Function at 0x408ecc
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
sub esp, 0x20
test ecx, ecx
jns 0x408eea
lea eax, [ecx*4 + 4]
mov ecx, dword [0x45253c]
sub ecx, eax
mov ecx, dword [ecx]
mov eax, dword [0x431d88]
mov edx, dword [ebp + 8]
push ebx
push esi
mov esi, 0x4726b8
lea ebx, [eax + ecx*2]
xor ecx, ecx
push edi
mov edi, esi
cmp edx, esi
jb 0x409148
mov eax, edx
sub eax, esi
sar eax, 1
cmp eax, 0x4008
jae 0x409148
mov edi, edx
mov dword [ebp + 8], ecx
jmp 0x409148
mov eax, edi
mov edx, ebx
sub eax, esi
mov dword [ebp - 4], edx
and eax, 0xfffffffe
cmp eax, 0x4008
jge 0x409154
movzx ecx, cx
mov eax, 0xe000
add ebx, 2
test eax, ecx
je 0x409130
cmp cx, ax
jbe 0x409133
movzx edx, word [ebx]
mov ebx, 0x8000
movzx eax, dl
mov esi, edx
mov dword [ebp - 0xc], eax
and esi, 0x7fff
mov dword [ebp - 0x1c], eax
or eax, ebx
shr edx, 8
mov dword [ebp - 0x20], eax
mov eax, edx
or eax, ebx
mov dword [ebp + 0xc], edx
mov ebx, dword [ebp - 4]
mov dword [ebp - 0x18], eax
add ebx, 4
mov eax, 0xe002
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], ebx
cmp cx, ax
jne 0x4090ce
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov esi, dword [ebp + 0xc]
test eax, eax
jns 0x408fc4
mov ecx, 0x5a04
cmp ax, cx
je 0x408fc4
cmp esi, 0x23
je 0x408fc4
cmp esi, 0x2e
je 0x408fc4
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x408fcb
mov dword [ebp - 4], 1
cmp dword [0x41dc6c], 0
mov ecx, dword [ebp - 0xc]
push 2
pop ebx
push 4
pop eax
cmovne ebx, eax
test cl, cl
jns 0x40901c
mov eax, ecx
and ecx, 0x3f
and eax, 0x40
push eax
mov eax, dword [0x431d88]
push edi
lea eax, [eax + ecx*2]
push eax
push dword [0x47a6cc]
push 0x80000002
call fcn.00409853
xor eax, eax
cmp word [edi], ax
jne 0x4090a9
push esi
push edi
call fcn.00408ecc
jmp 0x4090a9
cmp ecx, 0x25
jne 0x40902f
push 0x2004
push edi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
jmp 0x4090a9
cmp ecx, 0x24
jne 0x409046
push 0x2004
push edi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
xor esi, esi
mov ebx, esi
jmp 0x4090a5
xor esi, esi
jmp 0x4090a5
mov eax, dword [0x44e3d0]
dec ebx
test eax, eax
je 0x40906d
cmp dword [ebp - 4], 0
je 0x40906d
push edi
push esi
push esi
push dword [ebp + ebx*4 - 0x20]
push dword [0x44e3c8]
call eax
test eax, eax
je 0x4090a9
lea eax, [ebp - 8]
push eax
push dword [ebp + ebx*4 - 0x20]
push dword [0x44e3c8]
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x40909e
push edi
push dword [ebp - 8]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
push dword [ebp - 8]
mov esi, eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
test esi, esi
jne 0x4090a9
xor eax, eax
push eax
mov word [edi], ax
pop esi
test ebx, ebx
jne 0x40904a
xor esi, esi
cmp word [edi], si
je 0x4090c3
cmp dword [ebp + 0xc], 0x1a
jne 0x4090c3
push dword [0x47a6c8]
push edi
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push edi
call fcn.00409c0f
mov ebx, dword [ebp - 0x10]
jmp 0x409120
mov eax, 0xe001
cmp cx, ax
jne 0x40910d
cmp esi, 0x1d
jne 0x4090eb
push dword [0x44e3c8]
push edi
call fcn.00409aac
jmp 0x4090fd
imul eax, esi, 0x4008
add eax, section..ndata
push eax
push edi
call fcn.00409ad1
lea eax, [esi - 0x15]
cmp eax, 7
jae 0x409120
push edi
call fcn.00409c0f
jmp 0x409120
mov eax, 0xe003
cmp cx, ax
jne 0x409120
not esi
push esi
push edi
call fcn.00408ecc
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
mov esi, 0x4726b8
jmp 0x409146
cmp cx, ax
push 2
jne 0x409142
mov ax, word [ebx]
lea ebx, [edx + 4]
mov word [edi], ax
jmp 0x409145
mov word [edi], cx
pop eax
add edi, eax
movzx ecx, word [ebx]
test cx, cx
jne 0x408f24
xor eax, eax
mov word [edi], ax
mov eax, dword [ebp + 8]
test eax, eax
je 0x409169
push esi
push eax
call fcn.00409ad1
jmp 0x40916b
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 8