Function at 0x405bd1
Capabilities:
Get common file path

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x1c
test eax, eax
jns 0x405bed
mov ecx, dword [0x7a2400]
lea eax, [eax*4 + 4]
sub ecx, eax
mov eax, dword [ecx]
mov ecx, dword [0x7a2c58]
mov edx, 0x7a1bc0
push ebp
mov ebp, dword [esp + 0x24]
add ecx, eax
push edi
mov edi, edx
cmp ebp, edx
jb 0x405c19
mov eax, ebp
sub eax, edx
cmp eax, 0x800
jae 0x405c19
mov edi, ebp
xor ebp, ebp
mov dword [esp + 0x28], ebp
cmp byte [ecx], 0
je 0x405e35
push ebx
push esi
mov eax, edi
mov ebx, ecx
sub eax, edx
mov dword [esp + 0x18], ebx
cmp eax, 0x400
jge 0x405e2f
mov dl, byte [ecx]
cmp dl, 4
jae 0x405e0b
movsx ebp, byte [ebx + 2]
movsx ecx, byte [ecx + 1]
mov esi, ebp
and esi, 0x7f
mov dword [esp + 0x14], ebp
mov eax, ecx
shl esi, 7
and eax, 0x7f
mov dword [esp + 0x20], ecx
or esi, eax
mov dword [esp + 0x28], ebp
mov eax, ecx
or eax, 0x8000
mov dword [esp + 0x1c], eax
mov eax, ebp
or eax, 0x8000
mov dword [esp + 0x24], eax
cmp dl, 2
jne 0x405da8
mov eax, dword [0x7a2c20]
test eax, eax
jns 0x405ca7
mov edx, 0x5a04
cmp ax, dx
je 0x405ca7
cmp ebp, 0x23
je 0x405ca7
cmp ebp, 0x2e
je 0x405ca7
xor eax, eax
jmp 0x405caa
xor eax, eax
inc eax
cmp dword [0x7a2ce4], 0
push 2
pop ebx
push 4
mov dword [esp + 0x38], eax
pop eax
cmovne ebx, eax
test cl, cl
jns 0x405cf7
mov eax, ecx
and ecx, 0x3f
add ecx, dword [0x7a2c58]
and eax, 0x40
push eax
push edi
push ecx
push str.SoftwareMicrosoftWindowsCurrentVersion
push 0x80000002
call fcn.00406663
cmp byte [edi], 0
jne 0x405d8b
push ebp
push edi
call fcn.00405bd1
jmp 0x405d86
cmp ecx, 0x25
jne 0x405d0a
push 0x400
push edi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
jmp 0x405d86
cmp ecx, 0x24
jne 0x405d1d
push 0x400
push edi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
xor ebx, ebx
test ebx, ebx
je 0x405d86
mov ebp, dword [esp + 0x34]
mov eax, dword [0x7a2410]
dec ebx
test eax, eax
je 0x405d48
test ebp, ebp
je 0x405d48
push edi
push 0
push 0
push dword [esp + ebx*4 + 0x28]
push dword [0x7a2418]
call eax
test eax, eax
je 0x405d82
lea eax, [esp + 0x10]
push eax
push dword [esp + ebx*4 + 0x20]
push dword [0x7a2418]
call sub.SHELL32.dll_SHGetSpecialFolderLocation
test eax, eax
jne 0x405d7b
push edi
push dword [esp + 0x14]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
push dword [esp + 0x10]
mov esi, eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
test esi, esi
jne 0x405d82
mov byte [edi], 0
test ebx, ebx
jne 0x405d25
mov ebp, dword [esp + 0x14]
cmp byte [edi], 0
je 0x405d9c
cmp ebp, 0x1a
jne 0x405d9c
push str.MicrosoftInternet_ExplorerQuick_Launch
push edi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push edi
call fcn.004069cc
mov ebx, dword [esp + 0x18]
jmp 0x405dfe
cmp dl, 3
jne 0x405df0
cmp esi, 0x1d
jne 0x405dc9
push dword [0x7a2418]
push 0x4085a8
push edi
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
jmp 0x405de0
mov eax, esi
shl eax, 0xa
push 0x400
add eax, section..ndata
push eax
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
lea eax, [esi - 0x15]
cmp eax, 7
jae 0x405dfe
push edi
call fcn.004069cc
jmp 0x405dfe
cmp dl, 1
jne 0x405dfe
not esi
push esi
push edi
call fcn.00405bd1
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add edi, eax
push 3
jmp 0x405e15
jne 0x405e18
mov al, byte [ecx + 1]
mov byte [edi], al
inc edi
push 2
pop eax
jmp 0x405e1e
mov byte [edi], dl
xor eax, eax
inc edi
inc eax
lea ecx, [ebx + eax]
mov edx, 0x7a1bc0
cmp byte [ecx], 0
jne 0x405c24
mov ebp, dword [esp + 0x30]
pop esi
pop ebx
mov byte [edi], 0
test ebp, ebp
je 0x405e4b
push 0x400
push edx
push ebp
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
jmp 0x405e4d
mov eax, edx
pop edi
pop ebp
add esp, 0x1c
ret 8