Function at 0x402ca0
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 1
push ebx
push esi
push edi
push 0
call dword [sym.imp.USER32.dll_GetDC]
mov esi, eax
test esi, esi
je 0x40314b
mov ebx, dword [ebp + 8]
push ebx
call fcn.0040291a
test eax, eax
je 0x40314b
push 0x7f02
xor edi, edi
push edi
call dword [sym.imp.USER32.dll_LoadCursorA]
push 1
mov dword [0x4065e0], eax
push ebx
call dword [sym.imp.USER32.dll_LoadAcceleratorsA]
mov dword [0x4065d8], eax
cmp dword [0x4065e0], edi
je 0x40314b
cmp eax, edi
je 0x40314b
cmp dword [ebp + 0xc], edi
jne 0x402d1b
push ebx
call fcn.00403156
test eax, eax
je 0x40314b
xor edi, edi
mov dword [0x406530], ebx
push edi
mov eax, 0x80000000
push ebx
push edi
push edi
push edi
push eax
push edi
push eax
push 0xcf0000
push section..text
push 0x406020
push edi
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [section..data], eax
cmp eax, edi
je 0x40314b
push 1
mov eax, dword [section..data]
push eax
xor edi, edi
call dword [sym.imp.SHELL32.dll_DragAcceptFiles]
mov eax, dword [section..data]
mov ecx, dword [0x406530]
mov dword [0x4067a4], eax
mov dword [0x4067a8], edi
mov dword [0x4067ac], edi
mov dword [0x4067dc], ecx
mov dword [0x4067a0], 0x54
call fcn.00401193
call fcn.004026c2
push edi
mov eax, dword [section..data]
push ebx
push 0xf
cmp dword [0x40601c], 1
push eax
push 0x190
sbb eax, eax
push 0x258
push edi
and eax, 0x100000
push edi
add eax, 0x50200104
push eax
push section..text
push 0x401054
push 0x200
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x406004], eax
cmp eax, edi
je 0x40314b
xor ebx, ebx
mov eax, dword [0x40601c]
push ebx
push eax
push 0xc8
push dword [0x406004]
call dword [sym.imp.USER32.dll_SendMessageA]
push 0x2d0
push 0x5a
push esi
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push eax
push dword [0x40600c]
call dword [sym.imp.KERNEL32.dll_MulDiv]
neg eax
push 0x406800
mov dword [0x406800], eax
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
push ebx
mov dword [0x4067f4], eax
push eax
push 0x30
push dword [0x406004]
call dword [sym.imp.USER32.dll_SendMessageA]
push esi
push ebx
call dword [sym.imp.USER32.dll_ReleaseDC]
push 1
mov byte [0x406580], bl
push 0x42
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push ebx
mov edi, dword [sym.imp.USER32.dll_PostMessageA]
push ebx
mov dword [0x406634], eax
push 0xc5
push dword [0x406004]
call edi
push dword [0x406050]
call fcn.0040216f
mov esi, dword [ebp + 0x10]
push esi
call fcn.004029ed
test eax, eax
jne 0x402fad
push dword [ebp + 0x14]
push esi
call fcn.00402b90
test eax, eax
je 0x402eb2
push ebx
mov eax, dword [section..data]
push ebx
push 0x10
push eax
call edi
mov eax, 1
jmp 0x40314d
xor ebx, ebx
cmp byte [esi], bl
je 0x402fad
push esi
mov dword [ebp - 4], ebx
mov esi, 0x406690
push esi
call fcn.00402893
push ebx
push pe_nt_image_headers32
push 3
push ebx
push 3
push 0x80000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [0x406630], eax
cmp eax, 0xffffffff
jne 0x402f7d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x402f0f
cmp eax, 5
je 0x402f53
push 0x30
cmp eax, 0x7b
je 0x402f61
push esi
mov eax, dword [0x406040]
jmp 0x402f6b
push 0x34
mov esi, 0x406690
push esi
mov eax, dword [0x406044]
push eax
push dword [0x406064]
push dword [section..data]
call fcn.0040240c
cmp eax, 6
jne 0x402f7d
push 0
push pe_nt_image_headers32
push 2
push 0
push 1
push 0xc0000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [0x406630], eax
jmp 0x402f7d
push 0x30
mov eax, dword [0x4060b0]
push 0x406690
jmp 0x402f6b
push 0x406690
mov eax, dword [0x406078]
push eax
push dword [0x406064]
push dword [section..data]
call fcn.0040240c
cmp dword [0x406630], 0xffffffff
je 0x402fad
xor esi, esi
push esi
push 0x406690
call fcn.0040346c
test al, 0x80
je 0x402fad
push esi
mov eax, dword [section..data]
push esi
push 0x10
push eax
call edi
mov eax, 1
jmp 0x40314d
cmp dword [0x406018], 0
je 0x402fc9
push 0xfd0000
mov eax, dword [section..data]
push 0xfffffffffffffff0
push eax
call dword [sym.imp.USER32.dll_SetWindowLongA]
push dword [ebp + 0x14]
push dword [section..data]
call dword [sym.imp.USER32.dll_ShowWindow]
mov edi, 0x406540
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
push dword [0x4060a0]
push edi
call esi
push edi
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
call ebx
lea edi, [eax + 0x406541]
mov eax, dword [0x406094]
inc eax
push eax
push edi
call esi
push edi
call ebx
lea edi, [eax + edi + 1]
mov eax, dword [0x4060a4]
push eax
push edi
call esi
push edi
call ebx
lea edi, [eax + edi + 1]
push 0x401050
push edi
call esi
push edi
call ebx
xor ebx, ebx
mov byte [eax + edi + 1], bl
mov eax, dword [0x406094]
inc eax
mov byte [0x4065f0], bl
push eax
push 0x4065f1
call esi
mov ecx, dword [section..data]
mov dword [0x406664], ebx
mov dword [0x406640], 0x4c
mov dword [0x406644], ecx
mov dword [0x406684], ebx
mov dword [0x406674], ebx
mov dword [0x406670], ebx
mov dword [0x406654], 0x40
mov dword [0x406658], 1
mov dword [0x406660], 0x104
cmp dword [ebp - 4], ebx
je 0x4030ae
push ebx
mov esi, 0x406380
push 5
push esi
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
je 0x4030ae
mov dword [0x40666c], esi
jmp 0x4030b8
mov dword [0x40666c], 0
mov eax, dword [section..data]
xor esi, esi
mov word [0x4065ca], si
mov dword [0x4065b4], eax
push 0x40103c
mov dword [0x4065c4], esi
mov dword [0x4065b0], 0x28
mov dword [0x4065bc], 0x10001
mov dword [0x4065d0], esi
call dword [sym.imp.USER32.dll_RegisterWindowMessageA]
mov dword [0x4065dc], eax
cmp eax, esi
je 0x40314b
lea eax, [ebp - 8]
lea ecx, [ebp - 4]
push eax
push ecx
push 0xb0
push dword [0x406004]
call dword [sym.imp.USER32.dll_SendMessageA]
push dword [ebp - 8]
push dword [ebp - 4]
push 0xb1
mov eax, dword [0x406004]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
push 0
push 0
push 0xb7
push dword [0x406004]
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, 1
jmp 0x40314d
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10