Function at 0x417e00
Capabilities:
Get common file path
Get session user name

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1c30
call fcn.0041ef90
push ebx
push esi
push edi
lea edi, [ebp - 0x1630]
mov ecx, 0x58c
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x45e034]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, 0xae703a
call fcn.0041ea00
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x5c], 0
mov dword [ebp - 0x58], 0x190
mov dword [ebp - 0x54], 0x41
mov dword [ebp - 0x78], 0
mov dword [ebp - 0x74], 0
mov dword [ebp - 0x70], 0x190
mov dword [ebp - 0x6c], 0x2d
mov dword [ebp - 0x90], 0x41
mov dword [ebp - 0x8c], 0
mov dword [ebp - 0x88], 0x190
mov dword [ebp - 0x84], 0x41
mov dword [ebp - 0xa8], 2
mov dword [ebp - 0xa4], 2
mov dword [ebp - 0xa0], 0x40
mov dword [ebp - 0x9c], 0x40
mov dword [ebp - 0xc0], 0xa
mov dword [ebp - 0xbc], 0xa
mov dword [ebp - 0xb8], 0x3a
mov dword [ebp - 0xb4], 0x3a
mov dword [ebp - 0xcc], 1
mov dword [ebp - 0x2e4], 0x101
mov esi, esp
lea eax, [ebp - 0x2e4]
push eax
lea ecx, [ebp - 0x2d8]
push ecx
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
cmp esi, esp
call fcn.0041e9d0
mov esi, esp
lea eax, [ebp - 0x48]
push eax
mov ecx, dword [0x45ed08]
push ecx
call dword [sym.imp.USER32.dll_BeginPaint]
cmp esi, esp
call fcn.0041e9d0
mov dword [ebp + 8], eax
cmp dword [0xae53ec], 1
jne 0x41859c
mov esi, esp
push str.StartPanel
mov eax, dword [0x45ed14]
push eax
call dword [sym.imp.UxTheme.dll_OpenThemeData]
cmp esi, esp
call fcn.0041e9d0
mov dword [0x45e8a4], eax
mov esi, esp
push 5
call dword [sym.imp.GDI32.dll_GetStockObject]
cmp esi, esp
call fcn.0041e9d0
mov dword [ebp - 0x328], eax
mov esi, esp
push 0
push 1
mov eax, dword [0x45e8a4]
push eax
call dword [sym.imp.UxTheme.dll_IsThemeBackgroundPartiallyTransparent]
cmp esi, esp
call fcn.0041e9d0
test eax, eax
je 0x417fb2
mov esi, esp
lea eax, [ebp - 0x60]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [0x45ed08]
push edx
call dword [sym.imp.UxTheme.dll_DrawThemeParentBackground]
cmp esi, esp
call fcn.0041e9d0
mov esi, esp
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x60]
push ecx
push 0
push 1
mov edx, dword [ebp + 8]
push edx
mov eax, dword [0x45e8a4]
push eax
call dword [sym.imp.UxTheme.dll_DrawThemeBackground]
cmp esi, esp
call fcn.0041e9d0
mov esi, esp
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0xa8]
push ecx
push 0
push 0xa
mov edx, dword [ebp + 8]
push edx
mov eax, dword [0x45e8a4]
push eax
call dword [sym.imp.UxTheme.dll_DrawThemeBackground]
cmp esi, esp
call fcn.0041e9d0
push 0x208
push 0
lea eax, [ebp - 0x544]
push eax
call fcn.00420f80
add esp, 0xc
push 0x208
push 0
lea eax, [ebp - 0x754]
push eax
call fcn.00420f80
add esp, 0xc
push 0x208
push 0
lea eax, [ebp - 0x964]
push eax
call fcn.00420f80
add esp, 0xc
push 0x208
push 0
lea eax, [ebp - 0xb74]
push eax
call fcn.00420f80
add esp, 0xc
push 0x208
push 0
lea eax, [ebp - 0xd84]
push eax
call fcn.00420f80
add esp, 0xc
push 0x208
push 0
lea eax, [ebp - 0xf94]
push eax
call fcn.00420f80
add esp, 0xc
push 0x208
push 0
lea eax, [ebp - 0x11a4]
push eax
call fcn.00420f80
add esp, 0xc
push 0x208
push 0
lea eax, [ebp - 0x13b4]
push eax
call fcn.00420f80
add esp, 0xc
push 0x208
push 0
lea eax, [ebp - 0x15c4]
push eax
call fcn.00420f80
add esp, 0xc
mov esi, esp
push 0
push 0x23
lea eax, [ebp - 0x544]
push eax
mov ecx, dword [0x45ed14]
push ecx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
cmp esi, esp
call fcn.0041e9d0
test eax, eax
je 0x4180ec
jmp 0x418109
mov esi, esp
push 0x10
push 0x44c3bc
push str.Application_Data_Folder_not_found
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp esi, esp
call fcn.0041e9d0
lea eax, [ebp - 0x544]
push eax
push 0x104
lea ecx, [ebp - 0x754]
push ecx
call fcn.00425800
add esp, 0xc
push str.MicrosoftUser_Account_Pictures_
push 0x104
lea eax, [ebp - 0x754]
push eax
call fcn.004254c0
add esp, 0xc
lea eax, [ebp - 0x2d8]
push eax
push 0x104
lea ecx, [ebp - 0x964]
push ecx
call fcn.004254c0
add esp, 0xc
push str..bmp
push 0x104
lea eax, [ebp - 0x964]
push eax
call fcn.004254c0
add esp, 0xc
lea eax, [ebp - 0x754]
push eax
push 0x104
lea ecx, [ebp - 0xb74]
push ecx
call fcn.004254c0
add esp, 0xc
lea eax, [ebp - 0x964]
push eax
push 0x104
lea ecx, [ebp - 0xb74]
push ecx
call fcn.004254c0
add esp, 0xc
mov esi, esp
push 0
push 0x28
lea eax, [ebp - 0xd84]
push eax
mov ecx, dword [0x45ed14]
push ecx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
cmp esi, esp
call fcn.0041e9d0
test eax, eax
je 0x4181ce
jmp 0x4181eb
mov esi, esp
push 0x10
push 0x44c3bc
push str.Application_Data_Folder_not_found
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp esi, esp
call fcn.0041e9d0
lea eax, [ebp - 0xd84]
push eax
push 0x104
lea ecx, [ebp - 0xf94]
push ecx
call fcn.00425800
add esp, 0xc
push str.AppDataLocalTemp_
push 0x104
lea eax, [ebp - 0x11a4]
push eax
call fcn.004254c0
add esp, 0xc
lea eax, [ebp - 0x2d8]
push eax
push 0x104
lea ecx, [ebp - 0x11a4]
push ecx
call fcn.004254c0
add esp, 0xc
push str..bmp
push 0x104
lea eax, [ebp - 0x13b4]
push eax
call fcn.004254c0
add esp, 0xc
lea eax, [ebp - 0xf94]
push eax
push 0x104
lea ecx, [ebp - 0x15c4]
push ecx
call fcn.00425800
add esp, 0xc
lea eax, [ebp - 0x11a4]
push eax
push 0x104
lea ecx, [ebp - 0x15c4]
push ecx
call fcn.004254c0
add esp, 0xc
lea eax, [ebp - 0x13b4]
push eax
push 0x104
lea ecx, [ebp - 0x15c4]
push ecx
call fcn.004254c0
add esp, 0xc
cmp dword [ebp - 0xcc], 1
jne 0x418597
lea eax, [ebp - 0xb74]
push eax
call fcn.0041dfa0
add esp, 4
test eax, eax
je 0x4182f4
mov esi, esp
push 0xa010
push 0
push 0
push 0
lea eax, [ebp - 0xb74]
push eax
mov ecx, dword [0x45eb70]
push ecx
call dword [sym.imp.USER32.dll_LoadImageW]
cmp esi, esp
call fcn.0041e9d0
mov dword [ebp - 0x334], eax
jmp 0x418362
lea eax, [ebp - 0x15c4]
push eax
call fcn.0041dfa0
add esp, 4
test eax, eax
je 0x418337
mov esi, esp
push 0xa010
push 0
push 0
push 0
lea eax, [ebp - 0x15c4]
push eax
mov ecx, dword [0x45eb70]
push ecx
call dword [sym.imp.USER32.dll_LoadImageW]
cmp esi, esp
call fcn.0041e9d0
mov dword [ebp - 0x334], eax
jmp 0x418362
mov esi, esp
push 0xa010
push 0
push 0
push 0
push str.res_bmp_normal.bmp
mov eax, dword [0x45eb70]
push eax
call dword [sym.imp.USER32.dll_LoadImageW]
cmp esi, esp
call fcn.0041e9d0
mov dword [ebp - 0x334], eax
cmp dword [ebp - 0x334], 0
jne 0x41837c
mov dword [ebp - 0xcc], 0
xor eax, eax
jmp 0x418a75
mov esi, esp
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
cmp esi, esp
call fcn.0041e9d0
mov dword [ebp - 0x2f0], eax
cmp dword [ebp - 0x2f0], 0
jne 0x4183af
mov dword [ebp - 0xcc], 0
xor eax, eax
jmp 0x418a75
mov esi, esp
lea eax, [ebp - 0x31c]
push eax
push 0x18
mov ecx, dword [ebp - 0x334]
push ecx
call dword [sym.imp.GDI32.dll_GetObjectW]
cmp esi, esp
call fcn.0041e9d0
mov dword [ebp - 0x15d0], eax
cmp dword [ebp - 0x15d0], 0
jne 0x4183ee
mov dword [ebp - 0xcc], 0
xor eax, eax
jmp 0x418a75
mov esi, esp
mov eax, dword [ebp - 0x334]
push eax
mov ecx, dword [ebp - 0x2f0]
push ecx
call dword [sym.imp.GDI32.dll_SelectObject]
cmp esi, esp
call fcn.0041e9d0
mov dword [ebp - 0x2fc], eax
cmp dword [ebp - 0x2fc], 0
jne 0x41842b
mov dword [ebp - 0xcc], 0
xor eax, eax
jmp 0x418a75
mov esi, esp
push 0xcc0020
mov eax, dword [ebp - 0x314]
push eax
mov ecx, dword [ebp - 0x318]
push ecx
push 0
push 0
mov edx, dword [ebp - 0x2f0]
push edx
mov eax, dword [ebp - 0xb4]
sub eax, dword [ebp - 0xbc]
push eax
mov ecx, dword [ebp - 0xb8]
sub ecx, dword [ebp - 0xc0]
push ecx
mov edx, dword [ebp - 0xc0]
push edx
mov eax, dword [ebp - 0xbc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.GDI32.dll_StretchBlt]
cmp esi, esp
call fcn.0041e9d0
mov dword [ebp - 0x15dc], eax
cmp dword [ebp - 0x15dc], 0
jne 0x4184a4
mov dword [ebp - 0xcc], 0
xor eax, eax
jmp 0x418a75
mov esi, esp
lea eax, [ebp - 0x31c]
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
cmp esi, esp
call fcn.0041e9d0
mov esi, esp
mov eax, dword [ebp - 0x2fc]
push eax
mov ecx, dword [ebp - 0x2f0]
push ecx
call dword [sym.imp.GDI32.dll_SelectObject]
cmp esi, esp
call fcn.0041e9d0
mov esi, esp
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
cmp esi, esp
call fcn.0041e9d0
mov esi, esp
mov eax, dword [ebp - 0x328]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.GDI32.dll_SelectObject]
cmp esi, esp
call fcn.0041e9d0
mov esi, esp
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
cmp esi, esp
call fcn.0041e9d0
mov esi, esp
mov eax, dword [0x45e90c]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.GDI32.dll_SelectObject]
cmp esi, esp
call fcn.0041e9d0
mov esi, esp
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
cmp esi, esp
call fcn.0041e9d0
mov esi, esp
mov eax, dword [ebp - 0x334]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.GDI32.dll_SelectObject]
cmp esi, esp
call fcn.0041e9d0
mov esi, esp
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
cmp esi, esp
call fcn.0041e9d0
mov esi, esp
mov eax, dword [ebp - 0x2f0]
push eax
call dword [sym.imp.GDI32.dll_DeleteDC]
cmp esi, esp
call fcn.0041e9d0
mov esi, esp
mov eax, dword [ebp - 0x2f0]
push eax
mov ecx, dword [0x45ed08]
push ecx
call dword [sym.imp.USER32.dll_ReleaseDC]
cmp esi, esp
call fcn.0041e9d0
jmp 0x41876f
mov esi, esp
push 2
call dword [sym.imp.USER32.dll_GetSysColor]
cmp esi, esp
call fcn.0041e9d0
mov dword [ebp - 0x15e8], eax
mov esi, esp
push 0x1b
call dword [sym.imp.USER32.dll_GetSysColor]
cmp esi, esp
call fcn.0041e9d0
mov dword [ebp - 0x15f4], eax
mov eax, 0x10
imul ecx, eax, 0
mov edx, dword [ebp - 0x78]
mov dword [ebp + ecx - 0x161c], edx
mov eax, 0x10
imul ecx, eax, 0
mov edx, dword [ebp - 0x74]
mov dword [ebp + ecx - 0x1618], edx
mov eax, dword [ebp - 0x15e8]
and eax, 0xff
movzx ecx, al
shl ecx, 8
mov edx, 0x10
imul eax, edx, 0
mov word [ebp + eax - 0x1614], cx
movzx eax, word [ebp - 0x15e8]
sar eax, 8
and eax, 0xff
movzx ecx, al
shl ecx, 8
mov edx, 0x10
imul eax, edx, 0
mov word [ebp + eax - 0x1612], cx
mov eax, dword [ebp - 0x15e8]
shr eax, 0x10
and eax, 0xff
movzx ecx, al
shl ecx, 8
mov edx, 0x10
imul eax, edx, 0
mov word [ebp + eax - 0x1610], cx
mov eax, 0x10
imul ecx, eax, 0
xor edx, edx
mov word [ebp + ecx - 0x160e], dx
mov eax, 0x10
shl eax, 0
mov ecx, dword [ebp - 0x70]
mov dword [ebp + eax - 0x161c], ecx
mov eax, 0x10
shl eax, 0
mov ecx, dword [ebp - 0x6c]
mov dword [ebp + eax - 0x1618], ecx
mov eax, dword [ebp - 0x15f4]
and eax, 0xff
movzx ecx, al
shl ecx, 8
mov edx, 0x10
shl edx, 0
mov word [ebp + edx - 0x1614], cx
movzx eax, word [ebp - 0x15f4]
sar eax, 8
and eax, 0xff
movzx ecx, al
shl ecx, 8
mov edx, 0x10
shl edx, 0
mov word [ebp + edx - 0x1612], cx
mov eax, dword [ebp - 0x15f4]
shr eax, 0x10
and eax, 0xff
movzx ecx, al
shl ecx, 8
mov edx, 0x10
shl edx, 0
mov word [ebp + edx - 0x1610], cx
mov eax, 0x10
shl eax, 0
xor ecx, ecx
mov word [ebp + eax - 0x160e], cx
mov dword [ebp - 0x162c], 0
mov dword [ebp - 0x1628], 1
mov esi, esp
push 0
push 1
lea eax, [ebp - 0x162c]
push eax
push 2
lea ecx, [ebp - 0x161c]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.MSIMG32.dll_GradientFill]
cmp esi, esp
call fcn.0041e9d0
mov esi, esp
lea eax, [ebp - 0x161c]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.GDI32.dll_SelectObject]
cmp esi, esp
call fcn.0041e9d0
mov esi, esp
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
cmp esi, esp
call fcn.0041e9d0
mov esi, esp
push 0x45e8a8
push 0xd2
push 0
push 1
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [0x45e8a4]
push ecx
call dword [sym.imp.UxTheme.dll_GetThemeFont]
cmp esi, esp
call fcn.0041e9d0
mov esi, esp
push 0x45e904
push 0xedb
push 0
push 1
mov eax, dword [0x45e8a4]
push eax
call dword [sym.imp.UxTheme.dll_GetThemeColor]
cmp esi, esp
call fcn.0041e9d0
mov esi, esp
push 0x45e8a8
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
cmp esi, esp
call fcn.0041e9d0
mov dword [0x45ef18], eax
cmp dword [0xae53ec], 1
jne 0x4188b0
mov esi, esp
mov eax, dword [0x45ef18]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.GDI32.dll_SelectObject]
cmp esi, esp
call fcn.0041e9d0
mov dword [0x45ef20], eax
mov esi, esp
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.GDI32.dll_GetTextColor]
cmp esi, esp
call fcn.0041e9d0
mov dword [0x45e908], eax
mov esi, esp
mov eax, dword [0x45e904]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.GDI32.dll_SetTextColor]
cmp esi, esp
call fcn.0041e9d0
mov esi, esp
push 1
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.GDI32.dll_SetBkMode]
cmp esi, esp
call fcn.0041e9d0
mov esi, esp
push 0x24
lea eax, [ebp - 0x90]
push eax
push 0xffffffffffffffff
lea ecx, [ebp - 0x2d8]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_DrawTextW]
cmp esi, esp
call fcn.0041e9d0
mov esi, esp
mov eax, dword [0x45e908]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.GDI32.dll_SetTextColor]
cmp esi, esp
call fcn.0041e9d0
mov esi, esp
mov eax, dword [0x45ef20]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.GDI32.dll_SelectObject]
cmp esi, esp
call fcn.0041e9d0
mov esi, esp
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
cmp esi, esp
call fcn.0041e9d0
jmp 0x4189d6
mov esi, esp
push str.Tahoma
push 0
push 2
push 0
push 0
push 0
push 0
push 0
push 1
push 0x2bc
push 0
push 0
push 0
push 0x17
call dword [sym.imp.GDI32.dll_CreateFontW]
cmp esi, esp
call fcn.0041e9d0
mov dword [0x45ef20], eax
mov esi, esp
mov eax, dword [0x45ef20]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.GDI32.dll_SelectObject]
cmp esi, esp
call fcn.0041e9d0
mov esi, esp
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.GDI32.dll_GetTextColor]
cmp esi, esp
call fcn.0041e9d0
mov dword [0x45e908], eax
mov esi, esp
push 9
call dword [sym.imp.USER32.dll_GetSysColor]
cmp esi, esp
call fcn.0041e9d0
mov esi, esp
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.GDI32.dll_SetTextColor]
cmp esi, esp
call fcn.0041e9d0
mov esi, esp
push 1
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.GDI32.dll_SetBkMode]
cmp esi, esp
call fcn.0041e9d0
lea eax, [ebp - 0x2d8]
push eax
call fcn.00425f60
add esp, 4
mov esi, esp
push eax
lea ecx, [ebp - 0x2d8]
push ecx
push 0xc
push 0x14
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.GDI32.dll_TextOutW]
cmp esi, esp
call fcn.0041e9d0
mov esi, esp
mov eax, dword [0x45e908]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.GDI32.dll_SetTextColor]
cmp esi, esp
call fcn.0041e9d0
mov esi, esp
mov eax, dword [0x45ef20]
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
cmp esi, esp
call fcn.0041e9d0
mov esi, esp
mov eax, dword [0x45ef20]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.GDI32.dll_SelectObject]
cmp esi, esp
call fcn.0041e9d0
mov esi, esp
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
cmp esi, esp
call fcn.0041e9d0
mov esi, esp
mov eax, dword [0x45ef18]
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
cmp esi, esp
call fcn.0041e9d0
mov esi, esp
mov eax, dword [0x45ef18]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.GDI32.dll_SelectObject]
cmp esi, esp
call fcn.0041e9d0
mov esi, esp
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
cmp esi, esp
call fcn.0041e9d0
mov esi, esp
lea eax, [ebp - 0x48]
push eax
mov ecx, dword [0x45ed08]
push ecx
call dword [sym.imp.USER32.dll_EndPaint]
cmp esi, esp
call fcn.0041e9d0
mov esi, esp
mov eax, dword [0x45e8a4]
push eax
call dword [sym.imp.UxTheme.dll_CloseThemeData]
cmp esi, esp
call fcn.0041e9d0
mov esi, esp
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.GDI32.dll_DeleteDC]
cmp esi, esp
call fcn.0041e9d0
mov esi, esp
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [0x45ed08]
push ecx
call dword [sym.imp.USER32.dll_ReleaseDC]
cmp esi, esp
call fcn.0041e9d0
mov eax, 1
push edx
mov ecx, ebp
push eax
lea edx, [0x418aa4]
call fcn.0041e970
pop eax
pop edx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041ea40
add esp, 0x1c30
cmp ebp, esp
call fcn.0041e9d0
mov esp, ebp
pop ebp
ret