Function at 0x41e860
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46dfcb
mov eax, dword fs:[0]
push eax
sub esp, 0x128
mov eax, dword [0x4b0408]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x134]
mov ebx, dword [ebp + 0xc]
xor esi, esi
push esi
mov dword [ebp - 0x120], eax
mov dword [ebp - 0x118], ebx
call fcn.00412820
mov dword [ebp - 4], esi
test ebx, ebx
jle 0x41ea85
lea eax, [ebp - 0x134]
cmp dword [ebp + 0x14], esi
je 0x41e8c9
push esi
push esi
push esi
jmp 0x41e8d8
push str._AMZ2112
push str.shelloldbuild
push str.shelloldmake
push 0x4b0374
push str.shellfolder
push eax
call fcn.004231b0
add esp, 0x18
mov dword [ebp - 0x11c], eax
test eax, eax
jle 0x41ea7f
cmp byte [0x4b19b0], 0
je 0x41e999
mov esi, 0x4b19b0
lea ecx, [esi + 1]
nop
mov al, byte [esi]
inc esi
test al, al
jne 0x41e910
sub esi, ecx
lea ecx, [ebp - 0x134]
call fcn.004131a0
mov edi, eax
test edi, edi
je 0x41e999
nop word [eax + eax]
mov ecx, edi
call fcn.00413190
mov ebx, eax
test ebx, ebx
je 0x41e950
push esi
push 0x4b19b0
push ebx
call fcn.0043f3c8
add esp, 0xc
test eax, eax
je 0x41e964
push edi
lea ecx, [ebp - 0x134]
call fcn.00413250
mov edi, eax
test edi, edi
jne 0x41e930
jmp 0x41e999
cmp dword [ebp + 0x10], 0
push dword [ebp - 0x118]
je 0x41e973
push ebx
jmp 0x41e977
lea eax, [ebx + esi]
push eax
mov esi, dword [ebp - 0x120]
push esi
call fcn.0043f7d0
mov eax, dword [ebp - 0x118]
add esp, 0xc
mov byte [eax + esi - 1], 0
test edi, edi
jne 0x41ea7f
push 0x104
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea esi, [ebp - 0x114]
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x41e9b4
sub esi, ecx
lea ecx, [ebp - 0x134]
call fcn.004131a0
mov ebx, eax
test ebx, ebx
je 0x41ea08
nop
mov ecx, ebx
call fcn.00413190
mov edi, eax
test edi, edi
je 0x41e9f6
push esi
lea eax, [ebp - 0x114]
push eax
push edi
call fcn.0043f3c8
add esp, 0xc
test eax, eax
jne 0x41eac2
push ebx
lea ecx, [ebp - 0x134]
call fcn.00413250
mov ebx, eax
test ebx, ebx
jne 0x41e9d0
mov edi, dword [ebp - 0x118]
cmp dword [ebp + 0x10], 0
je 0x41eb57
lea ecx, [ebp - 0x134]
call fcn.004131a0
test eax, eax
je 0x41ea7f
mov ecx, eax
call fcn.00413190
mov esi, eax
test esi, esi
je 0x41ea7f
cmp byte [0x4b19b0], 0
jne 0x41ea69
mov edx, 0x4b19b0
mov ecx, esi
sub edx, esi
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx + ecx - 1], al
test al, al
jne 0x41ea46
push 0x5c
push 0x4b19b0
call fcn.004324f0
add esp, 8
test eax, eax
je 0x41ea69
mov byte [eax], 0
mov ebx, dword [ebp - 0x120]
push edi
push esi
push ebx
call fcn.0043f7d0
add esp, 0xc
mov byte [edi + ebx - 1], 0
mov esi, dword [ebp - 0x11c]
push 1
lea ecx, [ebp - 0x134]
call fcn.00412ee0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x134]
call fcn.004128e0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042bd08
mov esp, ebp
pop ebp
ret
cmp byte [0x4b19b0], 0
jne 0x41eaf7
mov edx, 0x4b19b0
mov ecx, edi
sub edx, edi
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx + ecx - 1], al
test al, al
jne 0x41ead4
push 0x5c
push 0x4b19b0
call fcn.004324f0
add esp, 8
test eax, eax
je 0x41eaf7
mov byte [eax], 0
cmp dword [ebp + 0x10], 0
je 0x41eb14
push dword [ebp - 0x118]
push edi
push dword [ebp - 0x120]
call fcn.0043f7d0
add esp, 0xc
jmp 0x41eb39
push 0x5c
push edi
call fcn.004324f0
push dword [ebp - 0x118]
test eax, eax
lea ecx, [eax + 1]
cmovne edi, ecx
push edi
push dword [ebp - 0x120]
call fcn.0043f7d0
add esp, 0x14
mov edi, dword [ebp - 0x118]
mov eax, dword [ebp - 0x120]
mov byte [edi + eax - 1], 0
test ebx, ebx
jne 0x41ea7f
jmp 0x41ea0e
xor esi, esi
jmp 0x41ea85