Function at 0x424260
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x627a40]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, edx
mov byte [ebp - 0x20], 0
mov dword [ebp - 0x28], edi
call fcn.004240c0
test al, al
je 0x42430f
call fcn.00435de0
test al, al
je 0x4242a6
ret 0x7546
call fcn.00436400
test al, al
je 0x4242c5
popal
clc
sub eax, 0x5eba5761
lcall 0x39d8, 0xabcd6df5
aam 0xe
sal dword [edi - 0x4f], 1
mov esi, 0xdc4d8dfa
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x24], 0
call fcn.00424400
test al, al
je 0x42430f
push edi
push 1
push dword [ebp - 0x24]
push dword [ebp + 8]
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov ebx, dword [ebp - 0x20]
test eax, eax
mov eax, 1
movzx ebx, bl
cmove ebx, eax
mov dword [ebp - 0x20], ebx
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
jne 0x42435a
call fcn.00436550
test al, al
je 0x424337
invalid
push 0
push dword [ebp + 8]
push dword [ebp - 0x28]
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov edx, dword [ebp - 0x20]
test eax, eax
movzx ebx, dl
mov eax, 1
cmovne ebx, eax
mov dword [ebp - 0x20], ebx
push 0x20
push str.cae04bc49778d3ec4522cef1584bb459
lea ecx, [ebp - 0x1c]
mov dword [ebp - 8], 0xf
mov dword [ebp - 0xc], 0
mov byte [ebp - 0x1c], 0
call fcn.00407270
cmp dword [ebp - 0xc], 0x100
jbe 0x4243ca
mov ecx, dword [ebp - 8]
cmp ecx, 0x10
jb 0x424399
inc ecx
push ecx
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x1c]
call fcn.00407760
xchg dword [ebp + 0x38], edx
mov bl, 0xf3
jae 0x42441b
jbe 0x4243c3
test dword [ebp + 0x7d2ec77c], esi
mov cl, 0x65
repne cmpsb byte [esi], byte es:[edi]
xor dword [edi + 0x4bf43273], esp
jno 0x4243de
mov edx, dword [ebp - 0x20]
mov al, dl
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00570ea9
mov esp, ebp
pop ebp
ret
retf 0x14
mov eax, dword [ebp - 8]
cmp eax, 0x10
jb 0x4243df
inc eax
lea ecx, [ebp - 0x1c]
push eax
push dword [ebp - 0x1c]
call fcn.00407760
dec dword [ebx - 0x3c7503b3]
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00570ea9
mov esp, ebp
pop ebp
ret
push str.f06abc52704194cdc30e23b08ddf07ee
mov byte [ebp - 0x20], 0
mov dword [ebp - 8], 0xf
mov dword [ebp - 0xc], 0
mov byte [ebp - 0x1c], 0
call fcn.00407270
cmp dword [ebp - 0xc], 0x100
mov eax, dword [ebp - 8]
jbe 0x42446f
cmp eax, 0x10
jb 0x424459
inc eax
lea ecx, [ebp - 0x1c]
push eax
push dword [ebp - 0x1c]
call fcn.00407760
cdq
lds ecx, [eax - 0x2201e4e]
int 0xfa
xor cl, byte [ecx + eax]
jg 0x424447
inc esp
and eax, 0x2ddc2289
jmp 0x424481
cmp eax, 0x10
jb 0x424481
inc eax
lea ecx, [ebp - 0x1c]
push eax
push dword [ebp - 0x1c]
call fcn.00407760
push 0x20
push str.2f533a5b5a808f7486d7c802adeca516
lea ecx, [ebp - 0x1c]
mov dword [ebp - 8], 0xf
mov dword [ebp - 0xc], 0
mov byte [ebp - 0x1c], 0
call fcn.00407270
cmp dword [ebp - 0xc], 0x100
mov eax, dword [ebp - 8]
jbe 0x4244de
add al, ch
into
sub eax, 0x7d81fffe
hlt
cmp eax, 0x10
jb 0x4244c0
inc eax
lea ecx, [ebp - 0x1c]
push eax
in al, 0x50
push dword [ebp - 0x1c]
call fcn.00407760
xchg ebp, eax
jg 0x4244b6
jno 0x42449c
add ch, byte [ebp - 0x73]
invalid
cmp eax, 0x10
jb 0x4244f0
inc eax
lea ecx, [ebp - 0x1c]
push eax
push dword [ebp - 0x1c]
call fcn.00407760
push 0x20
push str.cae04bc49778d3ec4522cef1584bb459
lea ecx, [ebp - 0x1c]
mov dword [ebp - 8], 0xf
mov dword [ebp - 0xc], 0
mov byte [ebp - 0x1c], 0
call fcn.00407270
cmp dword [ebp - 0xc], 0x100
mov eax, dword [ebp - 8]
jbe 0x424546
cmp eax, 0x10
jb 0x42452f
inc eax
lea ecx, [ebp - 0x1c]
push eax
push dword [ebp - 0x1c]
call fcn.00407760
push 0xffffffffffffffd0
xor dword [edx], esp
nop
push 0xffffffffffffff9a
sar dl, 1
retf
cmp eax, 0x10
jb 0x424558
inc eax
lea ecx, [ebp - 0x1c]
push eax
push dword [ebp - 0x1c]
call fcn.00407760
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push str.Kernel32.dll
call esi
mov ebx, eax
push str.Wtsapi32.dll
mov dword [ebp - 0x28], ebx
call esi
mov dword [ebp - 0x2c], eax
test ebx, ebx
je 0x424636
test eax, eax
je 0x424636
call fcn.00436550
test al, al
je 0x4245af
faddp st(1)
pop ebp
aad 0xc3
cld
xchg edx, eax
mov ebx, 0xfa20aa6a
inc esp
jno 0x4245c5
xor byte [ebp + 0x1bebacc3], ch
mov ebx, 0x9bc1bdc9
in eax, dx
bound eax, qword [ebx + ecx*4 + 0x5d]
fmul dword [ebx + 0x5a11ac35]
add byte [eax - 0x10], ch
mov ecx, 0x75ff0061
aam 0xff
salc
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x61b9f0
push dword [ebp - 0x2c]
call esi
push 0x61ba04
push ebx
mov edi, eax
call esi
test eax, eax
je 0x4245fb
test edi, edi
jne 0x4245fb
call eax
mov ebx, dword [ebp - 0x24]
push ebx
push eax
xor eax, eax
call eax
test eax, eax
je 0x4245fb
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
mov ecx, dword [ebp - 0x20]
test eax, eax
movzx ecx, cl
mov edx, 1
cmovne ecx, edx
mov dword [ebp - 0x20], ecx
call fcn.00435fa0
test al, al
je 0x424620
xchg edx, eax
rol dh, 0x14
fild word [0x78b8ea3c]
leave
bound ecx, qword [edi + 0x61]
and dword [edx + 0x34af9ff0], 0x57266e05
arpl word [edx - 0x278a00f8], cx
push dword [ebp - 0x28]
mov esi, dword [sym.imp.KERNEL32.dll_FreeLibrary]
call esi
push dword [ebp - 0x2c]
call esi
cmp byte [ebp - 0x20], 0
jne 0x424642
call fcn.00425830
mov ecx, dword [ebp - 0x24]
mov dword [ecx], eax
jmp 0x424645
mov ecx, dword [ebp - 0x24]
cmp dword [ecx], 0
mov ecx, dword [ebp - 4]
pop edi
setne al
xor ecx, ebp
pop esi
pop ebx
call fcn.00570ea9
mov esp, ebp
pop ebp
ret