Function at 0x406005
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x18
mov eax, dword [ebp + 0xc]
mov ecx, dword [0x424cc8]
test eax, eax
lea edi, [ecx + eax]
jns 0x40602d
inc eax
mov edx, dword [0x4255d0]
imul eax, eax, 0xfffffffc
mov edi, ecx
add edi, dword [edx + eax]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x24], 0x4255e0
sub eax, 0x4255e0
cmp eax, 0x7ff
ja 0x4061f1
mov eax, dword [ebp + 8]
mov dword [ebp + 8], 0
mov dword [ebp - 0x24], eax
jmp 0x4061f1
mov eax, dword [ebp - 0x24]
sub eax, 0x4255e0
cmp eax, 0x3ff
jg 0x4061fb
inc edi
cmp cl, 0xfc
jbe 0x4061d7
movsx ebx, byte [edi + 1]
movsx edx, byte [edi]
and ebx, 0x7f
mov eax, edx
and eax, 0x7f
mov dword [ebp - 0x1c], edx
shl ebx, 7
or ebx, eax
movsx eax, byte [edi]
or ah, 0x80
mov dword [ebp - 0x18], eax
movsx eax, byte [edi + 1]
mov dword [ebp - 0x14], eax
movsx eax, byte [edi + 1]
or ah, 0x80
add edi, 2
mov dword [ebp - 0x10], eax
cmp cl, 0xfe
jne 0x40617c
cmp dword [0x424c44], 1
sbb esi, esi
and esi, 0xfffffffe
add esi, 4
test dl, dl
jns 0x4060fb
mov eax, edx
and edx, 0x3f
and eax, 0x40
add edx, dword [0x424cc8]
push eax
push dword [ebp - 0x24]
push edx
push str.SoftwareMicrosoftWindowsCurrentVersion
push 0x80000002
call fcn.00405df6
mov ecx, dword [ebp - 0x24]
cmp byte [ecx], 0
jne 0x406121
push dword [ebp - 0x14]
push ecx
call fcn.00406005
jmp 0x406121
cmp edx, 0x25
jne 0x40610f
push 0x400
push dword [ebp - 0x24]
call sub.KERNEL32.dll_GetSystemDirectoryA
jmp 0x406121
cmp edx, 0x24
jne 0x406123
push 0x400
push dword [ebp - 0x24]
call sub.KERNEL32.dll_GetWindowsDirectoryA
xor esi, esi
dec esi
cmp esi, 0xffffffff
je 0x406161
lea eax, [ebp - 0x20]
push eax
push dword [ebp + esi*4 - 0x1c]
push dword [0x424d20]
call sub.SHELL32.DLL_SHGetSpecialFolderLocation
test eax, eax
jne 0x406159
push dword [ebp - 0x24]
push dword [ebp - 0x20]
call sub.SHELL32.DLL_SHGetPathFromIDListA
mov ebx, eax
push dword [ebp - 0x20]
call sub.OLE32.dll_CoTaskMemFree
test ebx, ebx
jne 0x406161
mov eax, dword [ebp - 0x24]
mov byte [eax], 0
jmp 0x406123
mov ecx, dword [ebp - 0x24]
cmp byte [ecx], 0
je 0x4061b1
cmp dword [ebp - 0x14], 0x1a
jne 0x4061b1
push str.MicrosoftInternet_ExplorerQuick_Launch
push ecx
call fcn.00405fcc
jmp 0x4061b1
cmp cl, 0xfd
jne 0x4061bb
cmp ebx, 0x1d
jne 0x406196
push dword [0x424d20]
push dword [ebp - 0x24]
call fcn.00405e69
jmp 0x4061a9
mov eax, ebx
shl eax, 0xa
add eax, section..ndata
push eax
push dword [ebp - 0x24]
call fcn.00405f27
lea eax, [ebx - 0x15]
cmp eax, 6
ja 0x4061ca
push dword [ebp - 0x24]
call fcn.00405ca4
jmp 0x4061ca
inc cl
jne 0x4061ca
not ebx
push ebx
push dword [ebp - 0x24]
call fcn.00406005
push dword [ebp - 0x24]
call fcn.00405f3e
add dword [ebp - 0x24], eax
jmp 0x4061f1
mov eax, dword [ebp - 0x24]
lea edx, [eax + 1]
jne 0x4061e9
mov ecx, dword [ebp - 0x24]
mov al, byte [edi]
inc edi
mov byte [ecx], al
jmp 0x4061ee
mov eax, dword [ebp - 0x24]
mov byte [eax], cl
mov dword [ebp - 0x24], edx
mov cl, byte [edi]
test cl, cl
jne 0x406059
mov ecx, dword [ebp - 0x24]
mov eax, 0x4255e0
mov byte [ecx], 0
cmp dword [ebp + 8], 0
je 0x406215
push eax
push dword [ebp + 8]
call fcn.00405f27
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 8