Function at 0x403450
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9c
mov eax, 0xedd
mov word [ebp - 0x3c], ax
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x68], ecx
movzx edx, word [ebp - 0x3c]
sub edx, 0xe54
mov eax, dword [ebp - 0x68]
movzx ecx, word [eax]
cmp edx, ecx
jl 0x40349d
mov edx, dword [ebp - 0x68]
movzx eax, word [edx]
and eax, 0xa64
mov word [ebp - 0x3c], ax
movzx ecx, word [ebp - 0x3c]
or ecx, 0x43f
mov edx, dword [ebp - 0x68]
mov word [edx], cx
jmp 0x4034fe
mov eax, dword [ebp - 0x68]
movzx ecx, word [eax]
add ecx, 0x909
movzx edx, word [ebp - 0x3c]
cmp ecx, edx
jl 0x4034fe
mov byte [ebp - 0x75], 0x7d
movzx eax, word [ebp - 0x3c]
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 0xec2
je 0x4034cd
jmp 0x4034fe
mov ecx, dword [ebp - 0x68]
movzx edx, word [ecx]
xor edx, 0xb8b
mov word [ebp - 0x3c], dx
mov eax, dword [ebp - 0x68]
movzx ecx, word [eax]
shl ecx, 2
mov word [ebp - 0x3c], cx
movzx edx, byte [ebp - 0x75]
push edx
push 0x49
push 0xdf
call fcn.00402eb0
add esp, 0xc
mov dword [ebp - 0x24], 0x2ec6
mov eax, dword [ebp - 0x68]
movzx ecx, word [eax]
mov dword [ebp - 0x90], ecx
cmp dword [ebp - 0x90], 0xdbe
je 0x40351f
jmp 0x40358a
movsx edx, byte [ebp - 0x75]
and edx, 0x1f
mov byte [ebp - 0x75], dl
mov eax, dword [ebp - 0x68]
movzx ecx, word [eax]
sub ecx, 0xb97
mov word [ebp - 0x3c], cx
mov edx, dword [ebp - 0x68]
movzx eax, word [edx]
add eax, 0x291
mov word [ebp - 0x3c], ax
lea ecx, [ebp - 0x24]
push ecx
mov edx, dword [ebp - 0x7c]
push edx
mov eax, dword [ebp - 0x64]
push eax
call dword [sym.imp.USERENV.dll_GetUserProfileDirectoryW]
mov dword [ebp - 0x44], eax
movzx ecx, word [ebp - 0x3c]
sub ecx, 0x201
mov edx, dword [ebp - 0x68]
mov word [edx], cx
movzx eax, word [ebp - 0x3c]
add eax, 0xc0c
mov ecx, dword [ebp - 0x68]
mov word [ecx], ax
mov edx, dword [ebp - 0x24]
shl edx, 0x14
mov dword [ebp - 0x24], edx
jmp 0x40381b
mov dword [ebp - 0x28], 0x2666
push 0
push 0x400
push 3
push 0
push 2
push 0x40000000
push str.C:unshapengrosslyInquisitivelydevil_societal
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x48], eax
mov eax, 0x40f
mov word [ebp - 0x60], ax
mov cx, word [ebp - 0x60]
mov word [ebp - 0x40], cx
mov edx, dword [ebp - 0x28]
mov dword [ebp - 0x18], edx
lea eax, [ebp - 0x75]
mov dword [ebp - 0x30], eax
mov byte [ebp - 0x4a], 0x66
movzx ecx, byte [ebp - 0x4a]
cmp ecx, 0x63
jl 0x40364b
lea edx, [ebp - 0x4a]
mov dword [ebp - 0x84], edx
lea eax, [ebp - 0x24]
mov dword [ebp - 0x80], eax
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x50], ecx
mov edx, dword [ebp - 0x50]
movzx eax, word [edx]
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 0x90b
je 0x40360a
jmp 0x40363b
mov ecx, dword [ebp - 0x84]
movzx edx, byte [ecx]
xor edx, 0x3c
mov byte [ebp - 0x4a], dl
movzx eax, byte [ebp - 0x75]
push eax
mov ecx, dword [ebp - 0x30]
movzx edx, byte [ecx]
push edx
mov eax, dword [ebp - 0x30]
movzx ecx, byte [eax]
push ecx
movzx edx, word [ebp - 0x40]
push edx
call fcn.00403870
add esp, 0x10
jmp 0x40364b
push 0
push 0
call dword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x74], eax
mov ecx, dword [ebp - 0x80]
mov edx, dword [ecx]
mov dword [ebp - 4], edx
lea eax, [ebp - 0x60]
mov dword [ebp - 0x10], eax
movsx ecx, byte [ebp - 0x75]
or ecx, 0x55
mov edx, dword [ebp - 0x30]
movsx eax, byte [edx]
cmp ecx, eax
je 0x4036c1
mov ecx, dword [ebp - 0x30]
movsx edx, byte [ecx]
and edx, 0x73
mov byte [ebp - 0x75], dl
mov eax, dword [ebp - 0x84]
movzx ecx, byte [eax]
movzx edx, byte [ebp - 0x4a]
add ecx, edx
mov eax, dword [ebp - 0x84]
mov byte [eax], cl
mov ecx, dword [ebp - 0x68]
movzx edx, word [ecx]
mov eax, dword [ebp - 0x50]
movzx ecx, word [eax]
sub edx, ecx
mov word [ebp - 0x3c], dx
movzx edx, byte [ebp - 0x75]
push edx
movzx eax, byte [ebp - 0x75]
push eax
mov ecx, dword [ebp - 0x30]
movzx edx, byte [ecx]
push edx
mov eax, dword [ebp - 0x10]
movzx ecx, word [eax]
push ecx
call fcn.00403870
add esp, 0x10
jmp 0x4036f3
movsx edx, word [ebp - 0x60]
mov eax, dword [ebp - 0x10]
movsx ecx, word [eax]
sub edx, ecx
movsx eax, word [ebp - 0x40]
cmp edx, eax
je 0x4036f3
mov ecx, dword [ebp - 0x74]
add ecx, dword [ebp - 0x28]
mov dword [ebp - 0x18], ecx
lea edx, [ebp - 0x24]
mov dword [ebp - 0x54], edx
mov eax, dword [ebp - 4]
mov dword [ebp - 0x88], eax
lea ecx, [ebp - 0x74]
mov dword [ebp - 0x14], ecx
movsx edx, byte [ebp - 0x75]
imul edx, edx, 0x4d
mov eax, dword [ebp - 0x30]
movsx ecx, byte [eax]
cmp edx, ecx
je 0x4037c0
movsx edx, word [ebp - 0x60]
mov dword [ebp - 0x98], edx
cmp dword [ebp - 0x98], 0x40f
je 0x403720
jmp 0x40373e
lea eax, [ebp - 0x18]
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x54]
mov edx, dword [ecx]
mov dword [ebp - 0x6c], edx
mov eax, dword [ebp - 0x80]
mov ecx, dword [eax]
sub ecx, dword [ebp - 4]
mov dword [ebp - 0x88], ecx
jmp 0x403750
mov edx, dword [ebp - 0x68]
movzx eax, word [edx]
mov ecx, dword [ebp - 0x50]
movzx edx, word [ecx]
xor eax, edx
mov word [ebp - 0x3c], ax
lea eax, [ebp - 0x4a]
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x10]
mov dx, word [ecx]
mov word [ebp - 0x38], dx
lea eax, [ebp - 0x75]
mov dword [ebp - 0x5c], eax
mov ecx, dword [ebp - 0x74]
mov dword [ebp - 0x70], ecx
lea edx, [ebp - 4]
mov dword [ebp - 0xc], edx
mov al, byte [ebp - 0x4a]
mov byte [ebp - 0x49], al
mov ecx, dword [ebp - 0x50]
mov dx, word [ecx]
mov word [ebp - 0x58], dx
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x18]
shr eax, cl
mov dword [ebp - 0x70], eax
push str.4OzasY_Yzt.AHPD
call dword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [ebp - 8], ax
mov ecx, dword [ebp - 0x6c]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x54]
mov eax, dword [ebp - 4]
mov ecx, dword [edx]
shl eax, cl
mov ecx, dword [ebp - 0x80]
mov dword [ecx], eax
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x34]
mov eax, dword [edx]
xor edx, edx
div dword [ecx]
mov dword [ebp - 0x70], eax
mov edx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x80]
mov ecx, dword [edx]
and ecx, dword [eax]
mov dword [ebp - 0x88], ecx
mov edx, dword [ebp - 0x84]
mov al, byte [edx]
mov byte [ebp - 0x9c], al
cmp byte [ebp - 0x9c], 0x18
je 0x4037e9
jmp 0x4037eb
jmp 0x4037f8
mov ecx, dword [ebp - 0x54]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x80]
add edx, dword [eax]
mov dword [ebp - 4], edx
mov ecx, dword [ebp - 0x50]
movzx edx, word [ecx]
movzx eax, word [ebp - 0x3c]
add edx, eax
mov ecx, dword [ebp - 0x68]
mov word [ecx], dx
mov edx, dword [ebp - 0x84]
movzx eax, byte [edx]
sub eax, 0x92
mov byte [ebp - 0x4a], al
movsx ecx, byte [ebp - 0x75]
sar ecx, 7
mov byte [ebp - 0x75], cl
mov edx, dword [ebp - 0x68]
movzx eax, word [edx]
movzx ecx, word [ebp - 0x3c]
sub eax, ecx
mov edx, dword [ebp - 0x68]
mov word [edx], ax
mov eax, dword [ebp - 0x24]
add eax, 0x274f
mov dword [ebp - 0x24], eax
movzx ecx, byte [ebp - 0x75]
push ecx
mov edx, dword [ebp - 0x68]
movzx eax, word [edx]
push eax
mov ecx, dword [ebp - 0x68]
movzx edx, word [ecx]
push edx
mov edx, dword [ebp - 0x3c]
mov cl, byte [ebp - 0x75]
call fcn.00404530
mov eax, 6
mov esp, ebp
pop ebp
ret