Function at 0x40a6e0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x55bede
mov eax, dword fs:[0]
push eax
sub esp, 0x514
mov eax, dword [0x5b4e20]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 0x104
lea eax, [ebp - 0x518]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov eax, dword [edi + 0x5cc]
lea ebx, [edi + 0x5c0]
cmp dword [eax - 0xc], 0
je 0x40a758
push 0
push 0x80
push 3
push 0
push 3
push SysReAllocStringLen
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
jne 0x40a776
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005308a3
mov esp, ebp
pop ebp
ret
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x400
lea eax, [ebp - 0x410]
push eax
push ecx
mov ecx, esp
mov dword [ebp - 0x520], esp
push str.MaximumThreadCount
call fcn.004023d0
push ecx
mov ecx, esp
push str.HiddenADSExplorer_Global_Options
mov dword [ebp - 4], 0
call fcn.004023d0
mov ecx, ebx
mov dword [ebp - 4], 0xffffffff
call fcn.00409570
test eax, eax
je 0x40a7de
lea eax, [ebp - 0x410]
push eax
call fcn.00530e85
add esp, 4
mov dword [edi + 0x398], eax
cmp eax, 0x1388
jbe 0x40a7e9
call fcn.00402ac0
mov dword [edi + 0x398], eax
push 0x400
lea eax, [ebp - 0x410]
push eax
push ecx
mov ecx, esp
mov dword [ebp - 0x51c], esp
push str.UseDefaultThreadCount
call fcn.004023d0
push ecx
mov ecx, esp
push str.HiddenADSExplorer_Global_Options
mov dword [ebp - 4], 1
call fcn.004023d0
mov ecx, ebx
mov dword [ebp - 4], 0xffffffff
call fcn.00409570
test eax, eax
je 0x40a845
lea eax, [ebp - 0x410]
push eax
call fcn.00530e85
add esp, 4
mov dword [edi + 0x5bc], eax
jmp 0x40a84f
mov dword [edi + 0x5bc], 0
push 0x400
lea eax, [ebp - 0x410]
push eax
push ecx
mov ecx, esp
mov dword [ebp - 0x51c], esp
push str.UseDefaultApp
call fcn.004023d0
push ecx
mov ecx, esp
push str.HiddenADSExplorer_Global_Options
mov dword [ebp - 4], 2
call fcn.004023d0
mov ecx, ebx
mov dword [ebp - 4], 0xffffffff
call fcn.00409570
test eax, eax
je 0x40a8ab
lea eax, [ebp - 0x410]
push eax
call fcn.00530e85
add esp, 4
mov dword [edi + 0x5a4], eax
jmp 0x40a8b5
mov dword [edi + 0x5a4], 0
push 0x400
lea eax, [ebp - 0x410]
push eax
push ecx
mov ecx, esp
mov dword [ebp - 0x51c], esp
push str.RunAtStartup
call fcn.004023d0
push ecx
mov ecx, esp
push str.HiddenADSExplorer_Global_Options
mov dword [ebp - 4], 3
call fcn.004023d0
mov ecx, ebx
mov dword [ebp - 4], 0xffffffff
call fcn.00409570
test eax, eax
je 0x40a911
lea eax, [ebp - 0x410]
push eax
call fcn.00530e85
add esp, 4
mov dword [edi + 0x5ac], eax
jmp 0x40a91b
mov dword [edi + 0x5ac], 0
push 0x400
lea eax, [ebp - 0x410]
push eax
push ecx
mov ecx, esp
mov dword [ebp - 0x51c], esp
push str.Threat_VirusTotal
call fcn.004023d0
push ecx
mov ecx, esp
push str.HiddenADSExplorer_Global_Options
mov dword [ebp - 4], 4
call fcn.004023d0
mov ecx, ebx
mov dword [ebp - 4], 0xffffffff
call fcn.00409570
test eax, eax
je 0x40a977
lea eax, [ebp - 0x410]
push eax
call fcn.00530e85
add esp, 4
mov dword [edi + 0x5b0], eax
jmp 0x40a981
mov dword [edi + 0x5b0], 1
push 0x400
lea eax, [ebp - 0x410]
push eax
push ecx
mov ecx, esp
mov dword [ebp - 0x51c], esp
push str.Threat_Expert
call fcn.004023d0
push ecx
mov ecx, esp
push str.HiddenADSExplorer_Global_Options
mov dword [ebp - 4], 5
call fcn.004023d0
mov ecx, ebx
mov dword [ebp - 4], 0xffffffff
call fcn.00409570
test eax, eax
je 0x40a9dd
lea eax, [ebp - 0x410]
push eax
call fcn.00530e85
add esp, 4
mov dword [edi + 0x5b4], eax
jmp 0x40a9e7
mov dword [edi + 0x5b4], 0
push 0x400
lea eax, [ebp - 0x410]
push eax
push ecx
mov ecx, esp
mov dword [ebp - 0x51c], esp
push str.Threat_Malwarehash
call fcn.004023d0
push ecx
mov ecx, esp
push str.HiddenADSExplorer_Global_Options
mov dword [ebp - 4], 6
call fcn.004023d0
mov ecx, ebx
mov dword [ebp - 4], 0xffffffff
call fcn.00409570
test eax, eax
je 0x40aa43
lea eax, [ebp - 0x410]
push eax
call fcn.00530e85
add esp, 4
mov dword [edi + 0x5b8], eax
jmp 0x40aa4d
mov dword [edi + 0x5b8], 0
push 0x400
lea eax, [ebp - 0x410]
push eax
push ecx
mov ecx, esp
mov dword [ebp - 0x51c], esp
push str.ShowWarning
call fcn.004023d0
push ecx
mov ecx, esp
push str.HiddenADSExplorer_Global_Options
mov dword [ebp - 4], 7
call fcn.004023d0
mov ecx, ebx
mov dword [ebp - 4], 0xffffffff
call fcn.00409570
test eax, eax
je 0x40aaa9
lea eax, [ebp - 0x410]
push eax
call fcn.00530e85
add esp, 4
mov dword [edi + 0x5a8], eax
jmp 0x40aab3
mov dword [edi + 0x5a8], 1
push 0x400
lea eax, [ebp - 0x410]
push eax
push ecx
mov ecx, esp
mov dword [ebp - 0x51c], esp
push str.ExecutableStream_AppPath
call fcn.004023d0
push ecx
mov ecx, esp
push str.HiddenADSExplorer_Global_Options
mov dword [ebp - 4], 8
call fcn.004023d0
mov ecx, ebx
mov dword [ebp - 4], 0xffffffff
call fcn.00409570
test eax, eax
je 0x40ab12
lea eax, [ebp - 0x410]
push eax
lea eax, [edi + 0x4a0]
push 0x104
push eax
call fcn.0053170f
jmp 0x40ab30
push str.C:Program_FilesWindows_NTAccessorieswordpad.exe
lea esi, [edi + 0x4a0]
push 0x104
push esi
call fcn.0053170f
mov al, byte [ebp - 0x518]
mov byte [esi], al
add esp, 0xc
lea eax, [ebp - 0x410]
push 0x400
push eax
push ecx
mov ecx, esp
mov dword [ebp - 0x51c], esp
push str.NonExecutableStream_AppPath
call fcn.004023d0
push ecx
mov ecx, esp
push str.HiddenADSExplorer_Global_Options
mov dword [ebp - 4], 9
call fcn.004023d0
mov ecx, ebx
mov dword [ebp - 4], 0xffffffff
call fcn.00409570
test eax, eax
je 0x40ab9d
lea eax, [ebp - 0x410]
push eax
lea eax, [edi + 0x39c]
push 0x104
push eax
call fcn.0053170f
add esp, 0xc
mov eax, 1
jmp 0x40a75a
push str.C:Program_FilesWindows_NTAccessorieswordpad.exe
lea esi, [edi + 0x39c]
push 0x104
push esi
call fcn.0053170f
mov al, byte [ebp - 0x518]
mov byte [esi], al
add esp, 0xc
mov eax, 1
jmp 0x40a75a