Function at 0x406922
Capabilities:
Get common file path

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x14
test eax, eax
jns 0x40693e
mov ecx, dword [0x46b540]
lea eax, [eax*4 + 4]
sub ecx, eax
mov eax, dword [ecx]
mov ecx, dword [0x473598]
push ebx
push ebp
mov ebp, dword [esp + 0x20]
mov edx, 0x463500
lea ebx, [ecx + eax*2]
xor ecx, ecx
push edi
mov edi, edx
cmp ebp, edx
jb 0x406970
mov eax, ebp
sub eax, edx
sar eax, 1
cmp eax, 0x4000
jae 0x406970
mov edi, ebp
mov ebp, ecx
mov dword [esp + 0x24], ebp
movzx ecx, word [ebx]
test cx, cx
je 0x406ba0
push esi
push 2
pop ebp
push 4
pop esi
mov eax, edi
sub eax, edx
and eax, 0xfffffffe
cmp eax, 0x4000
jge 0x406b9b
movzx edx, cx
add ebx, ebp
cmp dx, si
jae 0x406b77
movsx esi, byte [ebx + 1]
movsx eax, byte [ebx]
movzx ecx, byte [ebx]
movzx ebp, byte [ebx + 1]
and eax, 0x7f
and esi, 0x7f
shl esi, 7
or esi, eax
mov eax, ecx
or eax, 0x8000
mov dword [esp + 0x14], eax
mov eax, ebp
or eax, 0x8000
push 2
mov dword [esp + 0x20], eax
pop eax
add ebx, eax
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], ebp
mov dword [esp + 0x10], ebx
cmp dx, ax
jne 0x406b18
mov eax, dword [0x473560]
test eax, eax
jns 0x406a0f
mov edx, 0x5a04
cmp ax, dx
je 0x406a0f
cmp ebp, 0x23
je 0x406a0f
cmp ebp, 0x2e
je 0x406a0f
xor esi, esi
mov ebp, esi
jmp 0x406a16
xor eax, eax
xor esi, esi
lea ebp, [eax + 1]
cmp dword [0x473624], 0
push 2
pop ebx
push 4
pop eax
cmovne ebx, eax
test cl, cl
jns 0x406a63
mov eax, ecx
and eax, 0x40
push eax
and ecx, 0x3f
push edi
lea eax, [ecx*2]
add eax, dword [0x473598]
push eax
push str.SoftwareMicrosoftWindowsCurrentVersion
push 0x80000002
call fcn.0040775e
cmp word [edi], si
mov esi, dword [esp + 0x20]
jne 0x406a7f
push esi
push edi
call fcn.00406922
jmp 0x406a78
cmp ecx, 0x25
jne 0x406a9f
push 0x2000
push edi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov esi, dword [esp + 0x20]
xor ecx, ecx
cmp word [edi], cx
je 0x406a90
cmp esi, 0x1a
jne 0x406a90
push str.MicrosoftInternet_ExplorerQuick_Launch
push edi
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push edi
call fcn.00407acb
mov ebx, dword [esp + 0x10]
jmp 0x406b65
cmp ecx, 0x24
jne 0x406ab2
push 0x2000
push edi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov ebx, esi
test ebx, ebx
je 0x406a74
mov eax, dword [0x46b550]
dec ebx
test eax, eax
je 0x406ad7
test ebp, ebp
je 0x406ad7
push edi
push esi
push esi
push dword [esp + ebx*4 + 0x20]
push dword [0x46b558]
call eax
test eax, eax
je 0x406a74
lea eax, [esp + 0x2c]
push eax
push dword [esp + ebx*4 + 0x18]
push dword [0x46b558]
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x406b0f
push edi
push dword [esp + 0x30]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
push dword [esp + 0x2c]
mov esi, eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
test esi, esi
jne 0x406a74
xor eax, eax
push eax
mov word [edi], ax
pop esi
jmp 0x406ab2
cmp edx, 3
jne 0x406b51
cmp esi, 0x1d
jne 0x406b30
push dword [0x46b558]
push edi
call fcn.00407290
jmp 0x406b41
mov eax, esi
shl eax, 0xe
add eax, section..ndata
push eax
push edi
call fcn.00407903
lea eax, [esi - 0x15]
cmp eax, 7
jae 0x406b65
push edi
call fcn.00407acb
jmp 0x406b65
xor eax, eax
inc eax
cmp dx, ax
jne 0x406b65
or eax, 0xffffffff
sub eax, esi
push eax
push edi
call fcn.00406922
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push 2
pop ebp
push 4
lea edi, [edi + eax*2]
pop esi
jmp 0x406b8a
jne 0x406b85
mov ax, word [ebx]
mov word [edi], ax
add edi, ebp
add ebx, ebp
jmp 0x406b8a
mov word [edi], dx
add edi, ebp
movzx ecx, word [ebx]
mov edx, 0x463500
test cx, cx
jne 0x406983
mov ebp, dword [esp + 0x28]
pop esi
xor eax, eax
mov word [edi], ax
test ebp, ebp
je 0x406bb2
push edx
push ebp
call fcn.00407903
jmp 0x406bb4
mov eax, edx
pop edi
pop ebp
pop ebx
add esp, 0x14
ret 8