Function at 0x1033ad3
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x578
mov eax, dword [0x1046080]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push 1
push 0xb
push edi
mov dword [ebp - 4], eax
mov dword [ebp - 0x520], ecx
mov dword [ebp - 0x530], edi
call dword [sym.imp.SHELL32.dll_SHCloneSpecialIDList]
mov ecx, dword [ebp - 0x520]
mov ebx, eax
xor esi, esi
push esi
mov dword [ebp - 0x528], ebx
call fcn.01002675
push edi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
cmp ebx, esi
je 0x1033e31
push ebx
call dword [sym.imp.SHELL32.dll_ILFindLastID]
push eax
call dword [sym.imp.SHELL32.dll_ILClone]
push ebx
mov dword [ebp - 0x524], eax
call dword [sym.imp.SHELL32.dll_ILRemoveLastID]
cmp dword [ebp - 0x524], esi
je 0x1033e25
push ebx
call fcn.0103ada1
mov ebx, eax
cmp ebx, esi
mov dword [ebp - 0x538], ebx
je 0x1033e19
call dword [sym.imp.USER32.dll_CreatePopupMenu]
cmp eax, esi
mov dword [ebp - 0x51c], eax
je 0x1033e13
mov eax, dword [ebx]
lea ecx, [ebp - 0x52c]
push ecx
push esi
push 0x1009b20
lea ecx, [ebp - 0x524]
push ecx
push 1
push edi
push ebx
call dword [eax + 0x28]
test eax, eax
jl 0x1033e07
mov eax, dword [ebp - 0x52c]
mov ecx, dword [eax]
push 2
push 0x7fef
push 2
push esi
push dword [ebp - 0x51c]
push eax
call dword [ecx + 0xc]
test eax, eax
jl 0x1033df5
mov ebx, dword [sym.imp.USER32.dll_LoadStringW]
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0x2d0
push dword [0x10460dc]
call ebx
mov edi, dword [sym.imp.USER32.dll_AppendMenuW]
lea eax, [ebp - 0x20c]
push eax
push 0x7ff2
push esi
push dword [ebp - 0x51c]
call edi
push 0x400000
call dword [sym.imp.SHELL32.dll_SHRestricted]
test eax, eax
jne 0x1033ca3
lea eax, [ebp - 0x20c]
push eax
push esi
push esi
push 0x16
push esi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x534], eax
je 0x1033ca3
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
cmp eax, esi
je 0x1033ca3
push esi
push esi
push 0x800
push dword [ebp - 0x51c]
call edi
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0x2ce
push dword [0x10460dc]
call ebx
lea eax, [ebp - 0x20c]
push eax
push 0x7ff0
push esi
push dword [ebp - 0x51c]
call edi
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0x2cf
push dword [0x10460dc]
call ebx
lea eax, [ebp - 0x20c]
push eax
push 0x7ff1
push esi
push dword [ebp - 0x51c]
call edi
cmp dword [ebp + 0xc], 0xffffffff
jne 0x1033cbe
push dword [ebp - 0x51c]
mov ecx, dword [ebp - 0x520]
call fcn.010308df
mov edx, eax
jmp 0x1033d20
mov eax, dword [ebp - 0x520]
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push esi
push esi
mov ebx, 0x401
push ebx
push dword [eax + 0x3b4]
call edi
mov eax, dword [ebp + 0xc]
push esi
push dword [ebp - 0x530]
shr eax, 0x10
push esi
movsx eax, ax
push eax
movsx eax, word [ebp + 0xc]
push eax
push 0x102
push dword [ebp - 0x51c]
call dword [sym.imp.USER32.dll_TrackPopupMenu]
push esi
push 1
mov dword [ebp - 0x534], eax
mov eax, dword [ebp - 0x520]
push ebx
push dword [eax + 0x3b4]
call edi
mov edx, dword [ebp - 0x534]
mov eax, edx
sub eax, esi
je 0x1033df5
sub eax, 0x7ff0
je 0x1033de9
dec eax
je 0x1033de5
dec eax
je 0x1033dd6
push 0xf
xor eax, eax
pop ecx
lea edi, [ebp - 0x574]
rep stosd dword es:[edi], eax
mov eax, dword [ebp - 0x530]
mov dword [ebp - 0x570], eax
add edx, 0xfffffffe
movzx eax, dx
mov dword [ebp - 0x56c], eax
lea eax, [ebp - 0x310]
push eax
push dword [ebp - 0x528]
mov dword [ebp - 0x578], 0x40
mov dword [ebp - 0x560], 1
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
lea eax, [ebp - 0x518]
push eax
push dword [ebp - 0x528]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
or byte [ebp - 0x573], 0x40
lea eax, [ebp - 0x310]
mov dword [ebp - 0x564], eax
lea eax, [ebp - 0x518]
mov dword [ebp - 0x548], eax
mov eax, dword [ebp - 0x52c]
mov ecx, dword [eax]
lea edx, [ebp - 0x578]
push edx
push eax
call dword [ecx + 0x10]
jmp 0x1033df5
mov ecx, dword [ebp - 0x520]
push 2
call fcn.010330b7
jmp 0x1033df5
push 1
jmp 0x1033dea
push esi
mov ecx, dword [ebp - 0x520]
call fcn.01033987
mov eax, dword [ebp - 0x52c]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ebx, dword [ebp - 0x538]
push dword [ebp - 0x51c]
call dword [sym.imp.USER32.dll_DestroyMenu]
mov eax, dword [ebx]
push ebx
call dword [eax + 8]
push dword [ebp - 0x524]
call dword [sym.imp.SHELL32.dll_ILFree]
push dword [ebp - 0x528]
call dword [sym.imp.SHELL32.dll_ILFree]
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.01001aff
leave
ret 8