Function at 0x4259c0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x629a40]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor bl, bl
mov dword [ebp - 0x28], edx
push edi
mov dword [ebp - 0x20], ebx
call fcn.00425880
test al, al
je 0x425a7f
call fcn.00438290
test al, al
je 0x425a10
cli
hlt
call fcn.00437b90
test al, al
je 0x425a36
push ecx
hlt
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x24], 0
call fcn.00425bf0
test al, al
je 0x425a7f
push dword [ebp - 0x28]
push 1
push dword [ebp - 0x24]
push dword [ebp + 8]
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
movzx ebx, bl
mov eax, 1
cmove ebx, eax
mov dword [ebp - 0x20], ebx
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
jne 0x425af9
pop edx
add byte [ebx + ebx*8 - 0x4317858b], al
pop ds
add dword [eax], eax
call fcn.00437a40
test al, al
je 0x425a9c
in al, dx
fild dword [esi]
xlatb
adc ch, byte [ebx + 0x62]
and dword [edi - 0x7e], edi
xchg dword [ecx + 0x6f1266e], ebp
test dword [edx + 0x6d], eax
mov ecx, 0x1262fe8
add byte [eax + eax*8 - 0x6debeb8c], al
call fcn.004380d0
test al, al
je 0x425ab9
adc al, 0x92
aas
dec esp
mov esp, 0x4506d3d4
jbe 0x425a79
cmp cl, bh
popal
ret 0xa056
call fcn.00437ea0
test al, al
je 0x425ad6
loopne 0x425a98
call 0x78880084
sti
setp byte [ebx - 0x2611c52b]
and esi, ecx
push 0xffffffffffffffb6
add byte [edx], ch
push 0
push dword [ebp + 8]
push dword [ebp - 0x28]
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov edx, dword [ebp - 0x20]
test eax, eax
movzx ecx, dl
mov eax, 1
cmovne ecx, eax
mov byte [ebp - 0x20], cl
push 0x20
push str.9aafb0a5c0f032d4f8a923f77aa11a81
lea ecx, [ebp - 0x1c]
mov dword [ebp - 8], 0xf
mov dword [ebp - 0xc], 0
mov byte [ebp - 0x1c], 0
call fcn.004075c0
cmp dword [ebp - 0xc], 0x100
mov eax, dword [ebp - 8]
jbe 0x425b4f
cmp eax, 0x10
jb 0x425b38
inc eax
lea ecx, [ebp - 0x1c]
push eax
push dword [ebp - 0x1c]
call fcn.00407ab0
push ds
mov eax, dword [0x48a99be9]
int1
cdq
invalid
cmp eax, 0x10
jb 0x425b61
inc eax
lea ecx, [ebp - 0x1c]
push eax
push dword [ebp - 0x1c]
call fcn.00407ab0
push 0x20
push str.5391e61b01dab8851e6029984c58469e
lea ecx, [ebp - 0x1c]
mov dword [ebp - 8], 0xf
mov dword [ebp - 0xc], 0
mov byte [ebp - 0x1c], 0
call fcn.004075c0
cmp dword [ebp - 0xc], 0x100
jbe 0x425bbf
mov ecx, dword [ebp - 8]
cmp ecx, 0x10
jb 0x425ba0
inc ecx
push ecx
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x1c]
call fcn.00407ab0
adc dword [ecx - 0x34], 0xffffffb1
popal
cmp al, 0x20
cmp byte [edx - 0x1a584158], bl
out dx, eax
jecxz 0x425c1a
pop ss
ja 0x425bff
in eax, 0x27
fisubr dword [ebp - 0x75]
in eax, 6
mov cl, 0x9d
cmp bl, ch
adc eax, 0x83f8458b
clc
adc byte [edx + 0xd], dh
mov eax, dword [ebp - 8]
cmp eax, 0x10
jb 0x425bd4
inc eax
lea ecx, [ebp - 0x1c]
push eax
push dword [ebp - 0x1c]
call fcn.00407ab0
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x20]
xor ecx, ebp
pop edi
pop esi
mov al, dl
pop ebx
call fcn.00572ac9
mov esp, ebp
pop ebp
ret
cld
push ebx
push esi
push edi
push 0x20
mov dword [ebp - 0x24], ecx
lea ecx, [ebp - 0x1c]
push str.47d7a4fba0195ba830ae49c31bbe6497
mov byte [ebp - 0x20], 0
mov dword [ebp - 8], 0xf
mov dword [ebp - 0xc], 0
mov byte [ebp - 0x1c], 0
call fcn.004075c0
cmp dword [ebp - 0xc], 0x100
mov eax, dword [ebp - 8]
jbe 0x425c67
add bh, al
inc ebp
hlt
cmp eax, 0x10
jb 0x425c49
inc eax
lea ecx, [ebp - 0x1c]
push eax
push dword [ebp - 0x1c]
call fcn.00407ab0
push ds
invalid
push ds
aad 0xb3
inc edi
sub ecx, esp
dec ecx
or edx, dword [ecx]
xor dword [ecx + ecx], ebx
mov byte [0xf4809528], al
add bh, byte [edx + 0x36]
add eax, 0xc82d3fdb
adc al, 0x1d
jmp 0x425c79
cmp eax, 0x10
jb 0x425c79
inc eax
lea ecx, [ebp - 0x1c]
push eax
push dword [ebp - 0x1c]
call fcn.00407ab0
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push str.Kernel32.dll
call esi
mov ebx, eax
push str.Wtsapi32.dll
mov dword [ebp - 0x28], ebx
call esi
mov dword [ebp - 0x2c], eax
test ebx, ebx
je 0x425da2
test eax, eax
je 0x425da2
call fcn.00437a40
test al, al
je 0x425cc2
fcom qword [0xb43649e8]
adc eax, 0x24c0ae
loopne 0x425c45
pop esp
rol dword [edi - 3], 0xf3
pop edx
arpl ax, bp
or dword [ecx + eax], esp
add byte [eax + eax*8 + 0x31bb1474], al
cmpsd dword [esi], dword es:[edi]
dec ebp
leave
call fcn.004380d0
test al, al
je 0x425cdf
mov ebx, 0xc94da731
sbb bh, byte ds:[ebp - 0x6bc5a79e]
mov bl, byte [ecx]
ret
call fcn.00437ea0
test al, al
je 0x425cfc
and dword [ebp - 0x64], edx
bound eax, qword [ebx]
movsd dword es:[edi], dword [esi]
insd dword es:[edi], dx
sbb dword [esp + edi], esp
adc esp, dword [esp + edi - 0x4ed89fba]
inc edx
sbb ah, bh
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x61dac0
push dword [ebp - 0x2c]
call esi
push 0x61dad4
push dword [ebp - 0x28]
mov edi, eax
call esi
test eax, eax
je 0x425d4a
test edi, edi
jne 0x425d4a
call eax
mov ebx, dword [ebp - 0x24]
push ebx
push eax
xor eax, eax
call eax
test eax, eax
je 0x425d4a
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
mov ecx, dword [ebp - 0x20]
test eax, eax
movzx ecx, cl
mov edx, 1
cmovne ecx, edx
mov dword [ebp - 0x20], ecx
call fcn.00438290
test al, al
je 0x425d64
dec eax
sub byte [edx + 0xd], al
push ebp
or dword [edi + 0x7196ce70], ebx
invalid
call fcn.00438370
test al, al
je 0x425d8c
mov eax, dword [0x7f9b9660]
int3
push dword [ebp - 0x28]
mov esi, dword [sym.imp.KERNEL32.dll_FreeLibrary]
call esi
push dword [ebp - 0x2c]
call esi
cmp byte [ebp - 0x20], 0
jne 0x425dae
call fcn.004270c0
mov ecx, dword [ebp - 0x24]
mov dword [ecx], eax
jmp 0x425db1
mov ecx, dword [ebp - 0x24]
cmp dword [ecx], 0
mov ecx, dword [ebp - 4]
pop edi
setne al
xor ecx, ebp
pop esi
pop ebx
call fcn.00572ac9
mov esp, ebp
pop ebp
ret