Function at 0x4059e8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
mov ebx, dword [ebp + 0xc]
test ebx, ebx
push edi
jge 0x405a08
mov ecx, dword [0x423b88]
lea eax, [ebx*4 + 4]
sub ecx, eax
mov ebx, dword [ecx]
mov eax, dword [0x4243d8]
mov ecx, dword [ebp + 8]
add ebx, eax
mov eax, 0x423340
sub ecx, eax
cmp ecx, 0x800
mov edi, eax
jae 0x405a2a
mov edi, dword [ebp + 8]
and dword [ebp + 8], 0
mov cl, byte [ebx]
test cl, cl
mov byte [ebp + 0xf], cl
je 0x405bf0
push esi
mov edx, edi
sub edx, eax
cmp edx, 0x400
jge 0x405bef
inc ebx
cmp cl, 0xfc
jbe 0x405bd5
movsx eax, byte [ebx + 1]
movsx ecx, byte [ebx]
mov esi, eax
and esi, 0x7f
mov edx, ecx
and edx, 0x7f
shl esi, 7
or esi, edx
mov edx, 0x8000
mov dword [ebp - 0x18], ecx
or ecx, edx
mov dword [ebp - 0x10], eax
or eax, edx
inc ebx
inc ebx
cmp byte [ebp + 0xf], 0xfe
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0xc], eax
jne 0x405b7f
and dword [ebp + 0xc], 0
push 4
pop esi
cmp dword [ebp - 0x10], esi
mov byte [edi], 0
jne 0x405aa1
mov dword [ebp + 0xc], str.MicrosoftInternet_ExplorerQuick_Launch
jmp 0x405b19
mov eax, dword [ebp - 0x18]
cmp eax, 0x2b
jne 0x405ac0
push edi
push str.CommonFilesDir
push str.SoftwareMicrosoftWindowsCurrentVersion
push 0x80000002
call fcn.004054b1
jmp 0x405b14
cmp eax, 0x26
jne 0x405af0
push edi
push str.ProgramFilesDir
push str.SoftwareMicrosoftWindowsCurrentVersion
push 0x80000002
call fcn.004054b1
cmp byte [edi], 0
jne 0x405b77
push str.C:Program_Files
push edi
call fcn.004055bd
jmp 0x405b14
cmp eax, 0x25
jne 0x405b03
push 0x400
push edi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
jmp 0x405b14
cmp eax, 0x24
jne 0x405b19
push 0x400
push edi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
cmp byte [edi], 0
jne 0x405b77
cmp dword [0x424424], 0
jne 0x405b25
push 2
pop esi
lea eax, [ebp - 4]
push eax
push dword [ebp + esi*4 - 0x1c]
dec esi
push dword [0x4243a0]
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x405b5b
push edi
push dword [ebp - 4]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
push dword [ebp - 4]
mov dword [ebp - 8], eax
call fcn.00405285
cmp dword [ebp - 8], 0
jne 0x405b62
jmp 0x405b5e
mov byte [edi], 0
test esi, esi
jne 0x405b25
cmp byte [edi], 0
je 0x405b77
cmp dword [ebp + 0xc], 0
je 0x405b77
push dword [ebp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push edi
call fcn.004055df
jmp 0x405bc5
cmp byte [ebp + 0xf], 0xfd
jne 0x405bb3
cmp esi, 0x1b
jne 0x405b98
push dword [0x4243a0]
push edi
call fcn.0040551b
jmp 0x405ba9
mov eax, esi
shl eax, 0xa
add eax, section..ndata
push eax
push edi
call fcn.004055bd
add esi, 0xffffffeb
cmp esi, 6
jae 0x405bc5
jmp 0x405b77
cmp byte [ebp + 0xf], 0xff
jne 0x405bc5
or eax, 0xffffffff
sub eax, esi
push eax
push edi
call fcn.004059e8
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add edi, eax
mov eax, 0x423340
jmp 0x405be2
jne 0x405bdf
mov cl, byte [ebx]
mov byte [edi], cl
inc edi
inc ebx
jmp 0x405be2
mov byte [edi], cl
inc edi
mov cl, byte [ebx]
test cl, cl
mov byte [ebp + 0xf], cl
jne 0x405a38
pop esi
cmp dword [ebp + 8], 0
mov byte [edi], 0
pop edi
pop ebx
je 0x405c04
push eax
push dword [ebp + 8]
call fcn.004055bd
leave
ret 8