Function at 0x1033a1b
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x578
mov eax, dword [0x1046080]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push 1
push 0xb
push edi
mov dword [ebp - 4], eax
mov dword [ebp - 0x520], ecx
mov dword [ebp - 0x530], edi
call dword [sym.imp.SHELL32.dll_SHCloneSpecialIDList]
mov ecx, dword [ebp - 0x520]
mov ebx, eax
xor esi, esi
push esi
mov dword [ebp - 0x528], ebx
call fcn.01002673
push edi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
cmp ebx, esi
je 0x1033d79
push ebx
call dword [sym.imp.SHELL32.dll_ILFindLastID]
push eax
call dword [sym.imp.SHELL32.dll_ILClone]
push ebx
mov dword [ebp - 0x524], eax
call dword [sym.imp.SHELL32.dll_ILRemoveLastID]
cmp dword [ebp - 0x524], esi
je 0x1033d6d
push ebx
call fcn.0103ace9
mov ebx, eax
cmp ebx, esi
mov dword [ebp - 0x538], ebx
je 0x1033d61
call dword [sym.imp.USER32.dll_CreatePopupMenu]
cmp eax, esi
mov dword [ebp - 0x51c], eax
je 0x1033d5b
mov eax, dword [ebx]
lea ecx, [ebp - 0x52c]
push ecx
push esi
push 0x1009ae8
lea ecx, [ebp - 0x524]
push ecx
push 1
push edi
push ebx
call dword [eax + 0x28]
test eax, eax
jl 0x1033d4f
mov eax, dword [ebp - 0x52c]
mov ecx, dword [eax]
push 2
push 0x7fef
push 2
push esi
push dword [ebp - 0x51c]
push eax
call dword [ecx + 0xc]
test eax, eax
jl 0x1033d3d
mov ebx, dword [sym.imp.USER32.dll_LoadStringW]
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0x2d0
push dword [0x10460dc]
call ebx
mov edi, dword [sym.imp.USER32.dll_AppendMenuW]
lea eax, [ebp - 0x20c]
push eax
push 0x7ff2
push esi
push dword [ebp - 0x51c]
call edi
push 0x400000
call dword [sym.imp.SHELL32.dll_SHRestricted]
test eax, eax
jne 0x1033beb
lea eax, [ebp - 0x20c]
push eax
push esi
push esi
push 0x16
push esi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x534], eax
je 0x1033beb
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
cmp eax, esi
je 0x1033beb
push esi
push esi
push 0x800
push dword [ebp - 0x51c]
call edi
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0x2ce
push dword [0x10460dc]
call ebx
lea eax, [ebp - 0x20c]
push eax
push 0x7ff0
push esi
push dword [ebp - 0x51c]
call edi
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0x2cf
push dword [0x10460dc]
call ebx
lea eax, [ebp - 0x20c]
push eax
push 0x7ff1
push esi
push dword [ebp - 0x51c]
call edi
cmp dword [ebp + 0xc], 0xffffffff
jne 0x1033c06
push dword [ebp - 0x51c]
mov ecx, dword [ebp - 0x520]
call fcn.01030827
mov edx, eax
jmp 0x1033c68
mov eax, dword [ebp - 0x520]
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push esi
push esi
mov ebx, 0x401
push ebx
push dword [eax + 0x3b4]
call edi
mov eax, dword [ebp + 0xc]
push esi
push dword [ebp - 0x530]
shr eax, 0x10
push esi
movsx eax, ax
push eax
movsx eax, word [ebp + 0xc]
push eax
push 0x102
push dword [ebp - 0x51c]
call dword [sym.imp.USER32.dll_TrackPopupMenu]
push esi
push 1
mov dword [ebp - 0x534], eax
mov eax, dword [ebp - 0x520]
push ebx
push dword [eax + 0x3b4]
call edi
mov edx, dword [ebp - 0x534]
mov eax, edx
sub eax, esi
je 0x1033d3d
sub eax, 0x7ff0
je 0x1033d31
dec eax
je 0x1033d2d
dec eax
je 0x1033d1e
push 0xf
xor eax, eax
pop ecx
lea edi, [ebp - 0x574]
rep stosd dword es:[edi], eax
mov eax, dword [ebp - 0x530]
mov dword [ebp - 0x570], eax
add edx, 0xfffffffe
movzx eax, dx
mov dword [ebp - 0x56c], eax
lea eax, [ebp - 0x310]
push eax
push dword [ebp - 0x528]
mov dword [ebp - 0x578], 0x40
mov dword [ebp - 0x560], 1
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
lea eax, [ebp - 0x518]
push eax
push dword [ebp - 0x528]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
or byte [ebp - 0x573], 0x40
lea eax, [ebp - 0x310]
mov dword [ebp - 0x564], eax
lea eax, [ebp - 0x518]
mov dword [ebp - 0x548], eax
mov eax, dword [ebp - 0x52c]
mov ecx, dword [eax]
lea edx, [ebp - 0x578]
push edx
push eax
call dword [ecx + 0x10]
jmp 0x1033d3d
mov ecx, dword [ebp - 0x520]
push 2
call fcn.01032fff
jmp 0x1033d3d
push 1
jmp 0x1033d32
push esi
mov ecx, dword [ebp - 0x520]
call fcn.010338cf
mov eax, dword [ebp - 0x52c]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ebx, dword [ebp - 0x538]
push dword [ebp - 0x51c]
call dword [sym.imp.USER32.dll_DestroyMenu]
mov eax, dword [ebx]
push ebx
call dword [eax + 8]
push dword [ebp - 0x524]
call dword [sym.imp.SHELL32.dll_ILFree]
push dword [ebp - 0x528]
call dword [sym.imp.SHELL32.dll_ILFree]
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.01001aff
leave
ret 8