Function at 0x409693
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
lea eax, [ebp - 8]
mov byte [ebp - 1], cl
xor ecx, ecx
mov dword [ebp - 8], ecx
push eax
push ecx
push ecx
test dl, dl
je 0x4097af
push 0x4010c0
call dword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
test eax, eax
je 0x4096ca
mov al, 1
jmp 0x409879
mov esi, dword [ebp - 8]
lea eax, [ebp - 0xc]
push eax
mov edx, SysReAllocString
mov ecx, esi
call fcn.0040a1f7
test eax, eax
je 0x4096ee
test esi, esi
je 0x4096c3
push esi
call dword [sym.imp.ole32.dll_CoTaskMemFree]
jmp 0x4096c3
mov ebx, dword [ebp - 0xc]
xor ecx, ecx
mov esi, ebx
add ebx, 0x14
push 2
pop edx
mov eax, ebx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call dword [sym.imp.msvcrt.dll____U_YAPAXI_Z]
mov edi, eax
mov edx, ebx
pop ecx
xor eax, eax
mov ecx, edi
push esi
mov word [edi], ax
push dword [ebp - 8]
call fcn.0040a16c
push dword [ebp - 8]
test eax, eax
je 0x40973d
call dword [sym.imp.ole32.dll_CoTaskMemFree]
push edi
call dword [sym.imp.msvcrt.dll____V_YAXPAX_Z]
mov al, 1
jmp 0x409878
call dword [sym.imp.ole32.dll_CoTaskMemFree]
push 0x13
push str.windowspowerShell_
mov edx, ebx
mov ecx, edi
call fcn.0040a16c
test eax, eax
jne 0x40972f
xor ecx, ecx
mov dword [ebp - 8], edi
push 2
pop edx
cmp byte [ebp - 1], cl
je 0x409880
lea eax, [ebx + 0x21]
mov dword [ebp - 0xc], eax
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call dword [sym.imp.msvcrt.dll____U_YAPAXI_Z]
mov esi, eax
xor eax, eax
pop ecx
push ebx
mov ebx, dword [ebp - 0xc]
mov ecx, esi
mov word [esi], ax
mov edx, ebx
push dword [ebp - 8]
call fcn.0040a16c
test eax, eax
je 0x409846
push edi
call dword [sym.imp.msvcrt.dll____V_YAXPAX_Z]
push esi
call dword [sym.imp.msvcrt.dll____V_YAXPAX_Z]
pop ecx
jmp 0x409736
push 0x4010d0
call dword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
test eax, eax
jne 0x4096c3
mov esi, dword [ebp - 8]
lea eax, [ebp - 0xc]
push eax
mov edx, SysReAllocString
mov ecx, esi
call fcn.0040a1f7
test eax, eax
jne 0x4096e1
mov ebx, dword [ebp - 0xc]
xor ecx, ecx
mov esi, ebx
add ebx, 0x19
push 2
pop edx
mov eax, ebx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call dword [sym.imp.msvcrt.dll____U_YAPAXI_Z]
mov edi, eax
mov edx, ebx
pop ecx
xor eax, eax
mov ecx, edi
push esi
mov word [edi], ax
push dword [ebp - 8]
call fcn.0040a16c
push dword [ebp - 8]
test eax, eax
jne 0x409729
call dword [sym.imp.ole32.dll_CoTaskMemFree]
push 0x13
push str.windowspowerShell_
mov edx, ebx
mov ecx, edi
call fcn.0040a16c
test eax, eax
jne 0x40972f
push 5
push str.v1.0_
jmp 0x40974a
push 0x20
push str.microsoft.powerShell_profile.ps1
mov edx, ebx
mov ecx, esi
call fcn.0040a16c
test eax, eax
jne 0x40979e
push edi
call dword [sym.imp.msvcrt.dll____V_YAXPAX_Z]
pop ecx
mov ecx, esi
call fcn.004098db
mov bl, al
push esi
call dword [sym.imp.msvcrt.dll____V_YAXPAX_Z]
mov al, bl
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebx + 0xc]
mov dword [ebp - 0xc], eax
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call dword [sym.imp.msvcrt.dll____U_YAPAXI_Z]
mov esi, eax
xor eax, eax
pop ecx
push ebx
mov ebx, dword [ebp - 0xc]
mov ecx, esi
mov word [esi], ax
mov edx, ebx
push dword [ebp - 8]
call fcn.0040a16c
test eax, eax
jne 0x40979e
push 0xb
push str.profile.ps1
mov edx, ebx
mov ecx, esi
call fcn.0040a16c
test eax, eax
je 0x40985e
push edi
call dword [sym.imp.msvcrt.dll____V_YAXPAX_Z]
pop ecx
mov bl, 1
jmp 0x40986f