Function at 0x4198db
Capabilities:
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2c4c
call fcn.00993ac0
mov eax, dword [0xa3d07c]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x2c4c], 0
push ebx
mov ebx, dword [ebp + 8]
mov ecx, ebx
push esi
push edi
mov dword [ebp - 0x2c48], ebx
xor esi, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0x41990c
sub ecx, edx
lea edi, [ebp - 0xec]
sar ecx, 1
mov esi, 0xa09614
push 7
lea eax, [ecx*2 + 2]
pop ecx
rep movsd dword es:[edi], dword [esi]
xor ecx, ecx
mov dword [ebp - 0x2c44], eax
inc ecx
push ecx
movsw word es:[edi], word [esi]
push eax
mov esi, str.Path
lea edi, [ebp - 0x1c]
push ebx
lea eax, [ebp - 0x1c]
push eax
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0xec]
push eax
push reloc.WS2_32.dll_accept
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
call fcn.004197e2
push 7
pop ecx
mov esi, 0xa09614
lea edi, [ebp - 0x10c]
rep movsd dword es:[edi], dword [esi]
push 1
push dword [ebp - 0x2c44]
lea eax, [ebp - 0x40]
movsw word es:[edi], word [esi]
mov esi, str.Path32
lea edi, [ebp - 0x40]
push ebx
push eax
lea eax, [ebp - 0x10c]
movsd dword es:[edi], dword [esi]
push eax
push reloc.WS2_32.dll_accept
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
call fcn.004197e2
add esp, 0x30
cmp byte [ebp + 0xc], 0
je 0x419a23
push 7
pop ecx
mov esi, 0xa09614
lea edi, [ebp - 0x12c]
rep movsd dword es:[edi], dword [esi]
push 1
push dword [ebp - 0x2c44]
lea eax, [ebp - 0x10]
movsw word es:[edi], word [esi]
mov esi, str.Path
lea edi, [ebp - 0x10]
push ebx
push eax
lea eax, [ebp - 0x12c]
movsd dword es:[edi], dword [esi]
push eax
push reloc.WS2_32.dll_bind
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
call fcn.004197e2
push 7
pop ecx
mov esi, 0xa09614
lea edi, [ebp - 0xc0]
rep movsd dword es:[edi], dword [esi]
push 1
push dword [ebp - 0x2c44]
lea eax, [ebp - 0x50]
movsw word es:[edi], word [esi]
mov esi, str.Path32
lea edi, [ebp - 0x50]
push ebx
push eax
lea eax, [ebp - 0xc0]
movsd dword es:[edi], dword [esi]
push eax
push reloc.WS2_32.dll_bind
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
call fcn.004197e2
add esp, 0x30
push 0x13
pop ecx
mov esi, str.23170F69_40C1_278A_1000_000100020000
lea edi, [ebp - 0xa0]
rep movsd dword es:[edi], dword [esi]
lea ebx, [ebp - 0xa0]
xor edx, edx
lea ecx, [ebx + 2]
movsw word es:[edi], word [esi]
mov ax, word [ebx]
add ebx, 2
cmp ax, dx
jne 0x419a40
push 0x12
sub ebx, ecx
lea eax, [ebp - 0xa0]
pop ecx
push edx
sar ebx, 1
lea edi, [ebp - 0x174]
push 1
mov esi, str._shellexContextMenuHandlers7_Zip
rep movsd dword es:[edi], dword [esi]
lea ebx, [ebx*2 + 2]
push ebx
push eax
push edx
lea eax, [ebp - 0x174]
push eax
push dword [ebp + 0xc]
call fcn.0041983d
push 0x16
pop ecx
mov esi, str.Directory_shellexContextMenuHandlers7_Zip
lea edi, [ebp - 0x2c0]
rep movsd dword es:[edi], dword [esi]
xor ecx, ecx
lea eax, [ebp - 0xa0]
push ecx
push 1
push ebx
push eax
push ecx
lea eax, [ebp - 0x2c0]
push eax
push dword [ebp + 0xc]
call fcn.0041983d
push 0x14
pop ecx
mov esi, str.Folder_shellexContextMenuHandlers7_Zip
lea edi, [ebp - 0x214]
rep movsd dword es:[edi], dword [esi]
xor ecx, ecx
lea eax, [ebp - 0xa0]
push ecx
push 1
push ebx
push eax
push ecx
lea eax, [ebp - 0x214]
movsw word es:[edi], word [esi]
push eax
push dword [ebp + 0xc]
call fcn.0041983d
add esp, 0x54
lea edi, [ebp - 0x268]
mov esi, str.Directory_shellexDragDropHandlers7_Zip
lea eax, [ebp - 0xa0]
push 0x14
pop ecx
rep movsd dword es:[edi], dword [esi]
xor ecx, ecx
push ecx
push 1
push ebx
push eax
push ecx
lea eax, [ebp - 0x268]
movsw word es:[edi], word [esi]
push eax
push dword [ebp + 0xc]
call fcn.0041983d
push 0x12
pop ecx
mov esi, str.Drive_shellexDragDropHandlers7_Zip
lea edi, [ebp - 0x1c0]
rep movsd dword es:[edi], dword [esi]
xor eax, eax
push eax
push 1
push ebx
lea eax, [ebp - 0xa0]
movsw word es:[edi], word [esi]
push eax
xor ebx, ebx
lea eax, [ebp - 0x1c0]
push ebx
push eax
push dword [ebp + 0xc]
call fcn.0041983d
add esp, 0x38
cmp byte [ebp + 0xc], bl
je 0x419cb0
push 0x22
pop ecx
mov esi, str.SoftwareMicrosoftWindowsCurrentVersionShell_ExtensionsApproved
lea edi, [ebp - 0x440]
rep movsd dword es:[edi], dword [esi]
push 0xb
pop ecx
mov esi, str.7_Zip_Shell_Extension
lea edi, [ebp - 0xcc]
rep movsd dword es:[edi], dword [esi]
lea ecx, [ebp - 0xcc]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x419b75
sub ecx, edx
sar ecx, 1
push 1
lea eax, [ecx*2 + 2]
push eax
lea eax, [ebp - 0xcc]
push eax
lea eax, [ebp - 0xa0]
push eax
lea eax, [ebp - 0x440]
push eax
push reloc.WS2_32.dll_bind
call fcn.004197e2
push 0x1e
pop ecx
mov esi, str.SoftwareMicrosoftWindowsCurrentVersionApp_Paths7zFM.exe
lea edi, [ebp - 0x33c]
rep movsd dword es:[edi], dword [esi]
push 0x400
lea eax, [ebp - 0x840]
push ebx
push eax
movsw word es:[edi], word [esi]
call fcn.009e1060
mov ebx, dword [ebp - 0x2c48]
add esp, 0x24
mov edx, ebx
xor ecx, ecx
mov esi, edx
mov ax, word [edx]
add edx, 2
cmp ax, cx
jne 0x419be0
lea edi, [ebp - 0x840]
sub edx, esi
sub edi, 2
mov ax, word [edi + 2]
add edi, 2
cmp ax, cx
jne 0x419bf6
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x840]
sub edi, 2
xor ecx, ecx
mov ax, word [edi + 2]
add edi, 2
cmp ax, cx
jne 0x419c1b
mov esi, str.7zFM.exe
lea ecx, [ebp - 0x840]
lea edx, [ecx + 2]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
xor esi, esi
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0x419c3d
sub ecx, edx
sar ecx, 1
push 1
lea eax, [ecx*2 + 2]
push eax
lea eax, [ebp - 0x840]
push eax
push esi
lea eax, [ebp - 0x33c]
push eax
push reloc.WS2_32.dll_bind
call fcn.004197e2
push 0x1e
pop ecx
mov esi, str.SoftwareMicrosoftWindowsCurrentVersionApp_Paths7zFM.exe
lea edi, [ebp - 0x3b8]
rep movsd dword es:[edi], dword [esi]
push 1
push dword [ebp - 0x2c44]
lea eax, [ebp - 0x10]
movsw word es:[edi], word [esi]
mov esi, str.Path
lea edi, [ebp - 0x10]
push ebx
push eax
lea eax, [ebp - 0x3b8]
movsd dword es:[edi], dword [esi]
push eax
push reloc.WS2_32.dll_bind
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
call fcn.004197e2
add esp, 0x30
jmp 0x419cb6
mov ebx, dword [ebp - 0x2c48]
xor eax, eax
push 0x400
push eax
lea eax, [ebp - 0x2c40]
push eax
call fcn.009e1060
add esp, 0xc
lea eax, [ebp - 0x2c40]
push 0x1ff
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryW]
xor edx, edx
test eax, eax
push 1
pop eax
movzx ecx, dl
cmovne ecx, eax
lea eax, [ebp - 0xc40]
push 0x400
push edx
push eax
mov dword [ebp - 0x2c44], ecx
call fcn.009e1060
lea edi, [ebp - 0xc40]
add esp, 0xc
sub edi, 2
xor ecx, ecx
mov ax, word [edi + 2]
add edi, 2
cmp ax, cx
jne 0x419d12
mov esi, str.CLSID_
lea edx, [ebp - 0xa0]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov esi, edx
mov ax, word [edx]
add edx, 2
cmp ax, cx
jne 0x419d30
lea edi, [ebp - 0xc40]
sub edx, esi
sub edi, 2
mov ax, word [edi + 2]
add edi, 2
cmp ax, cx
jne 0x419d46
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0xc40]
sub edi, 2
xor edx, edx
mov ax, word [edi + 2]
add edi, 2
cmp ax, dx
jne 0x419d6b
push 8
pop ecx
push 0x400
push edx
lea eax, [ebp - 0x1440]
mov esi, str.InprocServer32
rep movsd dword es:[edi], dword [esi]
push eax
call fcn.009e1060
add esp, 0xc
lea eax, [ebp - 0x1440]
push str.7_zip32.dll
push ebx
mov ebx, dword [sym.imp.SHLWAPI.dll_PathCombineW]
push eax
call ebx
lea ecx, [ebp - 0x1440]
xor esi, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0x419db6
sub ecx, edx
xor eax, eax
xor edx, edx
sar ecx, 1
push edx
inc eax
push eax
lea eax, [ecx*2 + 2]
push eax
lea eax, [ebp - 0x1440]
push eax
push edx
lea eax, [ebp - 0xc40]
push eax
push dword [ebp + 0xc]
call fcn.0041983d
add esp, 0x1c
lea edi, [ebp - 0x30]
mov esi, str.Apartment
push 5
pop ecx
rep movsd dword es:[edi], dword [esi]
lea ecx, [ebp - 0x30]
xor esi, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0x419e03
sub ecx, edx
xor eax, eax
push esi
sar ecx, 1
inc eax
push eax
lea eax, [ebp - 0x30]
lea edi, [ecx*2 + 2]
push edi
push eax
push str.ThreadingModel
lea eax, [ebp - 0xc40]
push eax
push dword [ebp + 0xc]
call fcn.0041983d
add esp, 0x1c
cmp byte [ebp - 0x2c44], 0
je 0x419ede
push 0x400
lea eax, [ebp - 0x840]
push esi
push eax
call fcn.009e1060
mov esi, dword [ebp - 0x2c48]
lea eax, [ebp - 0x840]
add esp, 0xc
push str.7_zip.dll
push esi
push eax
call ebx
lea ecx, [ebp - 0x840]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x2c4c]
jne 0x419e7a
xor eax, eax
sub ecx, edx
push 0x100
inc eax
sar ecx, 1
push eax
lea eax, [ecx*2 + 2]
push eax
lea eax, [ebp - 0x840]
push eax
xor eax, eax
push eax
lea eax, [ebp - 0xc40]
push eax
push dword [ebp + 0xc]
call fcn.0041983d
push 0x100
xor eax, eax
inc eax
push eax
push edi
lea eax, [ebp - 0x30]
push eax
push str.ThreadingModel
lea eax, [ebp - 0xc40]
push eax
push dword [ebp + 0xc]
call fcn.0041983d
add esp, 0x38
jmp 0x419ee4
mov esi, dword [ebp - 0x2c48]
mov edi, 0x400
xor eax, eax
push edi
push eax
lea eax, [ebp - 0x1840]
push eax
call fcn.009e1060
add esp, 0xc
lea eax, [ebp - 0x1840]
xor ecx, ecx
push ecx
cmp byte [ebp + 0xc], cl
je 0x419f0e
push 0x17
jmp 0x419f10
push 2
push eax
push ecx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push edi
xor edi, edi
lea eax, [ebp - 0x1040]
push edi
push eax
call fcn.009e1060
add esp, 0xc
lea eax, [ebp - 0x1840]
push 0xa0911c
push eax
lea eax, [ebp - 0x1040]
push eax
call ebx
push edi
lea eax, [ebp - 0x1040]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0x400
lea eax, [ebp - 0x1c40]
push edi
push eax
call fcn.009e1060
add esp, 0xc
lea eax, [ebp - 0x1040]
push str.7_Zip_Help.lnk
push eax
lea eax, [ebp - 0x1c40]
push eax
call ebx
push 0x400
lea eax, [ebp - 0x2040]
push edi
push eax
call fcn.009e1060
add esp, 0xc
lea eax, [ebp - 0x2040]
push str.7_zip.chm
push esi
push eax
call ebx
push str.7_Zip_Help
lea eax, [ebp - 0x1c40]
push eax
lea eax, [ebp - 0x2040]
push eax
call fcn.004194ec
push 0x400
lea eax, [ebp - 0x2840]
push edi
push eax
call fcn.009e1060
add esp, 0x18
lea eax, [ebp - 0x2840]
push str.7zFM.exe
push esi
push eax
call ebx
push 0x400
lea eax, [ebp - 0x2440]
push edi
push eax
call fcn.009e1060
add esp, 0xc
lea eax, [ebp - 0x1040]
push str.7_Zip_File_Manager.lnk
push eax
lea eax, [ebp - 0x2440]
push eax
call ebx
push str.7_Zip_File_Manager
lea eax, [ebp - 0x2440]
push eax
lea eax, [ebp - 0x2840]
push eax
call fcn.004194ec
add esp, 0xc
push 0x40
push str.Completed
push str.7_Zip_21.07_is_installed
push edi
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00993100
leave
ret 8