405b50
cmp dl, 1
jne 0x405b50
not esi
push esi
push edi
call fcn.00405932
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add edi, eax
push 3
jmp 0x405b67
jne 0x405b6a
mov al, byte [ecx + 1]
mov byte [edi], al
inc edi
push 2
pop eax
jmp 0x405b70
mov byte [edi], dl
xor eax, eax
inc edi
inc eax
lea ecx, [ebx + eax]
mov edx, 0x42e080
cmp byte [ecx], 0
jne 0x405985
mov ebp, dword [esp + 0x30]
pop esi
pop ebx
mov byte [edi], 0
test ebp, ebp
je 0x405b97
push edx
push ebp
call fcn.004064c9
jmp 0x405b99
mov eax, edx
pop edi
pop ebp
add esp, 0x1c
ret 8