Function at 0x401000
Capabilities:
Get common file path

Disassembly:
push 0x42042c
push 0
push 0x473494
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0
call sub.kernel32.dll_GetModuleHandleW
mov dword [0x473498], eax
push 0
push 0x1000
push 0
call sub.kernel32.dll_HeapCreate
mov dword [0x473494], eax
mov eax, str.FormatEx
mov dword [0x4734c8], eax
call fcn.0045e5d0
call fcn.0045e224
call fcn.0045d204
call fcn.0045cbcd
call fcn.0045b5d0
call fcn.0045afaf
call fcn.0045abc0
call fcn.00458485
call fcn.0045145d
call fcn.00450fc8
call fcn.00450555
call fcn.0044f155
push 0x4000
call fcn.0045ac20
mov dword [0x47354c], eax
push 0x4000
call fcn.0045ac20
mov dword [0x473550], eax
push 0x6c
call fcn.0045ac20
mov dword [0x473554], eax
push 0x58
call fcn.0045ac20
mov dword [0x473568], eax
push 0xec
call fcn.0045ac20
mov dword [0x473558], eax
push 0x50
call fcn.0045ac20
mov dword [0x473548], eax
push 0x74
call fcn.0045ac20
mov dword [0x47355c], eax
push 0x28
call fcn.0045ac20
mov dword [0x473560], eax
push 0x11
call fcn.0045ac20
mov dword [0x473564], eax
push 0x48
call fcn.0045ac20
mov dword [0x47356c], eax
push 0x893880
push 0x46e070
push 8
push 0xbe9
push 4
call fcn.0045e24d
push 0x893888
push 0x46e070
push 8
push 1
push 4
call fcn.0045e24d
mov dword [0x893894], 0x19
mov dword [0x893898], 2
push 0x893890
push 0
push 0x15
push 4
push 2
call fcn.0045e2f4
mov dword [0x8938a0], 0x1b
mov dword [0x8938a4], 2
push 0x89389c
push 0
push 0x15
push 4
push 2
call fcn.0045e2f4
push 0x8938a8
push 0x46e070
push 8
push 0x19
push 4
call fcn.0045e24d
push 0x8938b0
push 0x46e070
push 8
push 0x1b
push 4
call fcn.0045e24d
push 0x8938b8
push 0x46e070
push 8
push 2
push 4
call fcn.0045e24d
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e620
pop edx
push eax
push 0x104
call fcn.0044f2b0
mov ebp, dword [0x47356c]
lea eax, [ebp + 0x10]
push eax
call fcn.0045e660
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e620
pop edx
push eax
push 0x104
call fcn.0044f2b0
mov ebp, dword [0x47356c]
lea eax, [ebp + 4]
push eax
call fcn.0045e660
mov ebp, dword [0x47356c]
push dword [ebp + 0x10]
push 0x104
call sub.kernel32.dll_GetTempPathW
push 0x104
mov ebp, dword [0x47356c]
push dword [ebp + 0x10]
mov ebp, dword [0x47356c]
push dword [ebp + 0x10]
call sub.kernel32.dll_GetLongPathNameW
push 0x104
mov ebp, dword [0x47356c]
push dword [ebp + 4]
push 0
call sub.kernel32.dll_GetModuleFileNameW
push 0x104
mov ebp, dword [0x47356c]
push dword [ebp + 4]
mov ebp, dword [0x47356c]
push dword [ebp + 4]
call sub.kernel32.dll_GetLongPathNameW
mov ebp, dword [0x47356c]
push dword [ebp + 0x10]
call sub.shlwapi.dll_PathAddBackslashW
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e620
pop edx
push eax
mov ebp, dword [0x47356c]
push dword [ebp + 4]
call fcn.0045b156
mov ebp, dword [0x47356c]
lea eax, [ebp + 8]
push eax
call fcn.0045e660
mov ebp, dword [0x47356c]
mov edx, dword [ebp + 8]
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e6f0
mov ebp, dword [0x47356c]
lea eax, [ebp]
push eax
call fcn.0045e660
push edx
call fcn.0045e620
pop edx
push eax
call fcn.0040b18d
mov ebp, dword [0x47356c]
lea eax, [ebp + 0x14]
push eax
call fcn.0045e660
mov ebp, dword [0x47356c]
mov edx, dword [ebp + 0x14]
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e6f0
mov edx, 0x467534
push edx
call fcn.0045e6f0
mov ebp, dword [0x47356c]
lea eax, [ebp + 0x18]
push eax
call fcn.0045e660
call sub.kernel32.dll_GetUserDefaultLCID
push eax
mov ebp, dword [0x47356c]
pop dword [ebp + 0x2c]
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e620
pop edx
push eax
mov ebp, dword [0x47356c]
mov eax, dword [ebp + 0x2c]
cdq
push edx
push eax
call fcn.0044f300
mov ebp, dword [0x47356c]
lea eax, [ebp + 0x28]
push eax
call fcn.0045e660
mov ebp, dword [0x47356c]
mov edx, dword [ebp + 8]
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e6f0
mov edx, str.Lang_
push edx
call fcn.0045e6f0
mov ebp, dword [0x47356c]
mov edx, dword [ebp + 0x28]
push edx
call fcn.0045e6f0
mov edx, str..dll
push edx
call fcn.0045e6f0
mov ebp, dword [0x473554]
lea eax, [ebp + 0x38]
push eax
call fcn.0045e660
mov ebp, dword [0x47355c]
mov dword [ebp + 0x6c], 1
mov ebp, dword [0x473558]
mov dword [ebp + 0x68], 1
mov ebp, dword [0x473558]
mov edx, str.Notepad.exe
lea ecx, [ebp + 0x44]
call fcn.0044e008
mov ebp, dword [0x473558]
mov edx, str.Notepad.exe
lea ecx, [ebp + 0x48]
call fcn.0044e008
mov ebp, dword [0x473558]
mov edx, str.Notepad.exe
lea ecx, [ebp + 0x4c]
call fcn.0044e008
mov ebp, dword [0x473564]
mov edx, 0x4691fe
lea ecx, [ebp + 9]
call fcn.0044e008
mov ebp, dword [0x473564]
mov edx, str._sources_OEM_
lea ecx, [ebp + 0xd]
call fcn.0044e008
mov ebp, dword [0x47356c]
mov edx, dword [ebp + 8]
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e6f0
mov edx, str.Toolsx86_
push edx
call fcn.0045e6f0
mov ebp, dword [0x47356c]
lea eax, [ebp + 0xc]
push eax
call fcn.0045e660
push 0x800
push 0
mov eax, str.cabinet.dll
push eax
call sub.kernel32.dll_LoadLibraryExW
mov dword [0x47353c], eax
cmp dword [0x47353c], 0
je 0x40150e
push 0x14
push dword [0x47353c]
call sub.kernel32.dll_GetProcAddress
mov dword [0x473540], eax
push 0x16
push dword [0x47353c]
call sub.kernel32.dll_GetProcAddress
mov dword [0x473538], eax
push 0x17
push dword [0x47353c]
call sub.kernel32.dll_GetProcAddress
mov dword [0x473544], eax
push 0x893878
push 0x46e130
push 7
push 0xb
push 0x14
call fcn.0045e24d
call fcn.00422d8f
mov dword [0x4734ac], eax
call fcn.0040e014
fstp qword [0x47349c]
call fcn.00436c22
mov ebp, dword [0x8938a8]
mov edx, str.CreateUser
lea ecx, [ebp + 4]
call fcn.0044e008
mov edx, 0x465954
lea ecx, [ebp + 8]
call fcn.0044e008
mov edx, str.MaxPwAge
lea ecx, [ebp + 0xc]
call fcn.0044e008
mov edx, str.AutoLogon
lea ecx, [ebp + 0x10]
call fcn.0044e008
mov edx, str.ExplorerDetailView
lea ecx, [ebp + 0x14]
call fcn.0044e008
mov edx, str.ShowHidden
lea ecx, [ebp + 0x18]
call fcn.0044e008
mov edx, 0x4678d4
lea ecx, [ebp + 0x1c]
call fcn.0044e008
mov edx, str.ShowQuicklaunch
lea ecx, [ebp + 0x20]
call fcn.0044e008
mov edx, str.ShowFileExt
lea ecx, [ebp + 0x24]
call fcn.0044e008
mov edx, str.ExplorerStatusBar
lea ecx, [ebp + 0x28]
call fcn.0044e008
mov edx, str.ShowCmdContextMenu
lea ecx, [ebp + 0x2c]
call fcn.0044e008
mov edx, str.NoHibernate
lea ecx, [ebp + 0x30]
call fcn.0044e008
mov edx, str.RemoveShortCutTo
lea ecx, [ebp + 0x34]
call fcn.0044e008
mov edx, str.RemoveShortCutArrow
lea ecx, [ebp + 0x38]
call fcn.0044e008
mov edx, str.RemoveXPTour
lea ecx, [ebp + 0x3c]
call fcn.0044e008
mov edx, str.RemoveOpenWith
lea ecx, [ebp + 0x40]
call fcn.0044e008
mov edx, str.RemoveBallonTips
lea ecx, [ebp + 0x44]
call fcn.0044e008
mov edx, str.NoSecurityWarning4DownloadedFiles
lea ecx, [ebp + 0x48]
call fcn.0044e008
mov edx, 0x463d40
lea ecx, [ebp + 0x4c]
call fcn.0044e008
mov edx, str.DisableSFC
lea ecx, [ebp + 0x50]
call fcn.0044e008
mov edx, str.NoPagefile
lea ecx, [ebp + 0x54]
call fcn.0044e008
mov edx, str.DisableSystemrestore
lea ecx, [ebp + 0x58]
call fcn.0044e008
mov edx, str.NoHibernate
lea ecx, [ebp + 0x5c]
call fcn.0044e008
mov ebp, dword [0x8938b0]
mov edx, str.NoAutoCheckSelect
lea ecx, [ebp + 4]
call fcn.0044e008
mov edx, str.ShowCmdContextMenu
lea ecx, [ebp + 8]
call fcn.0044e008
mov edx, str.ShowHidden
lea ecx, [ebp + 0xc]
call fcn.0044e008
mov edx, str.ShowFileExt
lea ecx, [ebp + 0x10]
call fcn.0044e008
mov edx, str.ShowAllTrayIcons
lea ecx, [ebp + 0x14]
call fcn.0044e008
mov edx, str.SmallTaskbarIcons
lea ecx, [ebp + 0x18]
call fcn.0044e008
mov edx, str.XP_TaskbarButton
lea ecx, [ebp + 0x1c]
call fcn.0044e008
mov edx, str.ShowQuickLaunch
lea ecx, [ebp + 0x20]
call fcn.0044e008
mov edx, str.RemoveShortCutTo
lea ecx, [ebp + 0x24]
call fcn.0044e008
mov edx, str.RemoveShortCutArrow
lea ecx, [ebp + 0x28]
call fcn.0044e008
mov edx, str.NoSecurityWarning4DownloadedFiles
lea ecx, [ebp + 0x2c]
call fcn.0044e008
mov edx, str.NoAeroTrans
lea ecx, [ebp + 0x30]
call fcn.0044e008
mov edx, str.MyCompOnDesktop
lea ecx, [ebp + 0x34]
call fcn.0044e008
mov edx, str.SmallDesktopIcons
lea ecx, [ebp + 0x38]
call fcn.0044e008
mov edx, str.DisableUAC
lea ecx, [ebp + 0x3c]
call fcn.0044e008
mov edx, str.DisableOnSoftRemove
lea ecx, [ebp + 0x40]
call fcn.0044e008
mov edx, str.HibernateOFF
lea ecx, [ebp + 0x44]
call fcn.0044e008
mov edx, str.NoPageFile
lea ecx, [ebp + 0x48]
call fcn.0044e008
mov edx, str.NoRebootonBSoD
lea ecx, [ebp + 0x4c]
call fcn.0044e008
mov edx, str.DisableSystemrestore
lea ecx, [ebp + 0x50]
call fcn.0044e008
mov edx, 0x463d40
lea ecx, [ebp + 0x54]
call fcn.0044e008
mov edx, str.DisableWin8Animation
lea ecx, [ebp + 0x58]
call fcn.0044e008
mov edx, str.DisableWin8LockScreen
lea ecx, [ebp + 0x5c]
call fcn.0044e008
mov edx, str.BootToDesktop
lea ecx, [ebp + 0x60]
call fcn.0044e008
mov edx, str.DisableWin10TaskBarIcons
lea ecx, [ebp + 0x64]
call fcn.0044e008
mov ebp, 0x46ff9d
mov dword [0x473570], ebp
mov ebx, dword [0x473570]
mov ebp, 0x46fff5
cmp ebx, ebp
jge 0x4017fc
mov ebp, dword [0x473570]
movsx ebx, byte [ebp]
add ebx, 0xffffffd0
push ebx
mov ebp, dword [0x473570]
pop eax
mov byte [ebp], al
inc dword [0x473570]
jmp 0x4017cd
call fcn.00437678
push 0
call 0x401820
call fcn.0045e600
push dword [0x473494]
call sub.kernel32.dll_HeapDestroy
call sub.kernel32.dll_ExitProcess
call fcn.0044f113
call fcn.00451442
call fcn.00458462
call fcn.0045b03d
call fcn.0045b1d5
call fcn.0045b5c0
call fcn.0045cbaf
call fcn.0045d8d5
call fcn.0045abb0
ret