Function at 0x401a00
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44c02d
mov eax, dword fs:[0]
push eax
sub esp, 0x60
mov eax, dword [0x45a004]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov dword [ebp - 0x64], edi
test edi, edi
je 0x401d5e
cmp dword [ebp + 0xc], 0
je 0x401d5e
xor eax, eax
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x60], 0
mov byte [ebp - 0x59], 1
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
mov ecx, edi
mov dword [ebp - 0x28], eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x401a82
sub ecx, edx
sar ecx, 1
push ecx
push edi
lea ecx, [ebp - 0x28]
call fcn.004030b0
xor eax, eax
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 7
mov word [ebp - 0x58], ax
push 0x44d860
push edi
mov byte [ebp - 4], 2
call fcn.00405488
add esp, 8
test eax, eax
je 0x401af4
push 0xd
push 0x44d860
lea ecx, [ebp - 0x40]
call fcn.004030b0
push str.USERPROFILE
call fcn.004282ef
add esp, 4
mov dword [ebp - 0x60], eax
mov byte [ebp - 0x59], 0
jmp 0x401b8c
push str._DESKTOP_
push edi
call fcn.00405488
add esp, 8
test eax, eax
je 0x401b27
push 9
push str._DESKTOP_
lea ecx, [ebp - 0x40]
call fcn.004030b0
lea eax, [ebp - 0x60]
push eax
push 0
push 0x100
push 0x44da40
jmp 0x401b87
push str._DOCUMENTS_
push edi
call fcn.00405488
add esp, 8
test eax, eax
je 0x401b58
push str._DOCUMENTS_
lea ecx, [ebp - 0x40]
call fcn.004017e0
lea eax, [ebp - 0x60]
push eax
push 0
push 0x100
push 0x44de80
jmp 0x401b87
push str._DOWNLOADS_
push edi
call fcn.00405488
add esp, 8
test eax, eax
je 0x401b8c
push str._DOWNLOADS_
lea ecx, [ebp - 0x40]
call fcn.004017e0
lea eax, [ebp - 0x60]
push eax
push 0
push 0x100
push 0x44e650
call sub.SHELL32.dll_SHGetKnownFolderPath
mov ecx, dword [ebp - 0x60]
test ecx, ecx
je 0x401c75
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x401ba0
sub ecx, edx
sar ecx, 1
push ecx
push dword [ebp - 0x60]
lea ecx, [ebp - 0x58]
call fcn.004030b0
cmp dword [ebp - 0x2c], 8
lea ebx, [ebp - 0x40]
mov esi, dword [ebp - 0x30]
lea ecx, [ebp - 0x28]
cmovae ebx, dword [ebp - 0x40]
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x18]
cmovae ecx, dword [ebp - 0x28]
mov dword [ebp - 0x6c], ecx
cmp esi, eax
ja 0x401c14
test esi, esi
jne 0x401be9
xor ecx, ecx
jmp 0x401d28
sub eax, esi
inc eax
lea eax, [ecx + eax*2]
mov dword [ebp - 0x68], eax
sub eax, ecx
sar eax, 1
je 0x401c11
movzx edx, word [ebx]
nop dword [eax + eax]
cmp word [ecx], dx
je 0x401cf9
add ecx, 2
sub eax, 1
jne 0x401c00
mov edi, dword [ebp - 0x64]
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
push dword [ebp + 0xc]
push edi
call fcn.0040f7fb
add esp, 0xc
cmp byte [ebp - 0x59], 0
je 0x401c3b
push dword [ebp - 0x60]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov edx, dword [ebp - 0x44]
cmp edx, 8
jb 0x401c75
mov ecx, dword [ebp - 0x58]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x401c6b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x401d7a
push edx
push ecx
call fcn.00403ed7
add esp, 8
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x401caf
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x401ca5
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x401d7a
push edx
push ecx
call fcn.00403ed7
add esp, 8
mov edx, dword [ebp - 0x2c]
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
cmp edx, 8
jb 0x401d5e
mov ecx, dword [ebp - 0x40]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x401d54
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x401d7a
jmp 0x401d54
mov edx, ebx
test esi, esi
je 0x401d14
mov edi, ecx
sub edi, ebx
mov ax, word [edx + edi]
cmp ax, word [edx]
jne 0x401d46
add edx, 2
sub esi, 1
jne 0x401d03
sub ecx, dword [ebp - 0x6c]
mov edi, dword [ebp - 0x64]
sar ecx, 1
cmp ecx, 0xffffffff
je 0x401c14
mov esi, dword [ebp - 0x30]
cmp dword [ebp - 0x44], 8
lea eax, [ebp - 0x58]
push dword [ebp - 0x48]
cmovae eax, dword [ebp - 0x58]
push eax
push esi
push ecx
lea ecx, [ebp - 0x28]
call fcn.00403210
jmp 0x401c14
mov esi, dword [ebp - 0x30]
add ecx, 2
mov eax, dword [ebp - 0x68]
jmp 0x401bf2
push edx
push ecx
call fcn.00403ed7
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00403e99
mov esp, ebp
pop ebp
ret
call fcn.004213d8
int3