Function at 0x43b1a0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x468100]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov dword [ebp - 0x1c], edx
test eax, eax
jns 0x43b1ce
mov ecx, dword [0x4a00a0]
lea eax, [eax*4 + 4]
sub ecx, eax
mov eax, dword [ecx]
mov ecx, dword [0x4a0070]
push esi
mov esi, 0x4a10c0
lea eax, [ecx + eax*2]
cmp edx, esi
jb 0x43b1fb
mov ecx, edx
sub ecx, esi
sar ecx, 1
cmp ecx, 0x4008
jae 0x43b1fb
mov dword [ebp - 0x1c], 0
mov esi, edx
mov edx, dword [ebp - 0x1c]
movzx ecx, word [eax]
test cx, cx
je 0x43b457
push ebx
push edi
lea esp, [esp]
mov edi, esi
sub edi, 0x4a10c0
and edi, 0xfffffffe
cmp edi, 0x4008
jge 0x43b455
movzx ecx, cx
add eax, 2
mov dword [ebp - 0x18], eax
test ecx, 0xe000
je 0x43b42b
mov edi, 0xe000
cmp cx, di
jbe 0x43b42b
movzx eax, word [eax]
add dword [ebp - 0x18], 2
mov edi, eax
mov ebx, eax
shr eax, 8
and ebx, 0xff
mov dword [ebp - 8], eax
or eax, 0x8000
mov edx, ebx
mov dword [ebp - 0xc], eax
or edx, 0x8000
mov eax, 0xe002
and edi, 0x7fff
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], edx
cmp cx, ax
jne 0x43b3b7
mov edi, 2
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, eax
jns 0x43b2b8
mov ecx, 0x5a04
cmp ax, cx
je 0x43b2b8
mov eax, dword [ebp - 8]
cmp eax, 0x23
je 0x43b2b8
mov dword [ebp - 0x20], 0
cmp eax, 0x2e
jne 0x43b2bf
mov dword [ebp - 0x20], 1
cmp dword [0x4a0024], 0
je 0x43b2cd
mov edi, 4
test bl, bl
jns 0x43b326
mov eax, dword [0x4a0070]
mov edx, ebx
and edx, 0x40
push edx
push esi
and ebx, 0x3f
lea ecx, [eax + ebx*2]
push ecx
push str.SoftwareMicrosoftWindowsCurrentVersion
push closesocket
call fcn.0043a670
cmp word [esi], 0
jne 0x43b309
mov edx, dword [ebp - 8]
push edx
push esi
call fcn.0043b1a0
cmp word [esi], 0
je 0x43b31b
cmp dword [ebp - 8], 0x1a
jne 0x43b31b
push str.MicrosoftInternet_ExplorerQuick_Launch
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push esi
call fcn.0043a810
jmp 0x43b419
cmp ebx, 0x25
jne 0x43b339
push 0x2004
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
jmp 0x43b303
cmp ebx, 0x24
jne 0x43b34c
push 0x2004
push esi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x43b303
test edi, edi
je 0x43b303
mov eax, dword [0x4b18f0]
dec edi
test eax, eax
je 0x43b372
cmp dword [ebp - 0x20], 0
je 0x43b372
mov ecx, dword [ebp + edi*4 - 0x14]
push esi
push 0
push 0
push ecx
push 0
call eax
test eax, eax
je 0x43b303
mov eax, dword [ebp + edi*4 - 0x14]
lea edx, [ebp - 0x24]
push edx
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x43b3a6
mov ecx, dword [ebp - 0x24]
push esi
push ecx
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
mov edx, dword [ebp - 0x24]
push edx
mov ebx, eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
test ebx, ebx
jne 0x43b303
xor eax, eax
mov word [esi], ax
test edi, edi
jne 0x43b350
push esi
call fcn.0043a810
jmp 0x43b419
mov edx, 0xe001
cmp cx, dx
jne 0x43b403
cmp edi, 0x1d
jne 0x43b3d9
push 0
push 0x4575c0
push esi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
jmp 0x43b3f3
mov eax, edi
imul eax, eax, 0x4008
push 0x2004
add eax, section..ndata
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
add edi, 0xffffffeb
cmp edi, 7
jae 0x43b419
push esi
call fcn.0043a810
jmp 0x43b419
mov edx, 0xe003
cmp cx, dx
jne 0x43b419
or eax, 0xffffffff
sub eax, edi
push eax
push esi
call fcn.0043b1a0
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edx, dword [ebp - 0x1c]
lea esi, [esi + eax*2]
mov eax, dword [ebp - 0x18]
jmp 0x43b449
mov edi, 0xe000
cmp cx, di
jne 0x43b443
mov cx, word [eax]
mov word [esi], cx
add esi, 2
add eax, 2
jmp 0x43b449
mov word [esi], cx
add esi, 2
movzx ecx, word [eax]
test cx, cx
jne 0x43b210
pop edi
pop ebx
xor eax, eax
mov word [esi], ax
pop esi
test edx, edx
je 0x43b482
push 0x2004
push 0x4a10c0
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043e1c4
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x4a10c0
call fcn.0043e1c4
mov esp, ebp
pop ebp
ret 8