Function at 0x402170
Capabilities:
Get common file path
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xf0
mov eax, dword [0x56f190]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 0x9c
mov dword [ebp - 0xc4], eax
mov dword [eax], 0
lea eax, [ebp - 0xac]
push 0
push eax
call fcn.00503970
add esp, 0xc
lea ecx, [ebp - 0xac]
push ecx
mov dword [ebp - 0xac], 0x9c
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
lea eax, [ebp - 0xb0]
push eax
push 0x54f014
mov edx, 5
cmp edx, dword [ebp - 0xa8]
push 0x17
push 0
sbb ebx, ebx
push 0x54e26c
neg ebx
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x4023c9
xor eax, eax
mov ecx, eax
mov edx, eax
mov esi, eax
mov dword [ebp - 0xec], ecx
mov dword [ebp - 0xe8], edx
mov dword [ebp - 0xe4], esi
mov dword [ebp - 0xe0], eax
test ebx, ebx
je 0x4022f1
mov dword [ebp - 0xd8], edx
lea edx, [ebp - 0xb4]
push edx
push 1
lea edx, [ebp - 0xc8]
push edx
push 8
lea edx, [ebp - 0xec]
mov dword [ebp - 0xd0], eax
mov eax, dword [ebp - 0xb0]
push edx
mov dword [ebp - 0xdc], ecx
mov dword [ebp - 0xd4], esi
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x3c]
call eax
test eax, eax
jne 0x4023b4
mov ecx, dword [ebp - 0xb4]
lea eax, [ebp - 0xb8]
push eax
push 0x54efe4
push 0x54df8c
push ecx
call dword [sym.imp.SHLWAPI.dll_IUnknown_QueryService]
mov esi, eax
test esi, esi
js 0x4022de
mov eax, dword [ebp - 0xb8]
mov edx, dword [eax]
mov edx, dword [edx + 0x3c]
lea ecx, [ebp - 0xbc]
push ecx
push eax
call edx
mov esi, eax
test esi, esi
js 0x4022d0
mov edx, dword [ebp - 0xc4]
mov eax, dword [ebp - 0xbc]
mov ecx, dword [eax]
push edx
push 0x54f004
push eax
mov eax, dword [ecx]
call eax
mov esi, eax
test ebx, ebx
je 0x4022d0
mov eax, dword [ebp - 0xbc]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [ebp - 0xb8]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [ebp - 0xb4]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
jmp 0x4023b9
lea ecx, [ebp - 0xc0]
push ecx
push 0
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
mov edx, dword [ebp - 0xc0]
push 0
push 0
push 0
push edx
call dword [sym.imp.SHELL32.dll_SHOpenFolderAndSelectItems]
mov ecx, dword [ebp - 0xc0]
mov dword [ebp - 0xd4], ecx
lea ecx, [ebp - 0xb4]
push ecx
push 1
lea ecx, [ebp - 0xc8]
push ecx
push 1
mov eax, 0x400c
lea ecx, [ebp - 0xec]
push ecx
mov word [ebp - 0xdc], ax
mov eax, dword [ebp - 0xb0]
mov edx, dword [eax]
mov edx, dword [edx + 0x3c]
lea ecx, [ebp - 0xdc]
push ecx
push eax
call edx
test eax, eax
jne 0x4023b4
mov esi, dword [sym.imp.USER32.dll_FindWindowA]
xor edi, edi
jmp 0x402370
push 0x54edac
push str.CabinetWClass
call esi
test eax, eax
jne 0x4023a6
push str.Desktop
push str.CabinetWClass
call esi
test eax, eax
jne 0x4023a6
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
inc edi
cmp edi, 0x3e8
jb 0x402370
jmp 0x402264
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x402264
mov esi, 0x80004005
mov eax, dword [ebp - 0xb0]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, esi
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00501afe
mov esp, ebp
pop ebp
ret 4