Function at 0x415fb9
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x260
mov eax, dword [0x4cdbf8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push ecx
push ecx
lea eax, [ebp - 0x25c]
push eax
push ecx
call fcn.0040ea0d
xor ecx, ecx
xor esi, esi
inc ecx
mov edi, 0x4b3eec
test eax, eax
mov edx, str.FriendlyAppName
cmove esi, ecx
add esp, 0xc
push 0
push edi
push ecx
mov ecx, str.ClassesApplicationsRdpZapper.exe
call fcn.0040e745
add esp, 0xc
mov ebx, str.__s__0
push 0
push ebx
push dword [0x5524ec]
push ebx
push 0
push 0
call fcn.00420ad0
add esp, 0x14
mov edx, 0x4b19af
mov ecx, str.ClassesApplicationsRdpZapper.exeDefaultIcon
push eax
push 1
call fcn.0040e745
add esp, 0xc
xor ecx, ecx
mov eax, str.__s_____1_
push ecx
push eax
push dword [0x5524ec]
push eax
push ecx
push ecx
call fcn.00420ad0
add esp, 0x14
mov edx, 0x4b19af
mov ecx, str.ClassesApplicationsRdpZapper.exe_shellopencommand
push eax
push 1
call fcn.0040e745
add esp, 0xc
mov edx, str..rdp
mov ecx, str.ClassesApplicationsRdpZapper.exeSupportedTypes
push 0
push 0x4b19af
push 1
call fcn.0040e745
add esp, 0xc
mov edx, edi
mov ecx, str.RegisteredApplications
push 0
push str.SoftwareRdpZapperCapabilities
push 1
call fcn.0040e745
add esp, 0xc
mov edx, str.ApplicationName
push 0
push edi
mov edi, str.RdpZapperCapabilities
push 1
mov ecx, edi
call fcn.0040e745
add esp, 0xc
push 0
push ebx
push dword [0x5524ec]
push ebx
xor ebx, ebx
push ebx
push ebx
call fcn.00420ad0
add esp, 0x14
mov edx, str.ApplicationIcon
mov ecx, edi
push eax
push 1
call fcn.0040e745
add esp, 0xc
mov edx, str.ApplicationDescription
mov ecx, edi
push ebx
push str.Remote_desktop_management_tool
push 1
call fcn.0040e745
add esp, 0xc
mov edi, 0x4b3eec
mov edx, edi
mov ecx, str.Classes.rdpOpenWithProgids
push ebx
mov ebx, 0x4b19af
push ebx
push 0
call fcn.0040e745
add esp, 0xc
mov edx, ebx
mov ecx, str.ClassesRdpZapper
push 0
push edi
push 1
call fcn.0040e745
add esp, 0x10
lea eax, [ebp - 0x130]
push 0x12b
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push ecx
xor edx, edx
lea eax, [ebp - 0x130]
push edx
mov ecx, str.__smstsc.exe__0
push ecx
push eax
push ecx
push edx
push edx
call fcn.00420ad0
add esp, 0x14
mov edx, ebx
mov ecx, str.ClassesRdpZapperDefaultIcon
push eax
push 1
call fcn.0040e745
add esp, 0xc
xor eax, eax
mov ebx, str.__s_____1_
push eax
push ebx
push dword [0x5524ec]
push ebx
push eax
push eax
call fcn.00420ad0
add esp, 0x14
mov edx, 0x4b19af
mov ecx, str.ClassesRdpZapper_shellopencommand
push eax
push 1
call fcn.0040e745
add esp, 0xc
mov edx, str..rdp
mov ecx, str.RdpZapperCapabilitiesFileAssociations
push 0
push edi
push 1
call fcn.0040e745
add esp, 0xc
push 0
push edi
push 1
mov edi, 0x4b19af
mov ecx, str.Classes.rdp
mov edx, edi
call fcn.0040e745
add esp, 0xc
mov edx, edi
mov edi, str.MicrosoftWindowsCurrentVersionApp_PathsRdpZapper
mov ecx, edi
push 0
push dword [0x5524ec]
push 1
call fcn.0040e745
mov eax, dword [0x5524ec]
add esp, 0xc
add eax, 0x384
mov edx, str.Path
mov ecx, edi
push 0
push eax
push 1
call fcn.0040e745
add esp, 0xc
mov dword [ebp - 0x260], 1
lea eax, [ebp - 0x260]
mov edx, str.UseUrl
mov ecx, edi
push 4
push eax
push 4
call fcn.0040e745
add esp, 0xc
mov edi, str.Classes_rdp
mov edx, 0x4b19af
mov ecx, edi
push 0
push str.URL:rdp
push 1
call fcn.0040e745
add esp, 0xc
mov edx, str.URL_Protocol
mov ecx, edi
push 0
push 0x4b19af
push 1
call fcn.0040e745
add esp, 0xc
xor eax, eax
push eax
push ebx
push dword [0x5524ec]
push ebx
push eax
push eax
call fcn.00420ad0
add esp, 0x14
mov edx, 0x4b19af
mov ecx, str.Classes_rdp_shellopencommand
push eax
push 1
call fcn.0040e745
mov ecx, dword [ebp - 4]
add esp, 0x10
mov eax, esi
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.0047fe8c
leave
ret