Function at 0x4039a0
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x23c]
sub esp, 0x23c
push 0xffffffffffffffff
push 0x4c05dd
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x50d024]
xor eax, ebp
mov dword [ebp + 0x238], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x4e71d4]
mov esi, 0x4e71d4
mov ebx, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
nop dword [eax]
lea ecx, [ebp - 0x14]
push ecx
push eax
push 0
call ebx
test eax, eax
jne 0x403b03
lea eax, [ebp + 0x30]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0
push eax
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
mov ecx, dword [ebp - 0x10]
push dword [ebp - 0x14]
push ecx
mov eax, dword [ecx]
call dword [eax + 0x14]
xor eax, eax
mov dword [ebp], 0
lea ecx, [ebp + 0x30]
mov dword [ebp + 0x10], 0
mov dword [ebp + 0x14], 0
lea edx, [ecx + 2]
mov dword [ebp + 0x10], 0
mov dword [ebp + 0x14], 7
mov word [ebp], ax
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x403a60
sub ecx, edx
lea eax, [ebp + 0x30]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp]
call fcn.00409630
mov dword [ebp - 4], 0
xor eax, eax
mov edx, dword [esi - 4]
mov ecx, edx
mov dword [ebp + 0x18], 0
mov dword [ebp + 0x28], 0
mov dword [ebp + 0x2c], 0
mov dword [ebp + 0x28], 0
lea edi, [ecx + 2]
mov dword [ebp + 0x2c], 7
mov word [ebp + 0x18], ax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x403ab4
sub ecx, edi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp + 0x18]
call fcn.00409630
mov byte [ebp - 4], 1
lea eax, [ebp]
push ecx
push 0
push 0
push eax
lea eax, [ebp + 0x18]
mov ecx, 0x511900
push eax
call fcn.00402ea0
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x18]
call fcn.00409da0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp]
call fcn.00409da0
mov eax, dword [esi + 8]
add esi, 8
test eax, eax
jne 0x4039f0
mov esi, 0x4e7260
cmp dword [str.WindowsFolder], eax
je 0x403cd9
mov ebx, 0x4e6bf4
call fcn.00408d40
test eax, eax
je 0x403cfc
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 2
lea ecx, [ebp - 0x10]
test ebx, 0xffff0000
jne 0x403b5e
movzx eax, bx
push eax
call fcn.00409090
jmp 0x403b6a
push 1
push 0x4e6bf4
call fcn.00409430
mov dword [ebp - 4], 3
mov edx, dword [esi]
test edx, edx
jne 0x403b7b
xor eax, eax
jmp 0x403b8f
mov eax, edx
lea edi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x403b80
sub eax, edi
sar eax, 1
push eax
push edx
lea ecx, [ebp - 0x10]
call fcn.00408700
push 1
push 0x4e6bf8
lea ecx, [ebp - 0x10]
call fcn.00408700
push ecx
lea edx, [ebp - 0x10]
lea ecx, [ebp - 0x14]
call fcn.004284e0
add esp, 4
mov byte [ebp - 4], 4
xor eax, eax
mov dword [ebp + 0x18], 0
mov word [ebp + 0x18], ax
mov eax, dword [ebp - 0x14]
mov edx, eax
mov dword [ebp + 0x28], 0
mov dword [ebp + 0x2c], 0
mov dword [ebp + 0x28], 0
mov dword [ebp + 0x2c], 7
lea edi, [edx + 2]
nop dword [eax]
mov cx, word [edx]
add edx, 2
test cx, cx
jne 0x403bf0
sub edx, edi
lea ecx, [ebp + 0x18]
sar edx, 1
push edx
push eax
call fcn.00409630
mov byte [ebp - 4], 5
xor eax, eax
mov edx, dword [esi]
mov ecx, edx
mov dword [ebp], 0
mov dword [ebp + 0x10], 0
mov dword [ebp + 0x14], 0
mov dword [ebp + 0x10], 0
lea edi, [ecx + 2]
mov dword [ebp + 0x14], 7
mov word [ebp], ax
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x403c40
sub ecx, edi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp]
call fcn.00409630
mov byte [ebp - 4], 6
lea eax, [ebp + 0x18]
push ecx
push 0
push 0
push eax
lea eax, [ebp]
mov ecx, 0x511900
push eax
call fcn.00402ea0
mov byte [ebp - 4], 5
lea ecx, [ebp]
call fcn.00409da0
mov byte [ebp - 4], 4
lea ecx, [ebp + 0x18]
call fcn.00409da0
mov byte [ebp - 4], 3
or eax, 0xffffffff
mov edx, dword [ebp - 0x14]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x403cab
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
or eax, 0xffffffff
mov edx, dword [ebp - 0x10]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x403ccd
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
add esi, 4
cmp dword [esi], 0
jne 0x403b27
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x238]
xor ecx, ebp
call fcn.00498bc4
lea esp, [ebp + 0x23c]
pop ebp
ret
push 0x80004005
call fcn.00409410
int3