Function at 0x4066c3
Capabilities:
Get common file path

Disassembly:
sub esp, 0x14
push ebp
mov ebp, dword [esp + 0x20]
test ebp, ebp
push esi
jge 0x4066e1
mov ecx, dword [0x4237a8]
lea eax, [ebp*4 + 4]
sub ecx, eax
mov ebp, dword [ecx]
mov eax, dword [0x423ff8]
mov ecx, dword [esp + 0x20]
add ebp, eax
mov eax, 0x422f60
sub ecx, eax
cmp ecx, 0x800
mov esi, eax
jae 0x406706
mov esi, dword [esp + 0x20]
and dword [esp + 0x20], 0
mov dl, byte [ebp]
test dl, dl
je 0x4068d0
push ebx
push edi
mov ecx, esi
sub ecx, eax
cmp ecx, 0x400
jge 0x4068ce
inc ebp
cmp dl, 0xfc
jbe 0x4068b0
movsx eax, byte [ebp + 1]
movsx ecx, byte [ebp]
mov edi, eax
and edi, 0x7f
mov ebx, ecx
and ebx, 0x7f
shl edi, 7
or edi, ebx
mov ebx, 0x8000
mov dword [esp + 0x14], ecx
or ecx, ebx
mov dword [esp + 0x1c], eax
or eax, ebx
inc ebp
inc ebp
cmp dl, 0xfe
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], eax
jne 0x40685a
xor edi, edi
cmp dword [esp + 0x1c], 4
mov dword [esp + 0x2c], edi
mov byte [esi], 0
jne 0x406783
push 2
mov dword [esp + 0x30], str.MicrosoftInternet_ExplorerQuick_Launch
pop edi
mov ebx, dword [esp + 0x14]
cmp ebx, 0x2b
jne 0x4067a1
push esi
push str.CommonFilesDir
push str.SoftwareMicrosoftWindowsCurrentVersion
push 0x80000002
call fcn.004061ea
cmp ebx, 0x26
jne 0x4067cc
push esi
push str.ProgramFilesDir
push str.SoftwareMicrosoftWindowsCurrentVersion
push 0x80000002
call fcn.004061ea
cmp byte [esi], 0
jne 0x40683d
push str.C:Program_Files
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp ebx, 0x25
jne 0x4067dd
push 0x400
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp ebx, 0x24
jne 0x4067ee
push 0x400
push esi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
cmp byte [esi], 0
jne 0x40683d
cmp dword [0x424044], 0
push 4
pop edi
jne 0x406804
push 2
pop edi
jmp 0x40683d
lea eax, [esp + 0x10]
push eax
push dword [esp + edi*4 + 0x14]
dec edi
push dword [0x423fc0]
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x40683a
push esi
push dword [esp + 0x14]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
push dword [esp + 0x10]
mov ebx, eax
call fcn.00405fcf
test ebx, ebx
jne 0x406841
jmp 0x40683d
mov byte [esi], 0
test edi, edi
jne 0x406804
cmp byte [esi], 0
je 0x40688c
cmp dword [esp + 0x2c], 0
je 0x40688c
push dword [esp + 0x2c]
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
jmp 0x40688c
cmp dl, 0xfd
jne 0x40689d
cmp edi, 0x1b
jne 0x406872
push dword [0x423fc0]
push esi
call fcn.00406254
jmp 0x406884
mov eax, edi
shl eax, 0xa
add eax, section..ndata
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
add edi, 0xffffffeb
cmp edi, 6
jae 0x406892
push esi
call fcn.00406302
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add esi, eax
jmp 0x4068be
cmp dl, 0xff
jne 0x4068be
or eax, 0xffffffff
sub eax, edi
push eax
push esi
call fcn.004066c3
jmp 0x406892
jne 0x4068bb
mov al, byte [ebp]
mov byte [esi], al
inc esi
inc ebp
jmp 0x4068be
mov byte [esi], dl
inc esi
mov dl, byte [ebp]
test dl, dl
mov eax, 0x422f60
jne 0x406713
pop edi
pop ebx
cmp dword [esp + 0x20], 0
mov byte [esi], 0
pop esi
pop ebp
je 0x4068ec
push 0x400
push eax
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
add esp, 0x14
ret 8