Function at 0x41465f
Capabilities:
Check if file exists
Check os version
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x234
and dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jbe 0x41468c
cmp dword [ebp + 0xc], 5
je 0x414685
cmp dword [ebp + 0xc], 0x1a
jne 0x41468c
mov dword [ebp + 0xc], 2
and byte [ebp - 0x234], 0
push ebx
push esi
push edi
push 0x40
xor eax, eax
pop ecx
lea edi, [ebp - 0x233]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x28]
mov byte [ebp - 6], 1
push eax
push dword [ebp + 0xc]
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jl 0x4146f8
and byte [ebp - 6], 0
lea eax, [ebp - 0x234]
push eax
push dword [ebp - 0x28]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
test eax, eax
je 0x4146f8
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
test eax, eax
jl 0x4146f8
mov eax, dword [ebp - 0x30]
push dword [ebp - 0x28]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
mov eax, dword [ebp - 0x30]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
and byte [ebp - 5], 0
cmp dword [ebp + 0xc], 0x26
mov ebx, 0x44655c
mov edi, 0x446554
mov esi, 0x446550
je 0x41471b
cmp dword [ebp + 0xc], 0x2b
jne 0x4147ba
lea eax, [ebp - 0x234]
push 0
push eax
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x38], edi
call fcn.00403191
push 0x44c700
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x4c], esi
call fcn.00403200
push 0
push eax
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x10], edi
call fcn.00406d6e
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x24], esi
call fcn.00402544
lea ecx, [ebp - 0x24]
call fcn.00402c9d
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x4147ae
lea eax, [ebp - 0x74]
push 0
push eax
lea ecx, [ebp - 0x24]
call fcn.00407327
add eax, 0x10
mov eax, dword [eax]
test eax, eax
jne 0x414790
and dword [ebp - 0x2c], eax
jmp 0x41479a
push eax
call dword [sym.imp.OLEAUT32.dll_VariantInit]
mov dword [ebp - 0x2c], eax
lea ecx, [ebp - 0x74]
call fcn.00402544
cmp dword [ebp - 0x2c], 0
je 0x4147ae
and byte [ebp - 5], 0
jmp 0x4147b2
mov byte [ebp - 5], 1
lea ecx, [ebp - 0x24]
call fcn.00402544
cmp byte [ebp - 6], 0
jne 0x4147c6
cmp byte [ebp - 5], 0
je 0x4147e4
cmp dword [ebp + 0xc], 0x1a
je 0x4149f2
cmp dword [ebp + 0xc], 0x26
je 0x41492b
cmp dword [ebp + 0xc], 0x2b
je 0x41487b
cmp byte [ebp - 0x234], 0
je 0x41481d
lea eax, [ebp - 0x234]
push 0
push eax
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x10], edi
call fcn.00403191
push 0x44c700
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x24], esi
mov dword [ebp - 4], 1
call fcn.00403200
jmp 0x414841
lea eax, [ebp - 0x234]
push 0
push eax
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x38], edi
call fcn.00403191
mov dword [ebp - 0x4c], esi
mov dword [ebp - 4], 2
lea eax, [ebp - 0x4c]
mov ecx, dword [ebp + 8]
push 0
push eax
mov dword [ecx + 0xc], ebx
mov dword [ecx + 0x14], edi
call fcn.00406d6e
mov edi, dword [ebp + 8]
test byte [ebp - 4], 2
mov dword [edi], esi
je 0x414869
and dword [ebp - 4], 0xfffffffd
lea ecx, [ebp - 0x4c]
call fcn.00402544
test byte [ebp - 4], 1
je 0x414a69
lea ecx, [ebp - 0x24]
jmp 0x414a64
lea eax, [ebp - 0x24]
push 1
push eax
call fcn.00415346
pop ecx
pop ecx
lea ecx, [ebp - 0x24]
call fcn.00402c9d
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x4148d8
lea eax, [ebp - 0x130]
push 0
push eax
lea ecx, [ebp - 0x24]
call fcn.00407327
add eax, 0x10
mov eax, dword [eax]
test eax, eax
jne 0x4148bd
and dword [ebp + 0xc], eax
jmp 0x4148c7
push eax
call dword [sym.imp.OLEAUT32.dll_VariantInit]
mov dword [ebp + 0xc], eax
lea ecx, [ebp - 0x130]
call fcn.00402544
cmp dword [ebp + 0xc], 0
jne 0x41490a
lea eax, [ebp - 0x4c]
push 0x26
push eax
call fcn.0041465f
pop ecx
pop ecx
mov ecx, eax
call fcn.00413fb9
push eax
lea ecx, [ebp - 0x24]
call fcn.00402d12
lea ecx, [ebp - 0x4c]
call fcn.00402544
push 0x44cfd8
lea ecx, [ebp - 0x24]
call fcn.00403200
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x24]
push 0
push eax
mov dword [ecx + 0xc], ebx
mov dword [ecx + 0x14], edi
call fcn.00406d6e
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x24]
mov dword [edi], esi
jmp 0x414a64
lea eax, [ebp - 0x24]
push 0
push eax
call fcn.00415346
pop ecx
pop ecx
lea ecx, [ebp - 0x24]
call fcn.00402c9d
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x414988
lea eax, [ebp - 0xb8]
push 0
push eax
lea ecx, [ebp - 0x24]
call fcn.00407327
add eax, 0x10
mov eax, dword [eax]
test eax, eax
jne 0x41496d
and dword [ebp + 0xc], eax
jmp 0x414977
push eax
call dword [sym.imp.OLEAUT32.dll_VariantInit]
mov dword [ebp + 0xc], eax
lea ecx, [ebp - 0xb8]
call fcn.00402544
cmp dword [ebp + 0xc], 0
jne 0x4149d4
lea eax, [ebp - 0xe0]
push 0
push eax
lea eax, [ebp - 0x90]
push 0
push eax
call fcn.0041304f
pop ecx
pop ecx
mov ecx, eax
call fcn.00407327
push eax
lea ecx, [ebp - 0x24]
call fcn.00402d12
lea ecx, [ebp - 0xe0]
call fcn.00402544
lea ecx, [ebp - 0x90]
call fcn.00402544
push 0x44d76c
lea ecx, [ebp - 0x24]
call fcn.004033a2
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x24]
push 0
push eax
mov dword [ecx + 0xc], ebx
mov dword [ecx + 0x14], edi
call fcn.00406d6e
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x24]
mov dword [edi], esi
jmp 0x414a64
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x68]
push 5
push eax
call fcn.0041465f
pop ecx
pop ecx
mov ecx, eax
call fcn.00413fb9
mov ecx, eax
call fcn.004071b4
push 0
push eax
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x10], edi
call fcn.00406d6e
lea ecx, [ebp - 0x108]
mov dword [ebp - 0x24], esi
call fcn.00402544
lea ecx, [ebp - 0x68]
call fcn.00402544
push 0x44cf8c
lea ecx, [ebp - 0x24]
call fcn.00403200
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x24]
push 0
push eax
mov dword [ecx + 0xc], ebx
mov dword [ecx + 0x14], edi
call fcn.00406d6e
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x24]
mov dword [edi], esi
call fcn.00402544
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret