Function at 0x10004027
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x550
push ebx
push esi
push edi
push 0x40
xor dl, dl
pop ecx
xor eax, eax
lea edi, [ebp - 0x207]
mov byte [ebp - 0x208], dl
push 0x40
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x30b]
mov byte [ebp - 0x30c], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x40
xor eax, eax
pop ecx
lea edi, [ebp - 0x103]
mov byte [ebp - 0x104], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
pushal
mov eax, eax
mov cx, 0xebe
popal
xor esi, esi
lea eax, [ebp - 0x208]
push esi
push dword [ebp + 8]
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
je 0x1000410f
push eax
push edx
push edi
add dl, dh
pop edi
pop edx
pop eax
cmp dword [ebp + 0xc], esi
je 0x100040b5
push dword [ebp + 0xc]
lea eax, [ebp - 0x208]
push eax
call sub.MSVCRT.dll_strcat
pop ecx
pop ecx
je 0x100040c6
push cx
mov cl, 0x54
pop cx
jne 0x100040c6
push ss
pop edi
push 0x47
test eax, 0x858d18c5
clc
std
invalid
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x30c]
push 0x10009458
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push eax
push ebx
push edx
xor bx, si
and dl, 0x7f
dec bh
test bh, 0xd
pop edx
pop ebx
pop eax
lea eax, [ebp - 0x44c]
push eax
lea eax, [ebp - 0x30c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp + 8], eax
jne 0x10004116
xor eax, eax
jmp 0x100043b6
mov esi, 0x104
push ebx
cmp ebx, esi
sub ebx, 0x6895
sub ebx, 0x50e0
mov bx, 0x26ca
xor bl, al
pop ebx
cmp dword [ebp - 0x44c], 0x10
je 0x1000439b
push edx
push edi
or edx, edx
mov dl, ch
cmp edx, ecx
and edx, eax
pop edi
pop edx
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x104]
push 0x100093d0
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
jp 0x10004186
mov ebx, ebx
mov esi, esi
xchg bx, bx
jnp 0x10004186
psrlw mm1, qword [edx + 0x13]
enter 0x626d, 0x3f
daa
in eax, 0x78
retf
lea eax, [ebp - 0x420]
push 0x2e
push eax
call dword [sym.imp.MSVCRT.dll_strrchr]
add esp, 0x18
mov dword [ebp + 0xc], eax
test eax, eax
je 0x1000439b
jo 0x100041c6
push cx
mov ch, 0xe0
pop cx
jno 0x100041c6
mov esp, 0x1e26fa6d
invalid
mov esi, 0x138b2633
add eax, 0x658f517f
pop ds
mov edi, dword [sym.imp.MSVCRT.dll__stricmp]
push 0x1000946c
push eax
call edi
pop ecx
test eax, eax
pop ecx
jne 0x100041e7
lea eax, [ebp - 0x104]
push eax
call fcn.100054b3
pop ecx
push eax
push ebx
push edx
xor bx, si
and dl, 0x7f
dec bh
test bh, 0xd
pop edx
pop ebx
pop eax
cmp dword [ebp - 0x430], 0
ja 0x1000439b
jb 0x1000421d
push di
pop di
jae 0x1000421d
scasb al, byte es:[edi]
bound eax, qword [edx]
pushfd
dec esi
call 0x1fd8a18f
test byte [eax + ebx - 0x7f], 0x4b
lea eax, [ecx - 0x42b43]
inc dword [eax]
and byte [eax], al
add byte [edi], cl
xchg dword [esi + 1], ebp
add byte [eax], al
cmp dword [ebp - 0x42c], 0x2000
ja 0x1000439b
jle 0x1000423f
mov ax, ax
mov cx, cx
jg 0x1000423f
aaa
jecxz 0x100041bb
hlt
push 0x10009520
push dword [ebp + 0xc]
call edi
pop ecx
test eax, eax
pop ecx
je 0x1000439b
push 0x10009528
push dword [ebp + 0xc]
call edi
pop ecx
test eax, eax
pop ecx
je 0x1000439b
push 0x10009530
push dword [ebp + 0xc]
call edi
pop ecx
test eax, eax
pop ecx
je 0x1000439b
push eax
push bx
test ax, 0x826
sub bl, 0x12
test bx, 0x3c13
test ah, 0x56
cmp bx, dx
pop bx
pop eax
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.MSVCRT.dll__strlwr]
lea eax, [ebp - 0x420]
push eax
call fcn.10004cdb
pop ecx
test eax, eax
pop ecx
jne 0x1000435c
and byte [ebp - 0x550], al
push 0x40
pop ecx
lea edi, [ebp - 0x54f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x104]
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push eax
lea eax, [ebp - 0x550]
push esi
push eax
push 0
mov ebx, 0x10009644
push 0x10009658
push ebx
call edi
test eax, eax
jbe 0x1000439b
lea eax, [ebp - 0x420]
push eax
call fcn.10004c78
test eax, eax
pop ecx
jne 0x1000435c
push esi
push eax
lea eax, [ebp - 0x550]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0x550]
push esi
push eax
push 0
push 0x1000965c
push ebx
call edi
test eax, eax
jbe 0x1000439b
lea eax, [ebp - 0x550]
push eax
call dword [sym.imp.MSVCRT.dll__strupr]
lea eax, [ebp - 0x550]
mov dword [esp], 0x10009058
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
pop ecx
test eax, eax
pop ecx
je 0x1000439b
push edx
push ax
sub edx, eax
cmp dx, cx
add edx, 0x1ab
xor ax, 0x2160
test bh, dl
test di, dx
pop ax
pop edx
lea eax, [ebp - 0x104]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push eax
test edx, eax
cmp eax, ecx
pop eax
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x44c]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x1000411b
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret